diff --git a/.gitignore b/.gitignore
index ef640962..140e5af6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2023-11-02T12:25:12Z by kres a0777d5-dirty.
+# Generated on 2026-08-03T16:58:42Z by kres 93d28ca.
 
 _out
+*.local.md
+*.override.md
diff --git a/.kres.yaml b/.kres.yaml
index 9a6f535f..b7a44f08 100644
--- a/.kres.yaml
+++ b/.kres.yaml
@@ -18,6 +18,12 @@ spec:
     - tools-zlib
     - tools-zstd
   reproducibleTargetName: tools
+  extraBuildArgs:
+    - GNU_MIRROR_URL
+  makefile:
+    extraVariables:
+      - name: GNU_MIRROR_URL
+        defaultValue: https://mirrors.kernel.org
 ---
 kind: common.Renovate
 spec:
diff --git a/Makefile b/Makefile
index 465cada4..aec552b7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-07-14T16:01:15Z by kres d66531d.
+# Generated on 2026-08-03T16:59:21Z by kres 93d28ca.
 
 # common variables
 
@@ -40,6 +40,7 @@ PUSH ?= false
 CI_ARGS ?=
 WITH_BUILD_DEBUG ?=
 BUILD_ARGS = --build-arg=SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH)
+BUILD_ARGS += --build-arg=GNU_MIRROR_URL="$(GNU_MIRROR_URL)"
 COMMON_ARGS = --file=Pkgfile
 COMMON_ARGS += --provenance=false
 COMMON_ARGS += --sbom=false
@@ -47,6 +48,10 @@ COMMON_ARGS += --progress=$(PROGRESS)
 COMMON_ARGS += --platform=$(PLATFORM)
 COMMON_ARGS += $(BUILD_ARGS)
 
+# extra variables
+
+GNU_MIRROR_URL ?= https://mirrors.kernel.org
+
 # targets defines all the available targets
 
 TARGETS = tools
diff --git a/Pkgfile b/Pkgfile
index 546a3c23..35f843a3 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -5,7 +5,7 @@
 format: v1alpha2
 
 vars:
-  TOOLCHAIN_IMAGE: ghcr.io/siderolabs/toolchain:v1.12.0-14-g82698c2
+  TOOLCHAIN_IMAGE: ghcr.io/siderolabs/toolchain:v1.12.0-16-g9883fce
 
   # renovate: datasource=github-tags depName=argp-standalone/argp-standalone
   argp_standalone_version: 1.5.0
@@ -238,9 +238,9 @@ vars:
   ninja_sha512: ec94d42967b962d66ab0747fcb9d095510117159de0473ec08df47a657895aa2523f920798e4608d0c6cf0e2e382512c14aec8a54ea58b6cd4b01edd3a7c8e62
 
   # renovate: datasource=github-releases extractVersion=^openssl-(?<version>.*)$ depName=openssl/openssl
-  openssl_version: 3.6.3
-  openssl_sha256: 243a86649cf6f23eeb6a2ff2456e09e5d77dd9018a54d3d96b0c6bdd6ba6c7f1
-  openssl_sha512: 4179ad56f285fd27a1c7b294472afdca588e915d4f8a9610e461f34f0678004aebe32e88434ae536a63a7c9aff6607702a3b341e2faacb7899c27d6def4cc92d
+  openssl_version: 3.6.4
+  openssl_sha256: 9bffaa1ad1e07b354c21bd3324ec02fa15579f45a7d0494b3e74bc449b7333ef
+  openssl_sha512: 9e7f4039082880357969c0857f33b20a6a4306d1b5e4f8fcbd7ec8dc41edc96e87c526a1db0b8259f5000c4ced84149b03547562ce4f9df35194634a7576dac0
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/devel/pahole/pahole.git
   pahole_version: 1.31
diff --git a/autoconf/pkg.yaml b/autoconf/pkg.yaml
index 63c73908..10539ada 100644
--- a/autoconf/pkg.yaml
+++ b/autoconf/pkg.yaml
@@ -8,7 +8,7 @@ dependencies:
     runtime: yes
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/autoconf/autoconf-{{ .autoconf_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/autoconf/autoconf-{{ .autoconf_version }}.tar.xz"
         destination: autoconf.tar.xz
         sha256: "{{ .autoconf_sha256 }}"
         sha512: "{{ .autoconf_sha512 }}"
diff --git a/automake/pkg.yaml b/automake/pkg.yaml
index f4ae2913..d661e278 100644
--- a/automake/pkg.yaml
+++ b/automake/pkg.yaml
@@ -7,7 +7,7 @@ dependencies:
   - stage: autoconf
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/automake/automake-{{ .automake_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/automake/automake-{{ .automake_version }}.tar.xz"
         destination: automake.tar.xz
         sha256: "{{ .automake_sha256 }}"
         sha512: "{{ .automake_sha512 }}"
diff --git a/bash/pkg.yaml b/bash/pkg.yaml
index c9f94a47..11b7bef0 100644
--- a/bash/pkg.yaml
+++ b/bash/pkg.yaml
@@ -8,7 +8,7 @@ dependencies:
     runtime: true
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/bash/bash-{{ .bash_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/bash/bash-{{ .bash_version }}.tar.gz"
         destination: bash.tar.gz
         sha256: "{{ .bash_sha256 }}"
         sha512: "{{ .bash_sha512 }}"
diff --git a/bc/pkg.yaml b/bc/pkg.yaml
index 43728b51..d1e658f2 100644
--- a/bc/pkg.yaml
+++ b/bc/pkg.yaml
@@ -7,10 +7,10 @@ dependencies:
   - stage: perl
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/bc/bc-{{ .bc_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/bc/bc-{{ .bc_version }}.tar.gz"
         destination: bc.tar.gz
-        sha256: {{ .bc_sha256 }}
-        sha512: {{ .bc_sha512 }}
+        sha256: "{{ .bc_sha256 }}"
+        sha512: "{{ .bc_sha512 }}"
     prepare:
       - |
         tar -xzf bc.tar.gz --strip-components=1
diff --git a/bison/pkg.yaml b/bison/pkg.yaml
index d216a8ab..5e2b8854 100644
--- a/bison/pkg.yaml
+++ b/bison/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: perl
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/bison/bison-{{ .bison_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/bison/bison-{{ .bison_version }}.tar.xz"
         destination: bison.tar.xz
         sha256: "{{ .bison_sha256 }}"
         sha512: "{{ .bison_sha512 }}"
diff --git a/coreutils/pkg.yaml b/coreutils/pkg.yaml
index 09e30828..7426ac47 100644
--- a/coreutils/pkg.yaml
+++ b/coreutils/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/coreutils/coreutils-{{ .coreutils_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/coreutils/coreutils-{{ .coreutils_version }}.tar.xz"
         destination: coreutils.tar.xz
         sha256: "{{ .coreutils_sha256 }}"
         sha512: "{{ .coreutils_sha512 }}"
diff --git a/diffutils/pkg.yaml b/diffutils/pkg.yaml
index 36321513..231ff824 100644
--- a/diffutils/pkg.yaml
+++ b/diffutils/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/diffutils/diffutils-{{ .diffutils_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/diffutils/diffutils-{{ .diffutils_version }}.tar.xz"
         destination: diffutils.tar.xz
         sha256: "{{ .diffutils_sha256 }}"
         sha512: "{{ .diffutils_sha512 }}"
diff --git a/dwarfutils/pkg.yaml b/dwarfutils/pkg.yaml
index abfc0b69..11b6b9a1 100644
--- a/dwarfutils/pkg.yaml
+++ b/dwarfutils/pkg.yaml
@@ -10,7 +10,7 @@ steps:
         sha256: "{{ .dwarfutils_sha256 }}"
         sha512: "{{ .dwarfutils_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xvf dwarfutils.tar.xz --strip-components=1
diff --git a/fakeroot/pkg.yaml b/fakeroot/pkg.yaml
index d4910cde..89753778 100644
--- a/fakeroot/pkg.yaml
+++ b/fakeroot/pkg.yaml
@@ -9,7 +9,7 @@ dependencies:
   - stage: tools-libcap
 steps:
   - sources:
-      - url: https://ftp.debian.org/debian/pool/main/f/fakeroot/fakeroot_{{ .fakeroot_version }}.orig.tar.gz
+      - url: https://snapshot.debian.org/file/8cb51d4e3fab1c967ebc2785aec7b108d06de335/fakeroot_{{ .fakeroot_version }}.orig.tar.gz
         destination: fakeroot.tar.gz
         sha256: "{{ .fakeroot_sha256 }}"
         sha512: "{{ .fakeroot_sha512 }}"
diff --git a/findutils/pkg.yaml b/findutils/pkg.yaml
index 1d92e985..451560a4 100644
--- a/findutils/pkg.yaml
+++ b/findutils/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/findutils/findutils-{{ .findutils_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/findutils/findutils-{{ .findutils_version }}.tar.xz"
         destination: findutils.tar.gz
         sha256: "{{ .findutils_sha256 }}"
         sha512: "{{ .findutils_sha512 }}"
diff --git a/gawk/pkg.yaml b/gawk/pkg.yaml
index cfaaee75..a47fb16a 100644
--- a/gawk/pkg.yaml
+++ b/gawk/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/gawk/gawk-{{ .gawk_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gawk/gawk-{{ .gawk_version }}.tar.xz"
         destination: gawk.tar.xz
         sha256: "{{ .gawk_sha256 }}"
         sha512: "{{ .gawk_sha512 }}"
diff --git a/gmp/pkg.yaml b/gmp/pkg.yaml
index 80bd9c82..96b93398 100644
--- a/gmp/pkg.yaml
+++ b/gmp/pkg.yaml
@@ -9,7 +9,7 @@ dependencies:
   - stage: m4
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/gmp/gmp-{{ .gmp_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gmp/gmp-{{ .gmp_version }}.tar.xz"
         destination: gmp.tar.xz
         sha256: "{{ .gmp_sha256 }}"
         sha512: "{{ .gmp_sha512 }}"
diff --git a/gperf/pkg.yaml b/gperf/pkg.yaml
index 19731d0a..2f3c49fa 100644
--- a/gperf/pkg.yaml
+++ b/gperf/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: http://ftpmirror.gnu.org/gnu/gperf/gperf-{{ .gperf_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gperf/gperf-{{ .gperf_version }}.tar.gz"
         destination: gperf.tar.gz
         sha256: "{{ .gperf_sha256 }}"
         sha512: "{{ .gperf_sha512 }}"
diff --git a/grep/pkg.yaml b/grep/pkg.yaml
index fd8b1082..0fc42907 100644
--- a/grep/pkg.yaml
+++ b/grep/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/grep/grep-{{ .grep_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/grep/grep-{{ .grep_version }}.tar.xz"
         destination: grep.tar.xz
         sha256: "{{ .grep_sha256 }}"
         sha512: "{{ .grep_sha512 }}"
diff --git a/gzip/pkg.yaml b/gzip/pkg.yaml
index 9904ac87..659cade0 100644
--- a/gzip/pkg.yaml
+++ b/gzip/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/gzip/gzip-{{ .gzip_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gzip/gzip-{{ .gzip_version }}.tar.xz"
         destination: gzip.tar.xz
         sha256: "{{ .gzip_sha256 }}"
         sha512: "{{ .gzip_sha512 }}"
diff --git a/libtasn1/pkg.yaml b/libtasn1/pkg.yaml
index 3f5a7b3c..31621b32 100644
--- a/libtasn1/pkg.yaml
+++ b/libtasn1/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/libtasn1/libtasn1-{{ .libtasn1_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/libtasn1/libtasn1-{{ .libtasn1_version }}.tar.gz"
         destination: libtasn1.tar.gz
         sha256: "{{ .libtasn1_sha256 }}"
         sha512: "{{ .libtasn1_sha512 }}"
diff --git a/libtool/pkg.yaml b/libtool/pkg.yaml
index fcc0f1b9..52009eca 100644
--- a/libtool/pkg.yaml
+++ b/libtool/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
     runtime: true
 steps:
   - sources:
-      - url: http://ftpmirror.gnu.org/libtool/libtool-{{ .libtool_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/libtool/libtool-{{ .libtool_version }}.tar.gz"
         destination: libtool.tar.gz
         sha256: "{{ .libtool_sha256 }}"
         sha512: "{{ .libtool_sha512 }}"
diff --git a/libunistring/pkg.yaml b/libunistring/pkg.yaml
index 50553b22..b9960d01 100644
--- a/libunistring/pkg.yaml
+++ b/libunistring/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/libunistring/libunistring-{{ .libunistring_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/libunistring/libunistring-{{ .libunistring_version }}.tar.xz"
         destination: libunistring.tar.xz
         sha256: "{{ .libunistring_sha256 }}"
         sha512: "{{ .libunistring_sha512 }}"
diff --git a/m4/pkg.yaml b/m4/pkg.yaml
index 868e8dfa..4deb9959 100644
--- a/m4/pkg.yaml
+++ b/m4/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/m4/m4-{{ .m4_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/m4/m4-{{ .m4_version }}.tar.xz"
         destination: m4.tar.xz
         sha256: "{{ .m4_sha256 }}"
         sha512: "{{ .m4_sha512 }}"
diff --git a/mpc/pkg.yaml b/mpc/pkg.yaml
index d3a98172..f26d63bd 100644
--- a/mpc/pkg.yaml
+++ b/mpc/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: mpfr
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/mpc/mpc-{{ .mpc_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/mpc/mpc-{{ .mpc_version }}.tar.gz"
         destination: mpc.tar.gz
         sha256: "{{ .mpc_sha256 }}"
         sha512: "{{ .mpc_sha512 }}"
diff --git a/mpfr/pkg.yaml b/mpfr/pkg.yaml
index e059c8a0..2131eeae 100644
--- a/mpfr/pkg.yaml
+++ b/mpfr/pkg.yaml
@@ -5,7 +5,7 @@ dependencies:
   - stage: gmp
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/mpfr/mpfr-{{ .mpfr_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/mpfr/mpfr-{{ .mpfr_version }}.tar.xz"
         destination: mpfr.tar.xz
         sha256: "{{ .mpfr_sha256 }}"
         sha512: "{{ .mpfr_sha512 }}"
diff --git a/ncurses/pkg.yaml b/ncurses/pkg.yaml
index 0c5e8750..9eee08b1 100644
--- a/ncurses/pkg.yaml
+++ b/ncurses/pkg.yaml
@@ -5,12 +5,12 @@ dependencies:
   - stage: patch
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/ncurses/ncurses-{{ .ncurses_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/ncurses/ncurses-{{ .ncurses_version }}.tar.gz"
         destination: ncurses.tar.gz
         sha256: "{{ .ncurses_sha256 }}"
         sha512: "{{ .ncurses_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xzf ncurses.tar.gz --strip-components=1
diff --git a/nettle/pkg.yaml b/nettle/pkg.yaml
index cdd24b96..0dff2208 100644
--- a/nettle/pkg.yaml
+++ b/nettle/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: gmp
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/nettle/nettle-{{ .nettle_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/nettle/nettle-{{ .nettle_version }}.tar.gz"
         destination: nettle.tar.gz
         sha256: "{{ .nettle_sha256 }}"
         sha512: "{{ .nettle_sha512 }}"
diff --git a/patch/pkg.yaml b/patch/pkg.yaml
index 6ae51169..c364f7ab 100644
--- a/patch/pkg.yaml
+++ b/patch/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/patch/patch-{{ .patch_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/patch/patch-{{ .patch_version }}.tar.xz"
         destination: patch.tar.xz
         sha256: "{{ .patch_sha256 }}"
         sha512: "{{ .patch_sha512 }}"
diff --git a/perl/pkg.yaml b/perl/pkg.yaml
index 344bc524..e5d78e9f 100644
--- a/perl/pkg.yaml
+++ b/perl/pkg.yaml
@@ -10,7 +10,7 @@ steps:
       sha256: "{{ .perl_sha256 }}"
       sha512: "{{ .perl_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xJf perl.tar.xz --strip-components=1
diff --git a/python3/pkg.yaml b/python3/pkg.yaml
index ff86b09e..333ee7c9 100644
--- a/python3/pkg.yaml
+++ b/python3/pkg.yaml
@@ -14,7 +14,7 @@ steps:
         sha256: "{{ .python_sha256 }}"
         sha512: "{{ .python_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xJf python.tar.xz --strip-components=1
diff --git a/sed/pkg.yaml b/sed/pkg.yaml
index 599df1d9..3d52be14 100644
--- a/sed/pkg.yaml
+++ b/sed/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/sed/sed-{{ .sed_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/sed/sed-{{ .sed_version }}.tar.xz"
         destination: sed.tar.xz
         sha256: "{{ .sed_sha256 }}"
         sha512: "{{ .sed_sha512 }}"
diff --git a/texinfo/pkg.yaml b/texinfo/pkg.yaml
index d65e159d..2e3223f5 100644
--- a/texinfo/pkg.yaml
+++ b/texinfo/pkg.yaml
@@ -5,7 +5,7 @@ dependencies:
   - stage: perl
 steps:
   - sources:
-      - url: https://ftp.gnu.org/gnu/texinfo/texinfo-{{ .texinfo_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/texinfo/texinfo-{{ .texinfo_version }}.tar.xz"
         destination: texinfo.tar.xz
         sha256: "{{ .texinfo_sha256 }}"
         sha512: "{{ .texinfo_sha512 }}"
diff --git a/tools-ca-certificates/pkg.yaml b/tools-ca-certificates/pkg.yaml
index ae362214..116bf32c 100644
--- a/tools-ca-certificates/pkg.yaml
+++ b/tools-ca-certificates/pkg.yaml
@@ -6,8 +6,8 @@ steps:
   - sources:
       - url: https://curl.se/ca/cacert-{{ .ca_certificates_version }}.pem
         destination: cacert.pem
-        sha256: {{ .ca_certificates_sha256 }}
-        sha512: {{ .ca_certificates_sha512 }}
+        sha256: "{{ .ca_certificates_sha256 }}"
+        sha512: "{{ .ca_certificates_sha512 }}"
     install:
       - |
         install -m644 -D cacert.pem /rootfs/etc/ssl/certs/ca-certificates
diff --git a/tools-cpio/pkg.yaml b/tools-cpio/pkg.yaml
index 00ed535b..74e24004 100644
--- a/tools-cpio/pkg.yaml
+++ b/tools-cpio/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: patch
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/cpio/cpio-{{ .cpio_version | replace "_" "." }}.tar.gz
+      - url: '{{ .GNU_MIRROR_URL }}/gnu/cpio/cpio-{{ .cpio_version | replace "_" "." }}.tar.gz'
         destination: cpio.tar.gz
         sha256: "{{ .cpio_sha256 }}"
         sha512: "{{ .cpio_sha512 }}"
diff --git a/tools-kmod/pkg.yaml b/tools-kmod/pkg.yaml
index d6a9cdca..03665178 100644
--- a/tools-kmod/pkg.yaml
+++ b/tools-kmod/pkg.yaml
@@ -41,7 +41,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/kmod.spdx.json
       name: kmod
-      version: {{ .kmod_version }}
+      version: "{{ .kmod_version }}"
       cpes:
         - cpe:2.3:a:kernel:kmod:{{ .kmod_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-libcap/pkg.yaml b/tools-libcap/pkg.yaml
index 4810096d..38fd06b4 100644
--- a/tools-libcap/pkg.yaml
+++ b/tools-libcap/pkg.yaml
@@ -26,7 +26,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/libcap.spdx.json
       name: libcap
-      version: {{ .libcap_version }}
+      version: "{{ .libcap_version }}"
       cpes:
         - cpe:2.3:a:libcap_project:libcap:{{ .libcap_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-libselinux/pkg.yaml b/tools-libselinux/pkg.yaml
index e5dcc17c..153989c2 100644
--- a/tools-libselinux/pkg.yaml
+++ b/tools-libselinux/pkg.yaml
@@ -33,7 +33,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/libselinux.spdx.json
       name: libselinux
-      version: {{ .selinux_version }}
+      version: "{{ .selinux_version }}"
       cpes:
         - cpe:2.3:a:selinuxproject:libselinux:{{ .selinux_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-libsepol/pkg.yaml b/tools-libsepol/pkg.yaml
index f8473bb6..813fc118 100644
--- a/tools-libsepol/pkg.yaml
+++ b/tools-libsepol/pkg.yaml
@@ -29,7 +29,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/libsepol.spdx.json
       name: libsepol
-      version: {{ .selinux_version }}
+      version: "{{ .selinux_version }}"
       cpes:
         - cpe:2.3:a:selinuxproject:libsepol:{{ .selinux_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-openssl/pkg.yaml b/tools-openssl/pkg.yaml
index 680f3af6..c3438faf 100644
--- a/tools-openssl/pkg.yaml
+++ b/tools-openssl/pkg.yaml
@@ -10,7 +10,7 @@ steps:
         sha256: "{{ .openssl_sha256 }}"
         sha512: "{{ .openssl_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         mkdir openssl
@@ -51,7 +51,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/openssl.spdx.json
       name: openssl
-      version: {{ .openssl_version }}
+      version: "{{ .openssl_version }}"
       cpes:
         - cpe:2.3:a:openssl:openssl:{{ .openssl_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-pcre2/pkg.yaml b/tools-pcre2/pkg.yaml
index 541d504d..17e2f38b 100644
--- a/tools-pcre2/pkg.yaml
+++ b/tools-pcre2/pkg.yaml
@@ -38,7 +38,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/pcre2.spdx.json
       name: pcre2
-      version: {{ .pcre2_version }}
+      version: "{{ .pcre2_version }}"
       cpes:
         - cpe:2.3:a:pcre:pcre2:{{ .pcre2_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-tar/pkg.yaml b/tools-tar/pkg.yaml
index 23f87c43..4b1a402a 100644
--- a/tools-tar/pkg.yaml
+++ b/tools-tar/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/tar/tar-{{ .tar_version | replace "_" "." }}.tar.xz
+      - url: '{{ .GNU_MIRROR_URL }}/gnu/tar/tar-{{ .tar_version | replace "_" "." }}.tar.xz'
         destination: tar.tar.xz
         sha256: "{{ .tar_sha256 }}"
         sha512: "{{ .tar_sha512 }}"
@@ -34,7 +34,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/tar.spdx.json
       name: tar
-      version: {{ .tar_version }}
+      version: "{{ .tar_version }}"
       cpes:
         - cpe:2.3:a:gnu:tar:{{ .tar_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-util-linux/pkg.yaml b/tools-util-linux/pkg.yaml
index 50944626..e49b5abf 100644
--- a/tools-util-linux/pkg.yaml
+++ b/tools-util-linux/pkg.yaml
@@ -49,7 +49,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/util-linux.spdx.json
       name: util-linux
-      version: {{ .util_linux_version }}
+      version: "{{ .util_linux_version }}"
       cpes:
         - cpe:2.3:a:kernel:util-linux:{{ .util_linux_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/tools-xz/pkg.yaml b/tools-xz/pkg.yaml
index 706893aa..a29084af 100644
--- a/tools-xz/pkg.yaml
+++ b/tools-xz/pkg.yaml
@@ -40,7 +40,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/xz.spdx.json
       name: xz
-      version: {{ .xz_version }}
+      version: "{{ .xz_version }}"
       cpes:
         - cpe:2.3:a:tukaani:xz:{{ .xz_version }}:*:*:*:*:*:*:*
       licenses:
diff --git a/vars.yaml b/vars.yaml
new file mode 100644
index 00000000..c99ac0c6
--- /dev/null
+++ b/vars.yaml
@@ -0,0 +1 @@
+GNU_MIRROR_URL: "{{ .BUILD_ARG_GNU_MIRROR_URL }}"