diff --git a/.github/workflows/publish_dockerhub_k8s_cache_main.yml b/.github/workflows/publish_dockerhub_k8s_cache_main.yml
index cc52c15157..35fba3b34b 100644
--- a/.github/workflows/publish_dockerhub_k8s_cache_main.yml
+++ b/.github/workflows/publish_dockerhub_k8s_cache_main.yml
@@ -10,6 +10,10 @@ on:
         description: "Git ref (commit, branch, or tag) to check out"
         required: false
         type: string
+    secrets:
+      DOCKER_TOKEN_EBPF_INSTRUMENTATION:
+        description: "Docker Hub access token for otel"
+        required: true
 
 permissions:
   contents: read
diff --git a/.github/workflows/publish_dockerhub_main.yml b/.github/workflows/publish_dockerhub_main.yml
index 5eba2d3cd5..460a0ebc18 100644
--- a/.github/workflows/publish_dockerhub_main.yml
+++ b/.github/workflows/publish_dockerhub_main.yml
@@ -10,6 +10,10 @@ on:
         description: "Git ref (commit, branch, or tag) to check out"
         required: false
         type: string
+    secrets:
+      DOCKER_TOKEN_EBPF_INSTRUMENTATION:
+        description: "Docker Hub access token for otel"
+        required: true
 
 permissions:
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27e97b97fa..b86a6545eb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -228,6 +228,8 @@ jobs:
       packages: write
     with:
       ref: ${{ inputs.tag || github.ref_name }}
+    secrets:
+      DOCKER_TOKEN_EBPF_INSTRUMENTATION: ${{ secrets.DOCKER_TOKEN_EBPF_INSTRUMENTATION }}
 
   docker-publish-k8s-cache:
     name: Publish Docker Image (k8s cache)
@@ -239,6 +241,8 @@ jobs:
       packages: write
     with:
       ref: ${{ inputs.tag || github.ref_name }}
+    secrets:
+      DOCKER_TOKEN_EBPF_INSTRUMENTATION: ${{ secrets.DOCKER_TOKEN_EBPF_INSTRUMENTATION }}
 
   build-artifacts:
     name: Build Release Artifacts
diff --git a/Makefile b/Makefile
index b843ff4ab7..b3d9fe55fc 100644
--- a/Makefile
+++ b/Makefile
@@ -179,7 +179,7 @@ generate: $(BPF2GO)
 .PHONY: docker-generate
 docker-generate:
 	@echo "### Generating files (docker)..."
-	@OTEL_EBPF_GENFILES_GEN_IMG=$(GEN_IMG) go generate cmd/obi-genfiles/obi_genfiles.go
+	@GOOS=$(shell go env GOHOSTOS) GOARCH=$(shell go env GOHOSTARCH) OTEL_EBPF_GENFILES_GEN_IMG=$(GEN_IMG) go generate cmd/obi-genfiles/obi_genfiles.go
 
 .PHONY: verify
 verify: prereqs lint test license-header-check
@@ -443,10 +443,15 @@ license-header-check:
 .PHONY: artifact
 artifact: docker-generate compile compile-cache java-docker-build
 	@echo "### Packing generated artifact for $(GOOS)/$(GOARCH)"
-	cp LICENSE ./bin
-	cp NOTICE ./bin
-	cp -r NOTICES ./bin
-	tar -C ./bin -czf bin/obi-$(RELEASE_VERSION)-$(GOOS)-$(GOARCH).tar.gz $(CMD) $(CACHE_CMD) $(JAVA_AGENT) LICENSE NOTICE NOTICES
+	@STAGING_DIR=$$(mktemp -d 2>/dev/null || mktemp -d -t obi.XXXXXX); \
+	trap "rm -rf $$STAGING_DIR" EXIT; \
+	cp ./bin/$(CMD) $$STAGING_DIR/; \
+	cp ./bin/$(CACHE_CMD) $$STAGING_DIR/; \
+	cp ./bin/$(JAVA_AGENT) $$STAGING_DIR/; \
+	cp LICENSE $$STAGING_DIR/; \
+	cp NOTICE $$STAGING_DIR/; \
+	cp -r NOTICES $$STAGING_DIR/; \
+	tar -C $$STAGING_DIR -czf bin/obi-$(RELEASE_VERSION)-$(GOOS)-$(GOARCH).tar.gz $(CMD) $(CACHE_CMD) $(JAVA_AGENT) LICENSE NOTICE NOTICES
 
 .PHONY: release
 release: clean-release-dir