diff --git a/deploy/docker/Dockerfile.konflux.cli b/deploy/docker/Dockerfile.konflux.cli
index 135f7eee1f..f2b9d892ae 100644
--- a/deploy/docker/Dockerfile.konflux.cli
+++ b/deploy/docker/Dockerfile.konflux.cli
@@ -20,7 +20,7 @@ ARG RUST_VERSION=1.92.0
 # ---------------------------------------------------------------------------
 # Build stage: compile CLI (fully-static glibc binary)
 # ---------------------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9/ubi:9.6@sha256:dec374e05cc13ebbc0975c9f521f3db6942d27f8ccdf06b180160490eef8bdbc AS builder
+FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d17538c8dbe55d8c305fa157ecc3f9c8977b05b6 AS builder
 
 ARG RUST_VERSION
 ARG TARGETARCH
@@ -73,7 +73,7 @@ RUN . /tmp/build-env && \
 # ---------------------------------------------------------------------------
 # Runtime
 # ---------------------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
 
 RUN microdnf install -y --nodocs ca-certificates \
     && microdnf clean all
diff --git a/deploy/docker/Dockerfile.konflux.gateway b/deploy/docker/Dockerfile.konflux.gateway
index 1ffe9a27e8..0f1a8916ee 100644
--- a/deploy/docker/Dockerfile.konflux.gateway
+++ b/deploy/docker/Dockerfile.konflux.gateway
@@ -14,7 +14,7 @@
 # ---------------------------------------------------------------------------
 # Build
 # ---------------------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9/ubi:9.6@sha256:dec374e05cc13ebbc0975c9f521f3db6942d27f8ccdf06b180160490eef8bdbc AS builder
+FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d17538c8dbe55d8c305fa157ecc3f9c8977b05b6 AS builder
 
 RUN dnf install -y --nodocs --setopt=install_weak_deps=0 \
         rust cargo \
@@ -48,13 +48,13 @@ RUN mkdir -p /tmp/z3-src \
     && if [ -n "$VER" ]; then export OPENSHELL_GIT_VERSION="$VER"; fi \
     && Z3_SYS_BUNDLED_DIR_OVERRIDE=/tmp/z3-src \
     cargo build --release \
-        --package openshell-server \
+        --package openshell-gateway \
         --features bundled-z3
 
 # ---------------------------------------------------------------------------
 # Runtime
 # ---------------------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
 
 RUN microdnf install -y --nodocs --setopt=install_weak_deps=0 ca-certificates \
     && microdnf clean all
diff --git a/deploy/docker/Dockerfile.konflux.supervisor b/deploy/docker/Dockerfile.konflux.supervisor
index b6f7b953c2..b771041dcf 100644
--- a/deploy/docker/Dockerfile.konflux.supervisor
+++ b/deploy/docker/Dockerfile.konflux.supervisor
@@ -21,7 +21,7 @@ ARG RUST_VERSION=1.92.0
 # ---------------------------------------------------------------------------
 # Build stage: compile supervisor (fully-static glibc binary)
 # ---------------------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9/ubi:9.6@sha256:dec374e05cc13ebbc0975c9f521f3db6942d27f8ccdf06b180160490eef8bdbc AS builder
+FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d17538c8dbe55d8c305fa157ecc3f9c8977b05b6 AS builder
 
 ARG RUST_VERSION
 ARG TARGETARCH
@@ -69,7 +69,7 @@ RUN . /tmp/build-env && \
 # ---------------------------------------------------------------------------
 # Runtime
 # ---------------------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
 
 ARG TARGETARCH
 
diff --git a/deploy/konflux/cli/rpms.in.yaml b/deploy/konflux/cli/rpms.in.yaml
index 69e1024f5b..38f70f6a84 100644
--- a/deploy/konflux/cli/rpms.in.yaml
+++ b/deploy/konflux/cli/rpms.in.yaml
@@ -5,7 +5,7 @@
 # Build + runtime stages combined.
 #
 # Resolved with `context.bare: true` so the lockfile pins the full dependency
-# closure. The image installs RPMs into two different bases (the ubi:9.6 build
+# closure. The image installs RPMs into two different bases (the ubi:9.8 build
 # stage and the ubi-minimal runtime stage); bare guarantees every package is
 # pinned and prefetched regardless of which base already provides it.
 #
diff --git a/deploy/konflux/gateway/rpms.in.yaml b/deploy/konflux/gateway/rpms.in.yaml
index 06eb993039..880dee734b 100644
--- a/deploy/konflux/gateway/rpms.in.yaml
+++ b/deploy/konflux/gateway/rpms.in.yaml
@@ -2,7 +2,7 @@
 # Build + runtime stages combined.
 #
 # Resolved with `context.bare: true` so the lockfile pins the full dependency
-# closure. The image installs RPMs into two different bases (the ubi:9.6 build
+# closure. The image installs RPMs into two different bases (the ubi:9.8 build
 # stage and the ubi-minimal runtime stage); bare guarantees every package is
 # pinned and prefetched regardless of which base already provides it.
 #
diff --git a/deploy/konflux/supervisor/rpms.in.yaml b/deploy/konflux/supervisor/rpms.in.yaml
index 837aea5063..e21a62fc0e 100644
--- a/deploy/konflux/supervisor/rpms.in.yaml
+++ b/deploy/konflux/supervisor/rpms.in.yaml
@@ -2,7 +2,7 @@
 # Build + runtime stages combined.
 #
 # Resolved with `context.bare: true` so the lockfile pins the full dependency
-# closure. The image installs RPMs into two different bases (the ubi:9.6 build
+# closure. The image installs RPMs into two different bases (the ubi:9.8 build
 # stage and the ubi-minimal runtime stage); bare guarantees every package is
 # pinned and prefetched regardless of which base already provides it.
 #