diff --git a/cloud/BUILD.bazel b/cloud/BUILD.bazel
index 0e44a88..965c100 100644
--- a/cloud/BUILD.bazel
+++ b/cloud/BUILD.bazel
@@ -1,19 +1,58 @@
-load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
-load("@io_bazel_rules_docker//contrib:push-all.bzl", "container_push")
+load("@bazel_skylib//rules:write_file.bzl", "write_file")
 
-container_bundle(
-    name = "cloud_containers",
-    images = {
-        "gcr.io/monogon-infra/cloud/apigw:{STABLE_MONOGON_cloud_version}": "//cloud/apigw:apigw_container",
-        "gcr.io/monogon-infra/cloud/shepherd/equinix:{STABLE_MONOGON_cloud_version}": "//cloud/shepherd/provider/equinix:equinix_container",
-        "gcr.io/monogon-infra/cloud/bmsrv:{STABLE_MONOGON_cloud_version}": "//cloud/bmaas/server/cmd:cmd_container",
-        "gcr.io/monogon-infra/cloud/scruffy:{STABLE_MONOGON_cloud_version}": "//cloud/bmaas/scruffy/cmd:cmd_container",
-        "gcr.io/monogon-infra/cloud/shepherd/mini:{STABLE_MONOGON_cloud_version}": "//cloud/shepherd/mini:mini_container",
-    },
+write_file(
+    name = "tags_tmpl",
+    out = "tags.txt.tmpl",
+    content = [
+        "BUILD_VERSION",
+    ],
 )
 
-container_push(
-    name = "push",
-    bundle = ":cloud_containers",
-    format = "Docker",
+load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
+
+# Use the value of --embed_label under --stamp, otherwise use a deterministic constant
+# value to ensure cache hits for actions that depend on this.
+expand_template(
+    name = "stamped",
+    out = "_stamped.tags.txt",
+    stamp_substitutions = {"BUILD_VERSION": "{{STABLE_MONOGON_cloud_version}}"},
+    substitutions = {"BUILD_VERSION": "0.0.0"},
+    template = "tags_tmpl",
+)
+
+load("@rules_oci//oci:defs.bzl", "oci_push")
+
+oci_push(
+    name = "apigw_image",
+    image = "//cloud/apigw:apigw_image",
+    remote_tags = ":stamped",
+    repository = "gcr.io/monogon-infra/cloud/apigw",
+)
+
+oci_push(
+    name = "shepherd_equinix",
+    image = "//cloud/shepherd/provider/equinix:equinix_image",
+    remote_tags = ":stamped",
+    repository = "gcr.io/monogon-infra/cloud/shepherd/equinix",
+)
+
+oci_push(
+    name = "bmsrv",
+    image = "//cloud/bmaas/server/cmd:cmd_image",
+    remote_tags = ":stamped",
+    repository = "gcr.io/monogon-infra/cloud/bmsrv",
+)
+
+oci_push(
+    name = "scruffy",
+    image = "//cloud/bmaas/scruffy/cmd:cmd_image",
+    remote_tags = ":stamped",
+    repository = "gcr.io/monogon-infra/cloud/scruffy",
+)
+
+oci_push(
+    name = "shepherd_mini",
+    image = "//cloud/shepherd/mini:mini_image",
+    remote_tags = ":stamped",
+    repository = "gcr.io/monogon-infra/cloud/shepherd/mini",
 )
diff --git a/cloud/apigw/BUILD.bazel b/cloud/apigw/BUILD.bazel
index ee3b409..a570529 100644
--- a/cloud/apigw/BUILD.bazel
+++ b/cloud/apigw/BUILD.bazel
@@ -1,6 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@io_bazel_rules_docker//container:container.bzl", "container_image")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 
 go_library(
     name = "apigw_lib",
@@ -19,15 +17,19 @@
     visibility = ["//visibility:public"],
 )
 
-static_binary_tarball(
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+pkg_tar(
     name = "apigw_layer",
-    executable = ":apigw",
+    srcs = [":apigw"],
 )
 
-container_image(
-    name = "apigw_container",
-    base = "@go_image_base//image",
-    entrypoint = ["/app/cloud/apigw/apigw_/apigw"],
+load("@rules_oci//oci:defs.bzl", "oci_image")
+
+oci_image(
+    name = "apigw_image",
+    base = "@distroless_base",
+    entrypoint = ["/apigw"],
     tars = [":apigw_layer"],
     visibility = ["//visibility:public"],
     workdir = "/app",
diff --git a/cloud/bmaas/scruffy/cmd/BUILD.bazel b/cloud/bmaas/scruffy/cmd/BUILD.bazel
index cf0391b..1a372e7 100644
--- a/cloud/bmaas/scruffy/cmd/BUILD.bazel
+++ b/cloud/bmaas/scruffy/cmd/BUILD.bazel
@@ -1,6 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@io_bazel_rules_docker//container:container.bzl", "container_image")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 
 go_library(
     name = "cmd_lib",
@@ -19,15 +17,19 @@
     visibility = ["//visibility:public"],
 )
 
-static_binary_tarball(
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+pkg_tar(
     name = "cmd_layer",
-    executable = ":cmd",
+    srcs = [":cmd"],
 )
 
-container_image(
-    name = "cmd_container",
-    base = "@go_image_base//image",
-    entrypoint = ["/app/cloud/bmaas/scruffy/cmd/cmd_/cmd"],
+load("@rules_oci//oci:defs.bzl", "oci_image")
+
+oci_image(
+    name = "cmd_image",
+    base = "@distroless_base",
+    entrypoint = ["/cmd"],
     tars = [":cmd_layer"],
     visibility = ["//visibility:public"],
     workdir = "/app",
diff --git a/cloud/bmaas/server/cmd/BUILD.bazel b/cloud/bmaas/server/cmd/BUILD.bazel
index 50184b9..958f2c4 100644
--- a/cloud/bmaas/server/cmd/BUILD.bazel
+++ b/cloud/bmaas/server/cmd/BUILD.bazel
@@ -1,5 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 
 go_library(
@@ -20,15 +19,19 @@
     visibility = ["//visibility:public"],
 )
 
-static_binary_tarball(
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+pkg_tar(
     name = "cmd_layer",
-    executable = ":cmd",
+    srcs = [":cmd"],
 )
 
-container_image(
-    name = "cmd_container",
-    base = "@go_image_base//image",
-    entrypoint = ["/app/cloud/bmaas/server/cmd/cmd_/cmd"],
+load("@rules_oci//oci:defs.bzl", "oci_image")
+
+oci_image(
+    name = "cmd_image",
+    base = "@distroless_base",
+    entrypoint = ["/cmd"],
     tars = [":cmd_layer"],
     visibility = ["//visibility:public"],
     workdir = "/app",
diff --git a/cloud/shepherd/mini/BUILD.bazel b/cloud/shepherd/mini/BUILD.bazel
index eb949ee..5587d1e 100644
--- a/cloud/shepherd/mini/BUILD.bazel
+++ b/cloud/shepherd/mini/BUILD.bazel
@@ -1,6 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@io_bazel_rules_docker//container:container.bzl", "container_image")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 
 go_library(
     name = "mini_lib",
@@ -30,15 +28,19 @@
     visibility = ["//visibility:public"],
 )
 
-static_binary_tarball(
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+pkg_tar(
     name = "mini_layer",
-    executable = ":mini",
+    srcs = [":mini"],
 )
 
-container_image(
-    name = "mini_container",
-    base = "@go_image_base//image",
-    entrypoint = ["/app/cloud/shepherd/mini/mini_/mini"],
+load("@rules_oci//oci:defs.bzl", "oci_image")
+
+oci_image(
+    name = "mini_image",
+    base = "@distroless_base",
+    entrypoint = ["/mini"],
     tars = [
         ":mini_layer",
         "//cloud/takeover:takeover_layer",
diff --git a/cloud/shepherd/provider/equinix/BUILD.bazel b/cloud/shepherd/provider/equinix/BUILD.bazel
index 3363d7f..2ea4ee7 100644
--- a/cloud/shepherd/provider/equinix/BUILD.bazel
+++ b/cloud/shepherd/provider/equinix/BUILD.bazel
@@ -1,6 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
-load("@io_bazel_rules_docker//container:container.bzl", "container_image")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 
 go_library(
     name = "equinix_lib",
@@ -59,15 +57,19 @@
     visibility = ["//visibility:public"],
 )
 
-static_binary_tarball(
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+pkg_tar(
     name = "equinix_layer",
-    executable = ":equinix",
+    srcs = [":equinix"],
 )
 
-container_image(
-    name = "equinix_container",
-    base = "@go_image_base//image",
-    entrypoint = ["/app/cloud/shepherd/provider/equinix/equinix_/equinix"],
+load("@rules_oci//oci:defs.bzl", "oci_image")
+
+oci_image(
+    name = "equinix_image",
+    base = "@distroless_base",
+    entrypoint = ["/equinix"],
     tars = [
         ":equinix_layer",
         "//cloud/takeover:takeover_layer",