diff --git a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index 0fb46bbee2..40544a868c 100644
--- a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -72,12 +72,15 @@ RUN --mount=type=cache,target=/var/cache/dnf /bin/bash <<'EOF'
 set -Eeuxo pipefail
 echo "Building for architecture: ${TARGETARCH}"
 if [ "$TARGETARCH" = "s390x" ]; then
-    PACKAGES="perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel"
+    PACKAGES=(perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel)
+    subscription-manager refresh
+    subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
+    PACKAGES+=(zeromq-devel)
 else
-    PACKAGES="perl mesa-libGL skopeo"
+    PACKAGES=(perl mesa-libGL skopeo)
 fi
-echo "Installing: $PACKAGES"
-dnf install -y $PACKAGES
+echo "Installing: ${PACKAGES[*]}"
+dnf install -y "${PACKAGES[@]}"
 dnf clean all && rm -rf /var/cache/yum
 EOF
 
@@ -406,7 +409,6 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     # RHOAIENG-58277: Meson 1.11.0 breaks pandas 2.3.3 source builds
     echo "meson<1.11" > build_constraints.txt && \
     if [ "$TARGETARCH" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then \
-        # We need special flags and environment variables when building packages
         GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \
         CFLAGS="-O3" CXXFLAGS="-O3" \
         uv pip install --strict --no-deps --no-cache --no-config --no-progress \
diff --git a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index a1e8b6c181..166f0f7402 100644
--- a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -44,17 +44,21 @@ EOF
 RUN --mount=type=cache,target=/var/cache/dnf /bin/bash <<'EOF'
 set -Eeuxo pipefail
 echo "Building for architecture: ${TARGETARCH}"
-PACKAGES="perl mesa-libGL skopeo libxcrypt-compat"
+PACKAGES=(perl mesa-libGL skopeo libxcrypt-compat)
 # Additional dev tools only for s390x
 if [ "$TARGETARCH" = "s390x" ]; then
-    PACKAGES="$PACKAGES gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel"
+    PACKAGES+=(gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel)
+    # RH-signed zeromq-devel is in rhelai-3.0 (not UBI AppStream/EPEL). Export repos before dnf.
+    subscription-manager refresh
+    subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
+    PACKAGES+=(zeromq-devel)
 fi
 if [ "$TARGETARCH" = "ppc64le" ]; then
-    PACKAGES="$PACKAGES git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build"
+    PACKAGES+=(git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build)
 fi
-if [ -n "$PACKAGES" ]; then
-    echo "Installing: $PACKAGES"
-    dnf install -y $PACKAGES
+if [ ${#PACKAGES[@]} -gt 0 ]; then
+    echo "Installing: ${PACKAGES[*]}"
+    dnf install -y "${PACKAGES[@]}"
     dnf clean all && rm -rf /var/cache/yum
 fi
 EOF