diff --git a/linux/build/docker/Dockerfile.builder b/linux/build/docker/Dockerfile.builder
index 328894b..58f98ae 100644
--- a/linux/build/docker/Dockerfile.builder
+++ b/linux/build/docker/Dockerfile.builder
@@ -78,6 +78,25 @@ RUN set -eux; \
     apt-get clean; \
     rm -rf /var/lib/apt/lists/*
 
+# systemctl no-op shim.
+# derivative-maker's build steps call `sudo systemctl daemon-reload` /
+# `systemctl restart approx` / etc. as part of host-machine preparation,
+# assuming systemd is PID 1 on the build host. Upstream's own container
+# image runs systemd-in-container; we don't, so any real systemctl call
+# would fail. The shim returns success for every invocation and logs
+# what was attempted, which is the standard pattern for running
+# systemd-aware build scripts in transient containers without actual
+# systemd. /usr/local/bin precedes /usr/bin in both default $PATH and
+# sudo's secure_path, so this masks any real systemctl that might land
+# later via package install.
+RUN printf '%s\n' '#!/bin/sh' \
+    '# systemctl no-op shim for systemd-less build containers.' \
+    '# Logs the attempt to stderr and returns success.' \
+    'echo "systemctl-shim: $*" >&2' \
+    'exit 0' \
+    > /usr/local/bin/systemctl \
+    && chmod 0755 /usr/local/bin/systemctl
+
 # Non-root user for derivative-maker.
 # Kicksecure's derivative-maker explicitly refuses to run as root and uses
 # sudo internally for its privileged operations (debootstrap, mksquashfs,
diff --git a/linux/build/scripts/build.sh b/linux/build/scripts/build.sh
index 987efa5..22cf8b5 100755
--- a/linux/build/scripts/build.sh
+++ b/linux/build/scripts/build.sh
@@ -32,7 +32,7 @@ cd "${REPO_ROOT}"
 # outside the LAN — it's the entry that fleet-wide /etc/docker/daemon.json
 # registers as an insecure-registry. The host-style "docker-registry:5000"
 # is *not* DNS-resolvable; do not use it.
-BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:c1490bab7785e86b431cea3efaf60c4c41b566fd3de085f5f0c4a53b236e5c97}"
+BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:70f160ab6084c49b81262e3625425848eb678c4b13175fb1b201cfb1fa075460}"
 
 if [[ "${BUILDER_IMAGE}" != *"@sha256:"* ]]; then
     echo "build.sh: BUILDER_IMAGE must be pinned by digest, got: ${BUILDER_IMAGE}" >&2