diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 0f81258b32d5..77fa851c3ad8 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-dev@sha256:eae27468101cff14340905c9b6d1fc6caebe339c7ed474d8fee6d35015c04d61",
+  "image": "ghcr.io/dfinity/ic-dev@sha256:9d622eb47c59dd4aed1031903831c63edbcc81ebafa3f2c80d8db98c8b771db9",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [
diff --git a/.github/workflows/api-bn-recovery-test.yml b/.github/workflows/api-bn-recovery-test.yml
index 9958adc1a7cc..39f7d94dd4f5 100644
--- a/.github/workflows/api-bn-recovery-test.yml
+++ b/.github/workflows/api-bn-recovery-test.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 5a629d1598d0..54acd975b14b 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90
diff --git a/.github/workflows/ci-pr-only.yml b/.github/workflows/ci-pr-only.yml
index 0f0db8ef8ee4..e1ca86ca0279 100644
--- a/.github/workflows/ci-pr-only.yml
+++ b/.github/workflows/ci-pr-only.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/tmp/containers"
     steps:
diff --git a/.github/workflows/container-api-bn-recovery.yml b/.github/workflows/container-api-bn-recovery.yml
index e013d3f86cb7..888edbf161be 100644
--- a/.github/workflows/container-api-bn-recovery.yml
+++ b/.github/workflows/container-api-bn-recovery.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
diff --git a/.github/workflows/container-scan-nightly.yml b/.github/workflows/container-scan-nightly.yml
index 4fd4a96d91eb..183729070e94 100644
--- a/.github/workflows/container-scan-nightly.yml
+++ b/.github/workflows/container-scan-nightly.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 60
diff --git a/.github/workflows/local-system-tests.yml b/.github/workflows/local-system-tests.yml
index ec1e967f56f1..8a95f0232822 100644
--- a/.github/workflows/local-system-tests.yml
+++ b/.github/workflows/local-system-tests.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 600
diff --git a/.github/workflows/pocket-ic-tests-windows.yml b/.github/workflows/pocket-ic-tests-windows.yml
index 16cf5bf00b5f..b96cd94f5fbc 100644
--- a/.github/workflows/pocket-ic-tests-windows.yml
+++ b/.github/workflows/pocket-ic-tests-windows.yml
@@ -45,7 +45,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90
diff --git a/.github/workflows/rate-limits-backend-release.yml b/.github/workflows/rate-limits-backend-release.yml
index b5affa8e9824..4ca43b8876bf 100644
--- a/.github/workflows/rate-limits-backend-release.yml
+++ b/.github/workflows/rate-limits-backend-release.yml
@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 
diff --git a/.github/workflows/release-testing.yml b/.github/workflows/release-testing.yml
index dc6886034edc..46e5c826f650 100644
--- a/.github/workflows/release-testing.yml
+++ b/.github/workflows/release-testing.yml
@@ -35,7 +35,7 @@ jobs:
       group: dm1
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 180
diff --git a/.github/workflows/rosetta-release.yml b/.github/workflows/rosetta-release.yml
index 06634d20871d..67a118738ed0 100644
--- a/.github/workflows/rosetta-release.yml
+++ b/.github/workflows/rosetta-release.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: DockerHub
diff --git a/.github/workflows/salt-sharing-canister-release.yml b/.github/workflows/salt-sharing-canister-release.yml
index a326e1c30ced..f4d60fabe122 100644
--- a/.github/workflows/salt-sharing-canister-release.yml
+++ b/.github/workflows/salt-sharing-canister-release.yml
@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 
diff --git a/.github/workflows/schedule-daily-bare-metal.yml b/.github/workflows/schedule-daily-bare-metal.yml
index 90a71e5de198..f25bcf199019 100644
--- a/.github/workflows/schedule-daily-bare-metal.yml
+++ b/.github/workflows/schedule-daily-bare-metal.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: Bare Metal Tests
diff --git a/.github/workflows/schedule-daily.yml b/.github/workflows/schedule-daily.yml
index 515992c344be..581ebe42453d 100644
--- a/.github/workflows/schedule-daily.yml
+++ b/.github/workflows/schedule-daily.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/schedule-rust-bench.yml b/.github/workflows/schedule-rust-bench.yml
index 759f4c6e2106..f323566972dd 100644
--- a/.github/workflows/schedule-rust-bench.yml
+++ b/.github/workflows/schedule-rust-bench.yml
@@ -24,7 +24,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       # running on bare metal machine using ubuntu user
       options: --user ubuntu --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/system-tests-benchmarks-nightly.yml b/.github/workflows/system-tests-benchmarks-nightly.yml
index cb9efbf84ad8..b0c3f0d9b62c 100644
--- a/.github/workflows/system-tests-benchmarks-nightly.yml
+++ b/.github/workflows/system-tests-benchmarks-nightly.yml
@@ -17,7 +17,7 @@ jobs:
       group: dm1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 480
diff --git a/.github/workflows/update-mainnet-canister-revisions.yaml b/.github/workflows/update-mainnet-canister-revisions.yaml
index 41a81eebb7a4..012942169c42 100644
--- a/.github/workflows/update-mainnet-canister-revisions.yaml
+++ b/.github/workflows/update-mainnet-canister-revisions.yaml
@@ -25,7 +25,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
     env:
diff --git a/BUILD.bazel b/BUILD.bazel
index 463b721b2c33..e7c378ba040c 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -391,3 +391,19 @@ genrule(
         "@platforms//os:linux",  # technically: Ubuntu/Debian with dpkg-deb
     ],
 )
+
+# OVMF_SEV.fd -- AMD SEV-SNP confidential VM firmware, extracted the same way
+# from the `ovmf-amdsev` `.deb` (see MODULE.bazel for the `ovmf_amdsev_deb`
+# http_file). That package is currently only available in Debian sid
+# (https://packages.debian.org/sid/ovmf-amdsev), hence pulling it from a
+# snapshot.debian.org snapshot rather than a stable release mirror.
+genrule(
+    name = "ovmfsev_code",
+    srcs = ["@ovmf_amdsev_deb//file"],
+    outs = ["OVMF_SEV.fd"],
+    cmd = "dpkg-deb --fsys-tarfile $(execpath @ovmf_amdsev_deb//file) | tar -xO ./usr/share/ovmf/OVMF.amdsev.fd > $@",
+    tags = ["manual"],
+    target_compatible_with = [
+        "@platforms//os:linux",  # technically: Ubuntu/Debian with dpkg-deb
+    ],
+)
diff --git a/MODULE.bazel b/MODULE.bazel
index c5fc6a7973aa..afdfff245a88 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -337,6 +337,18 @@ http_file(
     url = "https://snapshot.ubuntu.com/ubuntu/20260422T000000Z/pool/main/e/edk2-hwe/ovmf-generic-hwe_2025.11-3ubuntu8_all.deb",
 )
 
+# OVMF (UEFI) firmware for AMD SEV-SNP confidential VMs, extracted from the
+# `ovmf-amdsev` `.deb` (see https://packages.debian.org/sid/ovmf-amdsev). Same
+# rationale as `ovmf_deb` above: no official prebuilt firmware, so we pull it
+# from a `.deb` snapshot instead of `rules_distroless` to avoid bloating the
+# lockfile.
+http_file(
+    name = "ovmf_amdsev_deb",
+    downloaded_file_path = "ovmf-amdsev.deb",
+    sha256 = "4655196c4e3131c77f172a17d422beba350f09e8385f2e55e3abda83276781fe",
+    url = "https://snapshot.debian.org/archive/debian/20260403T143651Z/pool/main/e/edk2/ovmf-amdsev_2025.11-5_all.deb",
+)
+
 # TLA+ tools
 bazel_dep(name = "rules_java", version = "9.3.0")
 
diff --git a/ci/container/TAG b/ci/container/TAG
index 1bc94839cfef..ddbd8530822f 100644
--- a/ci/container/TAG
+++ b/ci/container/TAG
@@ -1 +1 @@
-285e2d5f1b7bc3735765c70b70504aad04c171c7ee7ebae00c03f24d608cd688
+134e4606f2dcedf81ada22866dc2df2a26fda5ccac2caf61e682d7da1c51185b
diff --git a/ci/container/files/packages.common b/ci/container/files/packages.common
index d0d7208ee085..169946819f5e 100644
--- a/ci/container/files/packages.common
+++ b/ci/container/files/packages.common
@@ -20,7 +20,7 @@ pkg-config
 libclang-dev
 libunwind-dev # required for the cargo build of ic-canister-sandbox-backend-lib crate (see: rs/canister_sandbox/src/backtrace.c)
 libusb-1.0-0-dev # required for HSM
-lld # required for ovmf_sev genrule
+lld # used as the default system linker for cargo builds (see ci/container/Dockerfile)
 protobuf-compiler # needed by cargo for prost-build/tonic-build (Bazel brings its own)
 llvm
 
@@ -29,7 +29,6 @@ clang
 cryptsetup-bin
 faketime
 fdisk
-iasl # to build OVMF
 ipmitool # to connect to baremetal test instances
  # Linked in by IC-OS binaries for managing encrypted disks.
 libcryptsetup-dev
@@ -37,7 +36,6 @@ libselinux-dev
 libsystemd-dev
  # Linked in by IC-OS binaries for managing virtual machines programmatically.
 libvirt-dev
-nasm # to build OVMF
 podman
 rsync
 zstd
diff --git a/ic-os/components/ovmf/BUILD.bazel b/ic-os/components/ovmf/BUILD.bazel
deleted file mode 100644
index 5c84f6309a0d..000000000000
--- a/ic-os/components/ovmf/BUILD.bazel
+++ /dev/null
@@ -1,39 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-# There is no way using new_git_repository to check out only a limited number of submodules, furthermore
-# new_git_repository does not cache the git repo, therefore it takes much longer. We found a bug in new_git_repository,
-# with filenames containing non-ASCII characters. Because of all these reasons, we use a genrule instead.
-genrule(
-    name = "ovmf_sev",
-    outs = ["OVMF_SEV.fd"],
-    cmd = """
-        REPOSITORY=https://github.com/tianocore/edk2.git
-        COMMIT=b7a715f7c03c45c6b4575bf88596bfd79658b8ce # edk2-stable202602
-
-        out="$$(realpath $@)"
-        workdir="$$(mktemp -d)"
-        trap "rm -rf $$workdir" EXIT
-        cd "$$workdir"
-        git clone "$$REPOSITORY"
-        cd edk2
-        git checkout "$$COMMIT"
-        git submodule update --init \
-            BaseTools/Source/C/BrotliCompress/brotli \
-            MdePkg/Library/MipiSysTLib/mipisyst \
-            MdeModulePkg/Library/BrotliCustomDecompressLib/brotli \
-            SecurityPkg/DeviceSecurity/SpdmLib/libspdm \
-            CryptoPkg/Library/OpensslLib/openssl \
-            CryptoPkg/Library/MbedTlsLib/mbedtls
-
-
-        # Required for building AmdSev package without grub. Workaround found in
-        # https://github.com/kata-containers/kata-containers/blob/d0df91935b8840036c2891b1f93dd8059ebe486a/tools/packaging/static-build/ovmf/build-ovmf.sh#L53
-        touch OvmfPkg/AmdSev/Grub/grub.efi
-
-        OvmfPkg/build.sh -a X64 -b RELEASE -t CLANGDWARF -p OvmfPkg/AmdSev/AmdSevX64.dsc
-
-        mv Build/AmdSev/RELEASE_CLANGDWARF/FV/OVMF.fd "$$out"
-    """,
-    tags = ["manual"],
-    target_compatible_with = ["@platforms//os:linux"],
-)
diff --git a/ic-os/defs.bzl b/ic-os/defs.bzl
index fbfdf8e8ad9c..51558976be07 100644
--- a/ic-os/defs.bzl
+++ b/ic-os/defs.bzl
@@ -283,7 +283,7 @@ def icos_build(
             native.genrule(
                 name = "generate-" + launch_measurements,
                 outs = [launch_measurements],
-                srcs = ["//ic-os/components/ovmf:ovmf_sev", boot_args, ":extracted_initrd.img", ":extracted_vmlinuz"],
+                srcs = ["//:ovmfsev_code", boot_args, ":extracted_initrd.img", ":extracted_vmlinuz"],
                 visibility = visibility,
                 tools = ["//ic-os:sev-snp-measure"],
                 tags = ["manual"],
@@ -295,7 +295,7 @@ def icos_build(
                             # Note: We only create launch measurements for the TEE boot arg variants
                             # (BOOT_ARGS_TEE_A and BOOT_ARGS_TEE_B)
                             for cmdline in "$$BOOT_ARGS_TEE_A" "$$BOOT_ARGS_TEE_B"; do
-                                hex=$$($(execpath //ic-os:sev-snp-measure) --mode snp --vcpus $$vcpus --ovmf "$(execpath //ic-os/components/ovmf:ovmf_sev)" --vcpu-type "$$vcpu_type" --append "$$cmdline" --initrd "$(location extracted_initrd.img)" --kernel "$(location extracted_vmlinuz)")
+                                hex=$$($(execpath //ic-os:sev-snp-measure) --mode snp --vcpus $$vcpus --ovmf "$(execpath //:ovmfsev_code)" --vcpu-type "$$vcpu_type" --append "$$cmdline" --initrd "$(location extracted_initrd.img)" --kernel "$(location extracted_vmlinuz)")
                                 # Convert hex string to decimal list, e.g. "abcd" ->  171\\n205
                                 measurement=$$(echo -n "$$hex" | fold -w2 | sed "s/^/0x/" | xargs printf "%d\n")
                                 jq -na --arg cmd "$$cmdline" --arg m "$$measurement" --arg vcpu_type "$$vcpu_type" '{
diff --git a/ic-os/guestos/defs.bzl b/ic-os/guestos/defs.bzl
index 880484ad4cb5..80c21f3ec0d2 100644
--- a/ic-os/guestos/defs.bzl
+++ b/ic-os/guestos/defs.bzl
@@ -26,7 +26,7 @@ def image_deps(mode, malicious = False):
 
         # Extra files to be added to rootfs and bootfs
         "bootfs": {
-            "//ic-os/components/ovmf:ovmf_sev": "/OVMF_SEV.fd:0644",
+            "//:ovmfsev_code": "/OVMF_SEV.fd:0644",
         },
         "rootfs": {
             # additional files to install