diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
index 0df2e4c0..912b705c 100644
--- a/.github/actions/build/action.yml
+++ b/.github/actions/build/action.yml
@@ -43,12 +43,14 @@ runs:
         path: './vcpkg/packages'
 
     - uses: lukka/run-cmake@v10.6 # pin version to avoid failed glibc dependency on ubuntu 20 runners. go back to @latest when ubuntu 22+ is adopted for runner os.
+      if: runner.os != 'ubuntu'
       name: Configure CMake
       with:
         configurePreset: ci-${{ inputs.preset }}
         configurePresetAdditionalArgs: "[ `-B`, `./build` ]"
 
-    - name: build ziti-edge-tunnel
+    - name: build ziti-edge-tunnel (non-linux)
+      if: runner.os != 'ubuntu'
       shell: bash
       run: |
         cmake \
@@ -56,3 +58,10 @@ runs:
           --config ${{ inputs.config }} \
           --target ${{ inputs.target }} \
           --verbose
+
+    - name: build ziti-edge-tunnel (linux)
+      if: runner.os == 'ubuntu'
+      uses: ./.github/actions/openziti-tunnel-build-action
+      with:
+        arch: ${{ inputs.preset }}
+        config: ${{ inputs.config }}
diff --git a/.github/actions/openziti-tunnel-build-action/gh-release/Dockerfile b/.github/actions/openziti-tunnel-build-action/gh-release/Dockerfile
new file mode 100644
index 00000000..f54f41f2
--- /dev/null
+++ b/.github/actions/openziti-tunnel-build-action/gh-release/Dockerfile
@@ -0,0 +1,8 @@
+ARG CMAKE_VERSION="3.26.3"
+ARG VCPKG_VERSION="master"
+
+# use ziti-builder:v1 (basded on ubuntu focal) for older glibc (2.27)
+FROM openziti/ziti-builder:v1
+
+COPY ./entrypoint.sh /root/
+ENTRYPOINT [ "/root/entrypoint.sh" ]
diff --git a/.github/actions/openziti-tunnel-build-action/gh-release/entrypoint.sh b/.github/actions/openziti-tunnel-build-action/gh-release/entrypoint.sh
new file mode 100644
index 00000000..90a03f18
--- /dev/null
+++ b/.github/actions/openziti-tunnel-build-action/gh-release/entrypoint.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+#
+# Copyright 2024 NetFoundry Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# RedHat 8
+#
+
+set -euo pipefail
+
+# these commands must be in the entrypoint so they are run after workspace is mounted on Docker workdir
+echo "INFO: GIT_DISCOVERY_ACROSS_FILESYSTEM=${GIT_DISCOVERY_ACROSS_FILESYSTEM}"
+echo "INFO: WORKDIR=${PWD}"
+echo "INFO: $(git --version)"
+
+# if first positional is an expected arch string then set cmake preset,
+# else use ci-linux-x64 (which actually just uses native/host tools - e.g. not cross compile)
+if [ ${#} -ge 1 ]; then
+    cmake_preset="${1}"
+else
+    cmake_preset="ci-linux-x64"
+fi
+
+if [ ${#} -ge 2 ]; then
+    cmake_config="${2}"
+else
+    cmake_config="RelWithDebInfo"
+fi
+
+# workspace dir for each build env is added to "safe" dirs in global config e.g.
+# ~/.gitconfig so both runner and builder containers trust these dirs
+# owned by different UIDs from that of Git's EUID. This is made necessary
+# by newly-enforced directory boundaries in Git v2.35.2
+# ref: https://lore.kernel.org/git/xmqqv8veb5i6.fsf@gitster.g/
+for SAFE in \
+    /github/workspace \
+    /__w/ziti-tunnel-sdk-c/ziti-tunnel-sdk-c \
+    /mnt ; do
+        git config --global --add safe.directory ${SAFE}
+done
+
+cmake -E make_directory ./build
+(
+    [[ -d ./build ]] && rm -r ./build
+    cmake -E make_directory ./build
+    # allow unset for scl_source scripts
+    set +u
+    source scl_source enable gcc-toolset-10 \
+        && cmake \
+            --preset "${cmake_preset}" \
+            -DCMAKE_BUILD_TYPE="${cmake_config}" \
+            -DBUILD_DIST_PACKAGES=ON \
+            -S . \
+            -B ./build
+    source scl_source enable gcc-toolset-10 \
+        && cmake \
+            --build ./build \
+            --config "${cmake_config}" \
+            --target package \
+            --verbose
+)
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index a1ef2f89..c601a804 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -44,17 +44,17 @@ jobs:
             preset: windows-arm64-vs2022
 
           - os: ubuntu-20.04
-            container: openziti/ziti-builder:v1
+#            container: openziti/ziti-builder:v2
             name: Linux x86_64
             preset: linux-x64-static-libssl
 
           - os: ubuntu-20.04
-            container: openziti/ziti-builder:v1
+#            container: openziti/ziti-builder:v2
             name: Linux arm
             preset: linux-arm-static-libssl
 
           - os: ubuntu-20.04
-            container: openziti/ziti-builder:v1
+#            container: openziti/ziti-builder:v2
             name: Linux arm64
             preset: linux-arm64-static-libssl