diff --git a/README.md b/README.md
index fc1187a..5865384 100644
--- a/README.md
+++ b/README.md
@@ -1,17 +1,21 @@
-
 [![ci](https://github.com/tillitis/tkey-devtools/actions/workflows/ci.yaml/badge.svg?branch=main&event=push)](https://github.com/tillitis/tkey-devtools/actions/workflows/ci.yaml)
 
-# tkey-tools
+# tkey-devtools
 
-This repository contains some development tools for the
-[Tillitis](https://tillitis.se/) TKey USB security stick.
+Some development tools for the [Tillitis](https://tillitis.se/) TKey
+USB security stick.
 
 - `tkey-runapp`: A simple development tool to load and start any TKey
   device app.
 
-- `run-tkey-qemu`: Script around our 
-  [TKey emulator](https://github.com/tillitis/qemu) OCI image
-  `ghcr.io/tillitis/tkey-qemu-tk1-23.03.1`.
+- Source to build and run OCI images for apps development in C
+  (device) and Go (client): tkey-app-builder. See `contrib`.
+
+- Source to build an OCI image of the QEMU-based [TKey
+  emulator](https://github.com/tillitis/qemu). See `contrib`.
+
+- `run-tkey-qemu`: A script to run the above in a container and export
+  the the serial port as a pty outside the container.
 
 See the [TKey Developer Handbook](https://dev.tillitis.se/) for how to
 develop your own apps, how to run and debug them in the emulator or on
@@ -35,23 +39,18 @@ $ make
 If you want to use podman and you have `make` you can run:
 
 ```
-$ podman pull ghcr.io/tillitis/tkey-builder:2
+$ podman pull ghcr.io/tillitis/tkey-builder
 $ make podman
 ```
 
-or run podman directly with
-
-```
-$ podman run --rm --mount type=bind,source=.,target=/src -w /src -it ghcr.io/tillitis/tkey-builder:2 make -j
-```
-
-To install:
+To install under Linux:
 
 ```
 sudo make install
 ```
 
-If you want to reload the udev rules to access the TKey use:
+Note that this installs Linux udev rules to enable you to access the
+TKey. If you want to reload the udev rules to access the TKey use:
 
 ```
 sudo make reload-rules
diff --git a/contrib/Makefile b/contrib/Makefile
new file mode 100644
index 0000000..806422c
--- /dev/null
+++ b/contrib/Makefile
@@ -0,0 +1,49 @@
+# Copyright (C) 2022, 2023 - Tillitis AB
+# SPDX-License-Identifier: GPL-2.0-only
+
+# image produced by build-image targets
+BUILDQEMUIMAGE=qemu-local
+BUILDAPPIMAGE=tkey-app-builder-local
+
+# default images used when running a container
+APPIMAGE=tkey-app-builder-local
+EMUIMAGE=ghcr.io/tillitis/tkey-qemu-tk1-23.03.1
+
+help: all
+
+all:
+	@echo "Targets:"
+	@echo "run-app               Run a shell using image '$(APPIMAGE)' for app development"
+	@echo "pull-app              Pull down the image '$(APPIMAGE)'"
+	@echo "build-app-image       Build a development image named '$(BUILDAPPIMAGE)'"
+	@echo "                      A newly built image can be used like: make IMAGE=$(BUILDAPPIMAGE) run"
+
+
+	@echo "run-emu               Run a shell using image '$(EMUIMAGE)' for the TKey emulator"
+	@echo "pull-emu              Pull down the image '$(EMUIMAGE)'"
+	@echo "build-emu-image       Build a toolchain image named '$(BUILDEMUIMAGE)'"
+	@echo "                      A newly built image can be used like: make IMAGE=$(BUILDEMUIMAGE) run"
+
+.PHONY: run-app
+run-app:
+	podman run --rm --mount type=bind,source="`pwd`/../",target=/build -w /build -it $(BUILDAPPIMAGE)
+
+.PHONY: pull-app
+pull-app:
+	podman pull $(APPIMAGE)
+
+.PHONY: build-app-image
+build-app-image:
+	podman build -t $(BUILDAPPIMAGE) -f tkey-app-builder.dockerfile
+
+.PHONY: run-emu
+run-emu:
+	podman run --rm --mount type=bind,source="`pwd`/../",target=/build -w /build -it $(EMUIMAGE)
+
+.PHONY: pull-emu
+pull-emu:
+	podman pull $(EMUIMAGE)
+
+.PHONY: build-emu-image
+build-emu-image:
+	podman build -t $(EMUIMAGE) -f tkey-qemu.dockerfile
diff --git a/contrib/tkey-app-builder.dockerfile b/contrib/tkey-app-builder.dockerfile
new file mode 100644
index 0000000..7beb4e2
--- /dev/null
+++ b/contrib/tkey-app-builder.dockerfile
@@ -0,0 +1,12 @@
+# Copyright (C) 2024 Tillitis AB
+# SPDX-License-Identifier: GPL-2.0-only
+
+FROM alpine:3.20
+
+RUN apk add --no-cache \
+    clang \
+    clang-extra-tools \
+    go \
+    lld \
+    llvm \
+    make
diff --git a/tkey-qemu.dockerfile b/contrib/tkey-qemu.dockerfile
similarity index 83%
rename from tkey-qemu.dockerfile
rename to contrib/tkey-qemu.dockerfile
index c510f5c..054c1be 100644
--- a/tkey-qemu.dockerfile
+++ b/contrib/tkey-qemu.dockerfile
@@ -1,40 +1,41 @@
+# Copyright (C) 2023 Tillitis AB
+# SPDX-License-Identifier: GPL-2.0-only
 
 # This is the tag in the https://github.com/tillitis/tillitis-key1 repo with
 # the firmware that our TKey/QEMU will run. The published tkey-qemu image will
 # have this as part of its name, the tag is then used for versioning the image
 # (could be updates to the TKey QEMU machine).
-ARG TKEYREPO_TAG=TK1-23.03.1
+ARG TKEYREPO_TAG=TK1-23.03.2
 
 # This is what we'll actually checkout when building the firmware. It
 # really is the firmware as of the TK1-tag above, but a couple of
 # commits later where the firmware checksum was committed!
-ARG TKEYREPO_TREEISH=444ee3d26c3acf651ff1bbb12023034ccee6ed68
+#ARG TKEYREPO_TREEISH=444ee3d26c3acf651ff1bbb12023034ccee6ed68
 
 # Using tkey-builder image for building since it has the deps.
-FROM ghcr.io/tillitis/tkey-builder:2 AS builder
+#FROM ghcr.io/tillitis/tkey-builder:2 AS builder
+FROM tkey-app-builder-local AS builder
 
-ARG TKEYREPO_TREEISH
-
-# Cleaning up /usr/local since we will later COPY all from there
-RUN rm -rf \
-    /usr/local/bin/* \
-    /usr/local/pico-sdk \
-    /usr/local/repo-commit-* \
-    /usr/local/share/icebox \
-    /usr/local/share/yosys
+RUN apk add --no-cache \
+    bash \
+    git \
+    glib-dev \
+    ninja \
+    python3 \
+    py3-virtualenv
 
 RUN git clone -b tk1 --depth=1 https://github.com/tillitis/qemu /src/qemu \
     && mkdir /src/qemu/build
 WORKDIR /src/qemu/build
 RUN ../configure --target-list=riscv32-softmmu --disable-werror \
-    && make -j "$(nproc --ignore=2)" \
+    && make -j "$(nproc --ignore=2)" qemu-system-riscv32 \
     && make install \
     && git >/usr/local/repo-commit-tillitis--qemu describe --all --always --long --dirty
 
 RUN git clone https://github.com/tillitis/tillitis-key1 /src/tkey
 WORKDIR /src/tkey/hw/application_fpga
 # QEMU needs the .elf, but we build .bin to check sum
-RUN git checkout ${TKEYREPO_TREEISH} \
+RUN git checkout ${TKEYREPO_TAG} \
     && make firmware.bin && sha512sum -c firmware.bin.sha512 \
     && make firmware.elf && cp -af firmware.elf firmware-noconsole.elf \
     && make clean \
diff --git a/tools/spdx-ensure b/tools/spdx-ensure
index bfd3c78..d2e9be8 100755
--- a/tools/spdx-ensure
+++ b/tools/spdx-ensure
@@ -22,7 +22,6 @@ missingok_files=(
 LICENSE
 Makefile
 README.md
-tkey-qemu.dockerfile
 go.mod
 go.sum
 gon.hcl