diff --git a/package/Dockerfile b/package/Dockerfile
index 9e7e9ee..d6a222c 100644
--- a/package/Dockerfile
+++ b/package/Dockerfile
@@ -1,12 +1,48 @@
-ARG BCI_VERSION=15.7
-FROM ghcr.io/flavio/kuberlr:v0.6.1 AS kuberlr
+ARG BCI_VERSION=16.0
+ARG GO_IMAGE=rancher/hardened-build-base:v1.26.4b1
+
+# xx provides cross-compilation helpers so the builder always runs on the build
+# machine's native arch while targeting TARGETPLATFORM.
+FROM --platform=$BUILDPLATFORM rancher/mirrored-tonistiigi-xx:1.6.1 AS xx
+
+# Single stage builds all kubectl versions listed in kubectl-versions.txt.
+FROM --platform=$BUILDPLATFORM ${GO_IMAGE}  AS kubectl-builder
+COPY --from=xx / /
+ARG TARGETPLATFORM
+RUN xx-go --wrap
+
+WORKDIR /build
+COPY kubectl-versions.txt .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    set -e && \
+    mkdir -p /kubectl-bins && \
+    while read -r version; do \
+        echo "==> Building kubectl ${version}"; \
+        curl -fsSL \
+            https://github.com/kubernetes/kubernetes/archive/refs/tags/${version}.tar.gz | \
+            tar -xz && \
+        cd kubernetes-${version#v} && \
+        KUBE_GIT_VERSION=${version} \
+        KUBE_GIT_COMMIT=unknown \
+        KUBE_GIT_TREE_STATE=clean \
+        KUBE_BUILD_PLATFORMS=$(xx-info os)/$(xx-info arch) \
+        GOFLAGS="-tags=providerless" \
+        CGO_ENABLED=0 \
+        make WHAT=cmd/kubectl && \
+        xx-verify --static _output/local/bin/$(xx-info os)/$(xx-info arch)/kubectl && \
+        cp _output/local/bin/$(xx-info os)/$(xx-info arch)/kubectl /kubectl-bins/kubectl${version#v} && \
+        cd /build && rm -rf kubernetes-${version#v}; \
+    done < kubectl-versions.txt
+
+FROM ghcr.io/flavio/kuberlr:v0.7.0 AS kuberlr
 FROM registry.suse.com/bci/bci-busybox:${BCI_VERSION} AS final
 FROM registry.suse.com/bci/bci-base:${BCI_VERSION} AS zypper
 
 ARG TARGETPLATFORM
 ARG TARGETARCH
 
-# Creates the based dir for the target image, and hydrates it with the
+# Creates the base dir for the target image, and hydrates it with the
 # original contents of the final image.
 RUN mkdir /chroot
 COPY --from=final / /chroot/
@@ -15,6 +51,7 @@ COPY --from=final / /chroot/
 # install all artefacts within a dir (/chroot) that can then be copied
 # over to a scratch image.
 RUN zypper --non-interactive refresh && \
+    zypper --installroot /chroot --non-interactive update && \
     zypper --installroot /chroot -n rm busybox-vi busybox-links && \
     zypper --installroot /chroot -n in bash-completion && \
     zypper --installroot /chroot clean -a && \
@@ -25,15 +62,8 @@ COPY --from=kuberlr /bin/kuberlr /chroot/bin/
 RUN cd /chroot/bin && ln -s ./kuberlr ./kubectl
 COPY --from=kuberlr /home/kuberlr /chroot/home/kuberlr
 
-WORKDIR /tmp
-COPY kubectl-versions.txt /tmp/kubectl-versions.txt
-# kuberlr get verifies bin hash for us
-RUN while read -r version; do \
-    /chroot/bin/kuberlr get $version; \
-    done < ./kubectl-versions.txt; \
-    /chroot/bin/kuberlr bins \
-    && cp -a /root/.kuberlr/linux-*/* /chroot/usr/bin/ \
-    && /chroot/bin/kuberlr bins
+# Copy all kubectl binaries built from source
+COPY --from=kubectl-builder /kubectl-bins/ /chroot/usr/bin/
 
 # Disable ability to download kubectl due to air-gap support
 RUN sed -i 's/AllowDownload = true/AllowDownload = false/' /chroot/home/kuberlr/.kuberlr/kuberlr.conf
@@ -51,4 +81,4 @@ COPY --from=zypper /chroot /
 USER kuberlr
 WORKDIR /home/kuberlr
 ENTRYPOINT ["/bin/kubectl"]
-CMD ["help"]
\ No newline at end of file
+CMD ["help"]
diff --git a/scripts/verify-local-multiarch-image b/scripts/verify-local-multiarch-image
index d3672a6..87f0e0e 100755
--- a/scripts/verify-local-multiarch-image
+++ b/scripts/verify-local-multiarch-image
@@ -8,7 +8,7 @@ CI_ROOT="./ci"
 OCI_ARCHIVE_PATH=${OCI_ARCHIVE_PATH:-"$CI_ROOT/multiarch-image.oci"}
 CI_LOG_FILE="$CI_ROOT/image-ci-$(date +'%Y%m%d-%H%M%S').log"
 TARGET_FILES=(
-  "/bin/kuberlr"
+  "/usr/bin/kuberlr"
   "/usr/bin/kube*"
 )
 OUTPUT_DIR="$CI_ROOT/files"
@@ -30,6 +30,7 @@ cleanup() {
   pwd
     if [[ -n "$TEMP_DIR" && -d "$TEMP_DIR" ]]; then
         log "Cleaning up temporary directory: $TEMP_DIR"
+        chmod -R u+rwx "$TEMP_DIR" 2>/dev/null || true
         rm -rf "$TEMP_DIR"
     fi
 }
@@ -264,4 +265,4 @@ echo "$IMAGE_MANIFESTS" | jq -c '.[]' | while IFS= read -r manifest_entry; do
 done
 
 log "🏁 Finished processing all manifests."
-log "📝 CI log saved to: $CI_LOG_FILE"
\ No newline at end of file
+log "📝 CI log saved to: $CI_LOG_FILE"