diff --git a/linux/build/docker/Dockerfile.builder b/linux/build/docker/Dockerfile.builder
index f4fd129..328894b 100644
--- a/linux/build/docker/Dockerfile.builder
+++ b/linux/build/docker/Dockerfile.builder
@@ -60,11 +60,17 @@ RUN set -eux; \
         fakeroot \
         git \
         gnupg \
+        gpg-agent \
         isolinux \
         live-build \
         mtools \
         reprepro \
         rsync \
+        sequoia-chameleon-gnupg \
+        sequoia-git \
+        sq \
+        sqop \
+        sqv \
         squashfs-tools \
         sudo \
         syslinux-common \
diff --git a/linux/build/scripts/build.sh b/linux/build/scripts/build.sh
index 1ec4559..987efa5 100755
--- a/linux/build/scripts/build.sh
+++ b/linux/build/scripts/build.sh
@@ -32,7 +32,7 @@ cd "${REPO_ROOT}"
 # outside the LAN — it's the entry that fleet-wide /etc/docker/daemon.json
 # registers as an insecure-registry. The host-style "docker-registry:5000"
 # is *not* DNS-resolvable; do not use it.
-BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:7d893178b4910de5654b503640caa40421f452294aca80e71b0814b152ef1890}"
+BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:c1490bab7785e86b431cea3efaf60c4c41b566fd3de085f5f0c4a53b236e5c97}"
 
 if [[ "${BUILDER_IMAGE}" != *"@sha256:"* ]]; then
     echo "build.sh: BUILDER_IMAGE must be pinned by digest, got: ${BUILDER_IMAGE}" >&2