diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 000000000..513ecea3a
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,38 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "regexManagers": [
+        {
+            "fileMatch": [
+                "Pkgfile"
+            ],
+            "matchStrings": [
+                "# renovate: datasource=(?<datasource>.*?)(?:\\s+extractVersion=(?<extractVersion>.+?))?(?:\\s+versioning=(?<versioning>.+?))?\\s+depName=(?<depName>.+?)?\\s(?:\\s+.*_(?:version|VERSION):\\s+(?<currentValue>.*))?(?:\\s.*_(?:ref|REF):\\s+(?<currentDigest>.*))?"
+            ],
+            "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
+        },
+        {
+            "fileMatch": [
+                "Pkgfile",
+                "Makefile"
+            ],
+            "matchStrings": [
+                "(?<depName>ghcr.io\\/siderolabs\\/bldr):(?<currentValue>v.*-frontend)"
+            ],
+            "datasourceTemplate": "docker",
+            "versioningTemplate": "semver"
+        }
+    ],
+    "packageRules": [
+        {
+            "matchPackageNames": [
+                "git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
+            ],
+            "allowedVersions": "<= 5.15"
+        }
+    ],
+    "schedule": [
+        "on monday at 1am"
+    ],
+    "timezone": "Etc/UTC",
+    "dependencyDashboard": true
+}
diff --git a/Makefile b/Makefile
index 074485b52..b523022b5 100644
--- a/Makefile
+++ b/Makefile
@@ -9,6 +9,10 @@ REGISTRY_AND_USERNAME := $(REGISTRY)/$(USERNAME)
 # git log ad5ad0a513b775e597c818b25476fc59ba3e4a8c --pretty=%ct
 SOURCE_DATE_EPOCH ?= "1559424892"
 
+# Sync bldr image with Pkgfile
+BLDR ?= docker run --rm --volume $(PWD):/tools --entrypoint=/bldr \
+	ghcr.io/siderolabs/bldr:v0.2.0-alpha.8-frontend graph --root=/tools
+
 BUILD := docker buildx build
 PLATFORM ?= linux/amd64,linux/arm64
 PROGRESS ?= auto
@@ -91,7 +95,7 @@ $(TARGETS) $(NONFREE_TARGETS):
 
 .PHONY: deps.png
 deps.png:
-	bldr graph | dot -Tpng > deps.png
+	@$(BLDR) graph | dot -Tpng > deps.png
 
 kernel-%: ## Updates the kernel configs: e.g. make kernel-olddefconfig; make kernel-menuconfig; etc.
 	for platform in $(subst $(,),$(space),$(PLATFORM)); do \
diff --git a/Pkgfile b/Pkgfile
index bbeb33f57..dbd184e5b 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -5,5 +5,174 @@ format: v1alpha2
 vars:
   TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.3.0-alpha.0-1-g7d6f9c3
 
+  # renovate: datasource=github-releases depName=containernetworking/plugins
+  cni_version: v1.1.0
+  cni_sha256: c256b996fd5a1a2aea0e46a1f322be01afae0899015f65d77863693feccd32a4
+  cni_sha512: 43cfcb0225cbc85cc75205cefac75f852fccce1a71b0384fe1f989e64c37508fc3b87cbc05c6dac679aea8950c3cd4d328a616fa79b52474561c624164da0206
+
+  # renovate: datasource=github-tags depName=containerd/containerd
+  containerd_version: v1.6.8
+  containerd_ref: 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
+  containerd_sha256: f5f938513c28377f64f85e84f2750d39f26b01262f3a062b7e8ce35b560ca407
+  containerd_sha512: c204c028cdfd76537d1da01c66526fc85b29b02d2412569bb9b265375603614b037356c61846025a72281398f0f46df326a5ea3df97f57901cce85f2f728f0ba
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git
+  cryptsetup_version: 2.3.4
+  cryptsetup_sha256: 8bc16c0b1c987867f13f0f2114fc4182d92bc866d1f84bb725c2cb9bcc55bf93
+  cryptsetup_sha512: a0a4981ca7294d6f0568bc9465e78ee1781ad73fe77e8daa0bbe67693534f02d3510e6fba9f76749b90ce7533bc9ac96dd27b73d733f8051e9560a3b4196ca3c
+
+  # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ versioning=loose depName=dosfstools/dosfstools
+  dosfstools_version: 4.2
+  dosfstools_sha256: 64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527
+  dosfstools_sha512: 3cc0808edb4432428df8a67da4bb314fd1f27adc4a05754c1a492091741a7b6875ebd9f6a509cc4c5ad85643fc40395b6e0cadee548b25cc439cc9b725980156
+
+  # renovate: datasource=github-releases depName=eudev-project/eudev
+  eudev_version: v3.2.11
+  eudev_sha256: dcfc482099f3fdfcfdb9aeabbc4d609877cf4d2d0407f50ab0c59d43fff44f92
+  eudev_sha512: 17b328365913af3e434abe667dd0498c3702a41c6cb66f3793ca2c195b05ac06397b0a401077f81df7dd25193e4eeea13657a221ca6cb3d237c4d91e31e30b33
+
+  # renovate: datasource=github-releases depName=flannel-io/cni-plugin
+  flannel_cni_version: v1.1.0
+  flannel_cni_sha256: 2bd79d899e8a8b3f96bf267ed2d7d5a0da3df45d8581cbf8d9e8433692375ae7
+  flannel_cni_sha512: e026bed01f8ac64b584d8c438ccc048df607b2e4832493335b2e266166acebf32f2b58c353bc2ecd3750d920e65a79afef7b28bf4a6405e2f461ab2c8cd953a7
+
+  # renovate: datasource=git-tags extractVersion=^grub-(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/grub.git
+  grub_version: 2.06
+  grub_sha256: b79ea44af91b93d17cd3fe80bdae6ed43770678a9a5ae192ccea803ebb657ee1
+  grub_sha512: 4f11c648f3078567e53fc0c74d5026fdc6da4be27d188975e79d9a4df817ade0fe5ad2ddd694238a07edc45adfa02943d83c57767dd51548102b375e529e8efe
+
+  # renovate: datasource=github-releases extractVersion=^IPMITOOL_(?<version>.*)$ versioning=loose depName=ipmitool/ipmitool
+  ipmitool_version: 1_8_18
+  ipmitool_sha256: 2bd79d899e8a8b3f96bf267ed2d7d5a0da3df45d8581cbf8d9e8433692375ae7
+  ipmitool_sha512: e026bed01f8ac64b584d8c438ccc048df607b2e4832493335b2e266166acebf32f2b58c353bc2ecd3750d920e65a79afef7b28bf4a6405e2f461ab2c8cd953a7
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.netfilter.org/iptables
+  iptables_version: 1.8.7
+  iptables_sha256: c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0
+  iptables_sha512: c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75
+
+  # renovate: datasource=git-refs versioning=git depName=https://github.com/ipxe/ipxe.git
+  ipxe_ref: c5af41a6f5b5f4a420b3e539f9e3a8dc9f8dd03e
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+  linux_version: 5.15.63
+  linux_sha256: 6dd3cd1e5a629d0002bc6c6ec7e8ea96710104f38664122dd56c83dfd4eb7341
+  linux_sha512: a1b33476484b9ca7a105d07b70835ad7e7e670750e6beb428ce23fe1bd853d66cd8a1ffca9ee736a98a42b98191d290127e628d33118be971c661e2fc6faf8ca
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git
+  kmod_version: 27
+  kmod_sha256: c1d3fbf16ca24b95f334c1de1b46f17bbe5a10b0e81e72668bdc922ebffbbc0c
+  kmod_sha512: e0513094935333fca1fb4c3e3493b232507a579ab00a6457cc9ed3e928363d05aad80634fb65a8287a336bf9895194c7be8ddc41bb088a6c2cca44fc1bfbdb6c
+
+  # renovate: datasource=git-tags extractVersion=^libaio-(?<version>.*)$ versioning=loose depName=https://pagure.io/libaio.git
+  libaio_version: 0.3.112
+  libaio_sha256: ab0462f2c9d546683e5147b1ce9c195fe95d07fac5bf362f6c01637955c3b492
+  libaio_sha512: 5f984529c9f747a6c82f1e4457fc0832bb1fc299ae6e700f2ac5a8ea7b9bfc6ea1e75809728cc115a020cff6685ed1f4e38c6aeacc1ea98dfccce04dd19dafaa
+
+  # renovate: datasource=github-releases extractVersion=^r(?<version>.*)$ versioning=loose depName=benhoyt/inih
+  libinih_version: 53
+  libinih_sha256: 01b0366fdfdf6363efc070c2f856f1afa33e7a6546548bada5456ad94a516241
+  libinih_sha512: 99bc40c294b521e9973184bfb30d60c129735991f33b387b3d023827a34672b0489eadf91e38895ea725168dbc7b27bb02c1975debe7573b4b209d0e947b2100
+
+  # renovate: datasource=github-tags extractVersion=^json-c-(?<version>.*)-.*$ versioning=loose depName=json-c/json-c
+  libjson_c_version: 0.15
+  libjson_c_sha256: b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6
+  libjson_c_sha512: dc01298bcc78f0f31a34f5fcfe45c0feebfd88518e97fb4f96f1a652f71ccdd303415a4c7bf5b573bdcbcca80428281f0dfccefc6545ea3a7f18dbb819332f34
+
+  # renovate: datasource=git-tags depName=https://git.tukaani.org/xz.git
+  xz_version: v5.2.4
+  xz_sha256: 9717ae363760dedf573dad241420c5fea86256b65bc21d2cf71b2b12f0544f4b
+  xz_sha512: 00db7dd31a61541b1ce6946e0f21106f418dd1ac3f27cdb8682979cbc3bd777cd6dd1f04f9ba257a0a7e24041e15ca40d0dd5c130380dce62280af67a0beb97f
+
+  # renovate: datasource=github-releases extractVersion=^popt-(?<version>.*)-release$ versioning=loose depName=rpm-software-management/popt
+  libpopt_version: 1.18
+  libpopt_sha256: 5159bc03a20b28ce363aa96765f37df99ea4d8850b1ece17d1e6ad5c24fdc5d1
+  libpopt_sha512: 86422e8762adda3d02d46c20ac74ffe389d4f991d552b6fea729f007345b6426cbeb71160284e2deaa2ce44ce754a9e6cf6ccbd64bff9bc2253df40cdc2f79a5
+
+  # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=seccomp/libseccomp
+  libseccomp_version: 2.5.4
+  libseccomp_sha256: d82902400405cf0068574ef3dc1fe5f5926207543ba1ae6f8e7a1576351dcbdb
+  libseccomp_sha512: 92650bd7d1d48b383f402a536b97a017fd0f6ad1234daf4b938d01c92e8d134a01d2f2dd45fd9e2d025d7556bd1386ec360402145a87f20580c85949d62cea0e
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.liburcu.org/userspace-rcu.git
+  liburcu_version: 0.13.1
+  liburcu_sha256: 3213f33d2b8f710eb920eb1abb279ec04bf8ae6361f44f2513c28c20d3363083
+  liburcu_sha512: c86f2eb260cccb3cb6bd54ddbc0b46e60083fc99423e9403242ebed7f39a2a49c68af933ea6f373e2a9d4f9dc56f5befe030740891e28cf2fabe927a48ff8182
+
+  # renovate: datasource=git-tags versioning=loose depName=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
+  linux_firmware_version: 20220411
+  linux_firmware_sha256: 533ae621b3eacf6a4696dab52a9dbc5727403a175c413b1682ab3f9cfb37872f
+  linux_firmware_sha512: 385d74206b5ab312bc787a460e77d908a383963bec407c2f144f83c6b5a813b2c1de9e6250ffb57aa80e0c328d1fbde96ead79f6da73eb84347660873c05ffe6
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://sourceware.org/git/lvm2.git
+  lvm2_version: 2_03_10
+  lvm2_sha256: 5ad1645a480440892e35f31616682acba0dc204ed049635d2df3e5a5929d0ed0
+  lvm2_sha512: 8678ae2f99739ccad0250f6f4b4b8e84520f2053835985a1ea9c80196a64df31a48858aebf983170c3dfcafecea83f2c6aa630ef73fd31dd84cf1627a1b421e4
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.musl-libc.org/musl
+  musl_version: 1.2.3
+  musl_sha256: 7d5b0b6062521e4627e099e4c9dc8248d32a30285e959b7eecaa780cf8cfd4a4
+  musl_sha512: 9332f713d3eb7de4369bc0327d99252275ee52abf523ee34b894b24a387f67579787f7c72a46cf652e090cffdb0bc3719a4e7b84dca66890b6a37f12e8ad089c
+
+  # renovate: datasource=github-releases depName=NVIDIA/open-gpu-kernel-modules
+  nvidia_driver_version: 515.65.01
+  nvidia_driver_sha256: 4eb71b093cdc5875242ddc6bb1858f619d257389a8f459762e51a0cf923374ee
+  nvidia_driver_sha512: c2ff6fd02272b6981a65e7e14c6b636f0113e21da910898c27682f58e60fa8e6deea3670081c57e4961fb5e7794eef8eddb90d134ba1892536a8468c5dc9d669
+
+  # renovate: datasource=github-releases depName=open-iscsi/open-iscsi
+  open_iscsi_version: 2.1.4
+  open_iscsi_sha256: a5a73f7c795d1dc214100b1eb70647d6c2ceccf8973e584f50ee7f92c40d2a8a
+  open_iscsi_sha512: ae0663a964d86e6a4c19203598b859173c93ecce550f9bc9855ff735dd51a3c45822f2bc1cc99e6891c56ef1d16c42223803f07a961558fe6e38ead2164faef3
+
+  # renovate: datasource=github-releases versioning=loose depName=open-iscsi/open-isns
+  open_isns_version: v0.101
+  open_isns_sha256: f672ec86b6c9e984843a7a28d76f07e26393499c486f86034b8b18caa8deb556
+  open_isns_sha512: e5a392127b0d85f36e9e4aa963c0c502af8c5aea0aba6d12abb4425649969dcc20ba6e87a99083626d981438439b17b71a86320f816042d82ed5dbe7e7a63e77
+
+  # renovate: datasource=git-tags extractVersion=^OpenSSL_(?<version>.*)$ versioning=loose depName=git://git.openssl.org/openssl.git
+  openssl_version: 1_1_1q
+  openssl_sha256: d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca
+  openssl_sha512: cb9f184ec4974a3423ef59c8ec86b6bf523d5b887da2087ae58c217249da3246896fdd6966ee9c13aea9e6306783365239197e9f742c508a0e35e5744e3e085f
+
+  # renovate: datasource=github-tags versioning=loose depName=raspberrypi/firmware
+  raspberrypi_firmware_version: 1.20220331
+  raspberrypi_firmware_sha256: e186889be44a80bc148c0a020aaf580633ddb10ee314c1c7299c74fd73db3dd1
+  raspberrypi_firmware_sha512: c510ddb5eb1c6ea1aa69f0063551445dd21092f68e19b64b885558d2c47735d4e9f781ef9674fbe3a9894d66eb07ccbb004541c9a85005318911fabda899c2cc
+
+  # renovate: datasource=github-tags depName=opencontainers/runc
+  runc_version: v1.1.4
+  runc_ref: 5fd4c4d144137e991c4acebb2146ab1483a97925
+  runc_sha256: 9f5972715dffb0b2371e4d678c1206cc8c4ec5eb80f2d48755d150bac49be35b
+  runc_sha512: 73f7b266a2aaabf180bf99d04e96a171ef12cc3c3ff43189caff324f1e4ac127a646c3c15489801d48291d997de4c88384ae957a8af4a96b3e779bcb09bc58ac
+
+  # renovate: datasource=git-tags extractVersion=^tag-(?<version>.*)$ versioning=loose depName=git://repo.or.cz/socat.git
+  socat_version: 1.7.3.4
+  socat_sha256: d9ed2075abed7b3ec9730ed729b4c8e287c502181c806d4487020418a6e2fc36
+  socat_sha512: c5699fd1a703e90927076599d02323b85722d49e86bc2f627b4301a41d3df72c634af629f378425ff201cde78343da5cd0cad1044bf857665176c91357401fdd
+
+  # renovate: datasource=git-tags extractVersion=^syslinux-(?<version>.*)$ versioning=loose depName=git://git.kernel.org/pub/scm/boot/syslinux/syslinux.git
+  syslinux_version: 6.03
+  syslinux_sha256: 26d3986d2bea109d5dc0e4f8c4822a459276cf021125e8c9f23c3cca5d8c850e
+  syslinux_sha512: dd2b2916962b9e93bc1e714182e3ca2a727a229b8afabe913050bcfdd43ee2af51ee3acf79121d8c20caf434583efaa7f3196871e0e07c04d82191323a50fe31
+
+  # renovate: datasource=github-tags versioning=loose depName=ARM-software/arm-trusted-firmware
+  arm_trusted_firmware_version: v2.7
+  arm_trusted_firmware_sha256: 327c65b1bc231608a7a808b068b00c1a22310e9fc86158813cd10a9711d5725e
+  arm_trusted_firmware_sha512: ff9bd87bf74653275ef9abdf2079974c214e13bd1861bdb3dc4240bdf7e972f3a91c8c6ef86e26afcffe51b29b856c8cf6ffb3d4150d7ccd6a4d3b696bb6f55f
+
+  # renovate: datasource=github-tags versioning=loose depName=u-boot/u-boot
+  uboot_version: 2022.04
+  uboot_sha256: 68e065413926778e276ec3abd28bb32fa82abaa4a6898d570c1f48fbdb08bcd0
+  uboot_sha512: 113056e542db049eea3b1d1ccbbe52c79539a2f9bb6129d284ec9200dcffec7bd5969821913a9899631575b80991c84ad01bc845b4bba614e42e54466d9f0d64
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
+  util_linux_version: 2.38
+  util_linux_sha256: 6d111cbe4d55b336db2f1fbeffbc65b89908704c01136371d32aa9bec373eb64
+  util_linux_sha512: d0f7888f457592067938e216695871ce6475a45d83a092cc3fd72b8cf8fca145ca5f3a99122f1744ef60b4f773055cf4e178dc6c59cd30837172aee0b5597e8c
+
+  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git
+  xfsprogs_version: 5.14.2
+  xfsprogs_sha256: 01ccd3ef9df2837753a5d876b8da84ea957d13d7a461b8c46e8afa4eb09aabc8
+  xfsprogs_sha512: cb9794247a2eed8bd9f10ff811d38f97e4adbed97bad334b0fa8a26503ec224237eddd92fd78892584a153967417ab2009fb2fc8bab6ef12cd53fd20bdba1b4e
 labels:
   org.opencontainers.image.source: https://github.com/siderolabs/pkgs
diff --git a/cni/pkg.yaml b/cni/pkg.yaml
index bdc247d1c..a3028177d 100644
--- a/cni/pkg.yaml
+++ b/cni/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/containernetworking/plugins/archive/refs/tags/v1.1.0.tar.gz
+      - url: https://github.com/containernetworking/plugins/archive/refs/tags/{{ .cni_version }}.tar.gz
         destination: cni-plugins.tar.gz
-        sha256: c256b996fd5a1a2aea0e46a1f322be01afae0899015f65d77863693feccd32a4
-        sha512: 43cfcb0225cbc85cc75205cefac75f852fccce1a71b0384fe1f989e64c37508fc3b87cbc05c6dac679aea8950c3cd4d328a616fa79b52474561c624164da0206
+        sha256: "{{ .cni_sha256 }}"
+        sha512: "{{ .cni_sha512 }}"
     env:
       GOPATH: /go
     prepare:
diff --git a/containerd/pkg.yaml b/containerd/pkg.yaml
index f8f0549e4..9ed6d7f2c 100644
--- a/containerd/pkg.yaml
+++ b/containerd/pkg.yaml
@@ -7,10 +7,10 @@ dependencies:
 steps:
   - sources:
         # sync with version and revision in build
-      - url: https://github.com/containerd/containerd/archive/refs/tags/v1.6.8.tar.gz
+      - url: https://github.com/containerd/containerd/archive/refs/tags/{{ .containerd_version }}.tar.gz
         destination: containerd.tar.gz
-        sha256: f5f938513c28377f64f85e84f2750d39f26b01262f3a062b7e8ce35b560ca407
-        sha512: c204c028cdfd76537d1da01c66526fc85b29b02d2412569bb9b265375603614b037356c61846025a72281398f0f46df326a5ea3df97f57901cce85f2f728f0ba
+        sha256: "{{ .containerd_sha256 }}"
+        sha512: "{{ .containerd_sha512 }}"
     prepare:
       - |
         tar -xzf containerd.tar.gz --strip-components=1
@@ -22,7 +22,7 @@ steps:
         export CGO_ENABLED=1
         export PATH=${PATH}:${TOOLCHAIN}/go/bin
         export BUILDTAGS='seccomp no_aufs no_btrfs no_devmapper no_zfs'
-        make bin/containerd bin/containerd-shim bin/containerd-shim-runc-v2 VERSION=v1.6.8 REVISION=9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
+        make bin/containerd bin/containerd-shim bin/containerd-shim-runc-v2 VERSION={{ .containerd_version }} REVISION={{ .containerd_ref}}
     install:
       - |
         mkdir -p /rootfs/bin
diff --git a/cryptsetup/pkg.yaml b/cryptsetup/pkg.yaml
index 1a1dd1b7c..72abb4ae7 100644
--- a/cryptsetup/pkg.yaml
+++ b/cryptsetup/pkg.yaml
@@ -11,10 +11,10 @@ dependencies:
   - stage: openssl
 steps:
   - sources:
-      - url: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/cryptsetup-2.3.4.tar.gz
+      - url: https://www.kernel.org/pub/linux/utils/cryptsetup/v{{ regexReplaceAll ".\\d+$" .cryptsetup_version "${1}" }}/cryptsetup-{{ .cryptsetup_version }}.tar.gz
         destination: cryptsetup.tar.gz
-        sha256: 8bc16c0b1c987867f13f0f2114fc4182d92bc866d1f84bb725c2cb9bcc55bf93
-        sha512: a0a4981ca7294d6f0568bc9465e78ee1781ad73fe77e8daa0bbe67693534f02d3510e6fba9f76749b90ce7533bc9ac96dd27b73d733f8051e9560a3b4196ca3c
+        sha256: "{{ .cryptsetup_sha256 }}"
+        sha512: "{{ .cryptsetup_sha512 }}"
     env:
       PKG_CONFIG_PATH: /usr/lib/pkgconfig
     prepare:
diff --git a/dosfstools/pkg.yaml b/dosfstools/pkg.yaml
index 3cc3d4202..593a4c54e 100644
--- a/dosfstools/pkg.yaml
+++ b/dosfstools/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/dosfstools/dosfstools/releases/download/v4.2/dosfstools-4.2.tar.gz
+      - url: https://github.com/dosfstools/dosfstools/releases/download/v{{ .dosfstools_version }}/dosfstools-{{ .dosfstools_version }}.tar.gz
         destination: dosfstools.tar.gz
-        sha256: 64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527
-        sha512: 3cc0808edb4432428df8a67da4bb314fd1f27adc4a05754c1a492091741a7b6875ebd9f6a509cc4c5ad85643fc40395b6e0cadee548b25cc439cc9b725980156
+        sha256: "{{ .dosfstools_sha256 }}"
+        sha512: "{{ .dosfstools_sha512 }}"
     prepare:
       - |
         tar -xzf dosfstools.tar.gz --strip-components=1
diff --git a/eudev/pkg.yaml b/eudev/pkg.yaml
index 02842c67a..60d871167 100644
--- a/eudev/pkg.yaml
+++ b/eudev/pkg.yaml
@@ -6,10 +6,10 @@ dependencies:
   - stage: util-linux
 steps:
   - sources:
-      - url: https://github.com/gentoo/eudev/archive/refs/tags/v3.2.11.tar.gz
+      - url: https://github.com/gentoo/eudev/archive/refs/tags/{{ .eudev_version }}.tar.gz
         destination: eudev.tar.gz
-        sha256: dcfc482099f3fdfcfdb9aeabbc4d609877cf4d2d0407f50ab0c59d43fff44f92
-        sha512: 17b328365913af3e434abe667dd0498c3702a41c6cb66f3793ca2c195b05ac06397b0a401077f81df7dd25193e4eeea13657a221ca6cb3d237c4d91e31e30b33
+        sha256: "{{ .eudev_sha256 }}"
+        sha512: "{{ .eudev_sha512 }}"
     prepare:
       - |
         tar -xzf eudev.tar.gz --strip-components=1
diff --git a/flannel-cni/pkg.yaml b/flannel-cni/pkg.yaml
index 5fb0c4495..fd8388583 100644
--- a/flannel-cni/pkg.yaml
+++ b/flannel-cni/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/flannel-io/cni-plugin/archive/refs/tags/v1.1.0.tar.gz
+      - url: https://github.com/flannel-io/cni-plugin/archive/refs/tags/{{ .flannel_cni_version }}.tar.gz
         destination: flannel-cni.tar.gz
-        sha256: 2bd79d899e8a8b3f96bf267ed2d7d5a0da3df45d8581cbf8d9e8433692375ae7
-        sha512: e026bed01f8ac64b584d8c438ccc048df607b2e4832493335b2e266166acebf32f2b58c353bc2ecd3750d920e65a79afef7b28bf4a6405e2f461ab2c8cd953a7
+        sha256: "{{ .flannel_cni_sha256 }}"
+        sha512: "{{ .flannel_cni_sha512 }}"
     env:
       GOPATH: /go
     prepare:
diff --git a/grub/pkg.yaml b/grub/pkg.yaml
index ea3094373..2a8dc4a15 100644
--- a/grub/pkg.yaml
+++ b/grub/pkg.yaml
@@ -6,10 +6,10 @@ dependencies:
   - stage: util-linux
 steps:
   - sources:
-      - url: https://ftp.gnu.org/gnu/grub/grub-2.06.tar.xz
+      - url: https://ftp.gnu.org/gnu/grub/grub-{{ .grub_version }}.tar.xz
         destination: grub.tar.xz
-        sha256: b79ea44af91b93d17cd3fe80bdae6ed43770678a9a5ae192ccea803ebb657ee1
-        sha512: 4f11c648f3078567e53fc0c74d5026fdc6da4be27d188975e79d9a4df817ade0fe5ad2ddd694238a07edc45adfa02943d83c57767dd51548102b375e529e8efe
+        sha256: "{{ .grub_sha256 }}"
+        sha512: "{{ .grub_sha512 }}"
     env: # disable any optimizations, as this breaks GRUB build
       CFLAGS: ""
       CXXFLAGS: ""
diff --git a/ipmitool/pkg.yaml b/ipmitool/pkg.yaml
index 2080c3046..49babfda3 100644
--- a/ipmitool/pkg.yaml
+++ b/ipmitool/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: openssl
 steps:
   - sources:
-      - url: https://github.com/ipmitool/ipmitool/releases/download/IPMITOOL_1_8_18/ipmitool-1.8.18.tar.gz
+      - url: https://github.com/ipmitool/ipmitool/releases/download/IPMITOOL_{{ .ipmitool_version }}/ipmitool-{{ .ipmitool_version | replace "_" "." }}.tar.gz
         destination: ipmitool.tar.gz
         sha256: e93fe5966d59e16bb4317c9c588cdf35d6100753a0ba957c493b064bcad52493
         sha512: 970a3ea69a2a06bf4bb49b07ddea2d575d79afe163f742a53dd29331889d74411d412e7a2117f1964c416b147ad4dc4212dec1fc653521ce710ed1eb45a185a3
diff --git a/iptables/pkg.yaml b/iptables/pkg.yaml
index 48fcbd8bf..6e5c9b666 100644
--- a/iptables/pkg.yaml
+++ b/iptables/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: http://deb.debian.org/debian/pool/main/i/iptables/iptables_1.8.7.orig.tar.bz2
+      - url: https://www.netfilter.org/pub/iptables/iptables-{{ .iptables_version }}.tar.bz2
         destination: iptables.tar.bz2
-        sha256: c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0
-        sha512: c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75
+        sha256: "{{ .iptables_sha256 }}"
+        sha512: "{{ .iptables_sha512 }}"
     prepare:
       - |
         tar -xjf iptables.tar.bz2 --strip-components=1
diff --git a/ipxe/pkg.yaml b/ipxe/pkg.yaml
index bd9e0397e..1d9ba3716 100644
--- a/ipxe/pkg.yaml
+++ b/ipxe/pkg.yaml
@@ -6,12 +6,12 @@ dependencies:
   - stage: liblzma
 steps:
   - sources:
-      - url: https://github.com/ipxe/ipxe/archive/c5af41a6f5b5f4a420b3e539f9e3a8dc9f8dd03e.tar.gz
+      - url: https://github.com/ipxe/ipxe/archive/{{ .ipxe_ref }}.tar.gz
         destination: ipxe.tar.gz
         sha256: 370ef608f6314fe53bef52f780288364aa446428eb774c1cd55c656b81fe23b8
         sha512: 4aa202b8b9489b217c8ef66b8cb3a8179689e98f2807024246d022eadc311f842855d19f20430bdbeb2358aca6ee7c9533d3f60456ba3b1681a8a22f31c2aa50
     env:
-      IPXE_VERSION: 1.21.1+git+c5af41a+sidero
+      IPXE_VERSION: 1.21.1+git+{{ substr 0 7 .ipxe_ref }}+sidero
     prepare:
       - |
         ln -s /toolchain/bin/echo /bin/echo
diff --git a/kernel/prepare/pkg.yaml b/kernel/prepare/pkg.yaml
index 326305bc4..355ea8fa2 100644
--- a/kernel/prepare/pkg.yaml
+++ b/kernel/prepare/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - image: '{{ .TOOLS_IMAGE }}'
 steps:
   - sources:
-      - url: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.63.tar.xz
+      - url: https://cdn.kernel.org/pub/linux/kernel/v{{ regexReplaceAll ".\\d+\\.\\d+$" .linux_version "${1}" }}.x/linux-{{ .linux_version }}.tar.xz
         destination: linux.tar.xz
-        sha256: 6dd3cd1e5a629d0002bc6c6ec7e8ea96710104f38664122dd56c83dfd4eb7341
-        sha512: a1b33476484b9ca7a105d07b70835ad7e7e670750e6beb428ce23fe1bd853d66cd8a1ffca9ee736a98a42b98191d290127e628d33118be971c661e2fc6faf8ca
+        sha256: "{{ .linux_sha256 }}"
+        sha512: "{{ .linux_sha512 }}"
     env:
       ARCH: {{ if eq .ARCH "aarch64"}}arm64{{ else if eq .ARCH "x86_64" }}x86_64{{ else }}unsupported{{ end }}
     prepare:
diff --git a/kmod/pkg.yaml b/kmod/pkg.yaml
index 6ca03ac50..d2b77c936 100644
--- a/kmod/pkg.yaml
+++ b/kmod/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://www.kernel.org/pub/linux/utils/kernel/kmod/kmod-27.tar.xz
+      - url: https://www.kernel.org/pub/linux/utils/kernel/kmod/kmod-{{.kmod_version }}.tar.xz
         destination: kmod.tar.xz
-        sha256: c1d3fbf16ca24b95f334c1de1b46f17bbe5a10b0e81e72668bdc922ebffbbc0c
-        sha512: e0513094935333fca1fb4c3e3493b232507a579ab00a6457cc9ed3e928363d05aad80634fb65a8287a336bf9895194c7be8ddc41bb088a6c2cca44fc1bfbdb6c
+        sha256: "{{ .kmod_sha256 }}"
+        sha512: "{{ .kmod_sha512 }}"
     prepare:
       - |
         tar -xJf kmod.tar.xz --strip-components=1
diff --git a/libaio/pkg.yaml b/libaio/pkg.yaml
index de604d523..46ca4b2ca 100644
--- a/libaio/pkg.yaml
+++ b/libaio/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://releases.pagure.org/libaio/libaio-0.3.112.tar.gz
+      - url: https://releases.pagure.org/libaio/libaio-{{ .libaio_version }}.tar.gz
         destination: libaio.tar.gz
-        sha256: ab0462f2c9d546683e5147b1ce9c195fe95d07fac5bf362f6c01637955c3b492
-        sha512: 5f984529c9f747a6c82f1e4457fc0832bb1fc299ae6e700f2ac5a8ea7b9bfc6ea1e75809728cc115a020cff6685ed1f4e38c6aeacc1ea98dfccce04dd19dafaa
+        sha256: "{{ .libaio_sha256 }}"
+        sha512: "{{ .libaio_sha512 }}"
     prepare:
       - |
         tar -xzf libaio.tar.gz --strip-components=1
diff --git a/libinih/pkg.yaml b/libinih/pkg.yaml
index 420c7e6bc..53d2f1a76 100644
--- a/libinih/pkg.yaml
+++ b/libinih/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/benhoyt/inih/archive/refs/tags/r53.tar.gz
+      - url: https://github.com/benhoyt/inih/archive/refs/tags/r{{ .libinih_version }}.tar.gz
         destination: inih.tar.gz
-        sha256: 01b0366fdfdf6363efc070c2f856f1afa33e7a6546548bada5456ad94a516241
-        sha512: 99bc40c294b521e9973184bfb30d60c129735991f33b387b3d023827a34672b0489eadf91e38895ea725168dbc7b27bb02c1975debe7573b4b209d0e947b2100
+        sha256: "{{ .libinih_sha256 }}"
+        sha512: "{{ .libinih_sha512 }}"
     prepare:
       - |
         tar -xzf inih.tar.gz --strip-components=1
diff --git a/libjson-c/pkg.yaml b/libjson-c/pkg.yaml
index 3979e284f..6945f6ab0 100644
--- a/libjson-c/pkg.yaml
+++ b/libjson-c/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://s3.amazonaws.com/json-c_releases/releases/json-c-0.15.tar.gz
+      - url: https://s3.amazonaws.com/json-c_releases/releases/json-c-{{ .libjson_c_version }}.tar.gz
         destination: json-c.tar.gz
-        sha256: b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6
-        sha512: dc01298bcc78f0f31a34f5fcfe45c0feebfd88518e97fb4f96f1a652f71ccdd303415a4c7bf5b573bdcbcca80428281f0dfccefc6545ea3a7f18dbb819332f34
+        sha256: "{{ .libjson_c_sha256 }}"
+        sha512: "{{ .libjson_c_sha512 }}"
     prepare:
       - |
         tar -xzf json-c.tar.gz --strip-components=1
diff --git a/liblzma/pkg.yaml b/liblzma/pkg.yaml
index 0a5b0a404..5d5066c47 100644
--- a/liblzma/pkg.yaml
+++ b/liblzma/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: http://deb.debian.org/debian/pool/main/x/xz-utils/xz-utils_5.2.4.orig.tar.xz
+      - url: https://github.com/xz-mirror/xz/archive/refs/tags/{{ .xz_version }}.tar.gz
         destination: xz.tar.xz
-        sha256: 9717ae363760dedf573dad241420c5fea86256b65bc21d2cf71b2b12f0544f4b
-        sha512: 00db7dd31a61541b1ce6946e0f21106f418dd1ac3f27cdb8682979cbc3bd777cd6dd1f04f9ba257a0a7e24041e15ca40d0dd5c130380dce62280af67a0beb97f
+        sha256: "{{ .xz_sha256 }}"
+        sha512: "{{ .xz_sha512 }}"
     prepare:
       - |
         tar -xJf xz.tar.xz --strip-components=1
diff --git a/libpopt/pkg.yaml b/libpopt/pkg.yaml
index e07a8a599..8ae277313 100644
--- a/libpopt/pkg.yaml
+++ b/libpopt/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: http://ftp.rpm.org/popt/releases/popt-1.x/popt-1.18.tar.gz
+      - url: http://ftp.rpm.org/popt/releases/popt-1.x/popt-{{ .libpopt_version }}.tar.gz
         destination: popt.tar.gz
-        sha256: 5159bc03a20b28ce363aa96765f37df99ea4d8850b1ece17d1e6ad5c24fdc5d1
-        sha512: 86422e8762adda3d02d46c20ac74ffe389d4f991d552b6fea729f007345b6426cbeb71160284e2deaa2ce44ce754a9e6cf6ccbd64bff9bc2253df40cdc2f79a5
+        sha256: "{{ .libpopt_sha256 }}"
+        sha512: "{{ .libpopt_sha512 }}"
     prepare:
       - |
         tar -xzf popt.tar.gz --strip-components=1
diff --git a/libseccomp/pkg.yaml b/libseccomp/pkg.yaml
index e06b09e1a..7de9cb8a8 100644
--- a/libseccomp/pkg.yaml
+++ b/libseccomp/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/seccomp/libseccomp/releases/download/v2.5.4/libseccomp-2.5.4.tar.gz
+      - url: https://github.com/seccomp/libseccomp/releases/download/v{{ .libseccomp_version }}/libseccomp-{{ .libseccomp_version }}.tar.gz
         destination: libseccomp.tar.gz
-        sha256: d82902400405cf0068574ef3dc1fe5f5926207543ba1ae6f8e7a1576351dcbdb
-        sha512: 92650bd7d1d48b383f402a536b97a017fd0f6ad1234daf4b938d01c92e8d134a01d2f2dd45fd9e2d025d7556bd1386ec360402145a87f20580c85949d62cea0e
+        sha256: "{{ .libseccomp_sha256 }}"
+        sha512: "{{ .libseccomp_sha512 }}"
     prepare:
       - |
         tar -xzf libseccomp.tar.gz --strip-components=1
diff --git a/liburcu/pkg.yaml b/liburcu/pkg.yaml
index f5bd64fb2..295ef174f 100644
--- a/liburcu/pkg.yaml
+++ b/liburcu/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://lttng.org/files/urcu/userspace-rcu-0.13.1.tar.bz2
+      - url: https://lttng.org/files/urcu/userspace-rcu-{{ .liburcu_version }}.tar.bz2
         destination: liburcu.tar.bz2
-        sha256: 3213f33d2b8f710eb920eb1abb279ec04bf8ae6361f44f2513c28c20d3363083
-        sha512: c86f2eb260cccb3cb6bd54ddbc0b46e60083fc99423e9403242ebed7f39a2a49c68af933ea6f373e2a9d4f9dc56f5befe030740891e28cf2fabe927a48ff8182
+        sha256: "{{ .liburcu_sha256 }}"
+        sha512: "{{ .liburcu_sha512 }}"
     prepare:
       - |
         tar -xjf liburcu.tar.bz2 --strip-components=1
diff --git a/linux-firmware/pkg.yaml b/linux-firmware/pkg.yaml
index ba495dbd7..83eea0f77 100644
--- a/linux-firmware/pkg.yaml
+++ b/linux-firmware/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
     - image: '{{ .TOOLS_IMAGE }}'
 steps:
     - sources:
-          - url: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-20220411.tar.gz
+          - url: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-{{ .linux_firmware_version }}.tar.gz
             destination: linux-firmware.tar.gz
-            sha256: 533ae621b3eacf6a4696dab52a9dbc5727403a175c413b1682ab3f9cfb37872f
-            sha512: 385d74206b5ab312bc787a460e77d908a383963bec407c2f144f83c6b5a813b2c1de9e6250ffb57aa80e0c328d1fbde96ead79f6da73eb84347660873c05ffe6
+            sha256: "{{ .linux_firmware_sha256 }}"
+            sha512: "{{ .linux_firmware_sha512 }}"
       prepare:
           - |
               mkdir -p lib/firmware
diff --git a/lvm2/pkg.yaml b/lvm2/pkg.yaml
index 54d0ee258..f3d10c184 100644
--- a/lvm2/pkg.yaml
+++ b/lvm2/pkg.yaml
@@ -8,10 +8,10 @@ dependencies:
   - stage: util-linux
 steps:
   - sources:
-      - url: https://mirrors.kernel.org/sourceware/lvm2/LVM2.2.03.10.tgz
+      - url: https://mirrors.kernel.org/sourceware/lvm2/LVM2.{{ .lvm2_version | replace "_" "." }}.tgz
         destination: lvm2.tar.gz
-        sha256: 5ad1645a480440892e35f31616682acba0dc204ed049635d2df3e5a5929d0ed0
-        sha512: 8678ae2f99739ccad0250f6f4b4b8e84520f2053835985a1ea9c80196a64df31a48858aebf983170c3dfcafecea83f2c6aa630ef73fd31dd84cf1627a1b421e4
+        sha256: "{{ .lvm2_sha256 }}"
+        sha512: "{{ .lvm2_sha512 }}"
     prepare:
       - |
         tar -xzf lvm2.tar.gz --strip-components=1
diff --git a/musl/pkg.yaml b/musl/pkg.yaml
index 3c6d30993..55b37333a 100644
--- a/musl/pkg.yaml
+++ b/musl/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - image: "{{ .TOOLS_IMAGE }}"
 steps:
   - sources:
-      - url: https://www.musl-libc.org/releases/musl-1.2.3.tar.gz
+      - url: https://www.musl-libc.org/releases/musl-{{ .musl_version }}.tar.gz
         destination: musl.tar.gz
-        sha256: 7d5b0b6062521e4627e099e4c9dc8248d32a30285e959b7eecaa780cf8cfd4a4
-        sha512: 9332f713d3eb7de4369bc0327d99252275ee52abf523ee34b894b24a387f67579787f7c72a46cf652e090cffdb0bc3719a4e7b84dca66890b6a37f12e8ad089c
+        sha256: "{{ .musl_sha256 }}"
+        sha512: "{{ .musl_sha512 }}"
     prepare:
       - |
         export PATH=${TOOLCHAIN}/cross/bin:${PATH}
diff --git a/nonfree/kmod-nvidia/pkg.yaml b/nonfree/kmod-nvidia/pkg.yaml
index 1e9b7d6d7..2e6670d3a 100644
--- a/nonfree/kmod-nvidia/pkg.yaml
+++ b/nonfree/kmod-nvidia/pkg.yaml
@@ -6,12 +6,12 @@ dependencies:
 steps:
   - sources:
     # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
-      - url: https://download.nvidia.com/XFree86/Linux-aarch64/515.65.01/NVIDIA-Linux-aarch64-515.65.01.run
+      - url: https://download.nvidia.com/XFree86/Linux-aarch64/{{ .nvidia_driver_version }}/NVIDIA-Linux-aarch64-{{ .nvidia_driver_version }}.run
         destination: nvidia.run
         sha256: 0d2ac6c6ca144c8c7bbf1a62034998463b21f2660a793607d88c031650d93e93
         sha512: 31ec7ba727bf14263eeadc3880bd8f2aaa0fe8c144aa216bb8af06a154dd1aa5f4a787fe386b20f5d739a49c80435bca5f6deba3010c593e1e54ecd29b4ab1b0
     # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
-      - url: https://download.nvidia.com/XFree86/Linux-x86_64/515.65.01/NVIDIA-Linux-x86_64-515.65.01.run
+      - url: https://download.nvidia.com/XFree86/Linux-x86_64/{{ .nvidia_driver_version }}/NVIDIA-Linux-x86_64-{{ .nvidia_driver_version }}.run
         destination: nvidia.run
         sha256: 0492ddc5b5e65aa00cbc762e8d6680205c8d08e103b7131087a15126aee495e9
         sha512: 5221a4ac071eb39a37a841f19cfe4983286dc35e918956b40604404ef36c122612475df7b9a391a9a70bd60f44e598c8a0e5ec54ccc3e90d51f01e1b2fbe5e33
diff --git a/nvidia-open-gpu-kernel-modules/pkg.yaml b/nvidia-open-gpu-kernel-modules/pkg.yaml
index 745274547..c63a9bacf 100644
--- a/nvidia-open-gpu-kernel-modules/pkg.yaml
+++ b/nvidia-open-gpu-kernel-modules/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: kernel-build
 steps:
   - sources:
-      - url: https://github.com/NVIDIA/open-gpu-kernel-modules/archive/refs/tags/515.65.01.tar.gz
+      - url: https://github.com/NVIDIA/open-gpu-kernel-modules/archive/refs/tags/{{ .nvidia_driver_version }}.tar.gz
         destination: open-gpu-kernel-modules.tar.gz
-        sha256: 4eb71b093cdc5875242ddc6bb1858f619d257389a8f459762e51a0cf923374ee
-        sha512: c2ff6fd02272b6981a65e7e14c6b636f0113e21da910898c27682f58e60fa8e6deea3670081c57e4961fb5e7794eef8eddb90d134ba1892536a8468c5dc9d669
+        sha256: "{{ .nvidia_driver_sha256 }}"
+        sha512: "{{ .nvidia_driver_sha512 }}"
     env:
       ARCH: {{ if eq .ARCH "aarch64"}}arm64{{ else if eq .ARCH "x86_64" }}x86_64{{ else }}unsupported{{ end }}
     prepare:
diff --git a/open-iscsi/pkg.yaml b/open-iscsi/pkg.yaml
index 7db3899a8..2765414fb 100644
--- a/open-iscsi/pkg.yaml
+++ b/open-iscsi/pkg.yaml
@@ -9,10 +9,10 @@ dependencies:
   - stage: util-linux
 steps:
   - sources:
-      - url: https://github.com/open-iscsi/open-iscsi/archive/refs/tags/2.1.4.tar.gz
+      - url: https://github.com/open-iscsi/open-iscsi/archive/refs/tags/{{ .open_iscsi_version }}.tar.gz
         destination: open-iscsi.tar.gz
-        sha256: a5a73f7c795d1dc214100b1eb70647d6c2ceccf8973e584f50ee7f92c40d2a8a
-        sha512: ae0663a964d86e6a4c19203598b859173c93ecce550f9bc9855ff735dd51a3c45822f2bc1cc99e6891c56ef1d16c42223803f07a961558fe6e38ead2164faef3
+        sha256: "{{ .open_iscsi_sha256 }}"
+        sha512: "{{ .open_iscsi_sha512 }}"
     prepare:
       - |
         tar -xzf open-iscsi.tar.gz --strip-components=1
diff --git a/open-isns/pkg.yaml b/open-isns/pkg.yaml
index 1626b675f..d2f9a7ad6 100644
--- a/open-isns/pkg.yaml
+++ b/open-isns/pkg.yaml
@@ -6,10 +6,10 @@ dependencies:
   - stage: openssl
 steps:
   - sources:
-      - url: https://github.com/open-iscsi/open-isns/archive/refs/tags/v0.101.tar.gz
+      - url: https://github.com/open-iscsi/open-isns/archive/refs/tags/{{ .open_isns_version }}.tar.gz
         destination: open-isns.tar.gz
-        sha256: f672ec86b6c9e984843a7a28d76f07e26393499c486f86034b8b18caa8deb556
-        sha512: e5a392127b0d85f36e9e4aa963c0c502af8c5aea0aba6d12abb4425649969dcc20ba6e87a99083626d981438439b17b71a86320f816042d82ed5dbe7e7a63e77
+        sha256: "{{ .open_isns_sha256 }}"
+        sha512: "{{ .open_isns_sha512 }}"
     prepare:
       - |
         tar -xzf open-isns.tar.gz --strip-components=1
diff --git a/openssl/pkg.yaml b/openssl/pkg.yaml
index 91090e2c3..5eb29bc13 100644
--- a/openssl/pkg.yaml
+++ b/openssl/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://www.openssl.org/source/openssl-1.1.1q.tar.gz
+      - url: https://www.openssl.org/source/openssl-{{ .openssl_version | replace "_" "." }}.tar.gz
         destination: openssl.tar.gz
-        sha256: d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca
-        sha512: cb9f184ec4974a3423ef59c8ec86b6bf523d5b887da2087ae58c217249da3246896fdd6966ee9c13aea9e6306783365239197e9f742c508a0e35e5744e3e085f
+        sha256: "{{ .openssl_sha256 }}"
+        sha512: "{{ .openssl_sha512 }}"
     env:
       SOURCE_DATE_EPOCH: "1"
     prepare:
diff --git a/raspberrypi-firmware/pkg.yaml b/raspberrypi-firmware/pkg.yaml
index 925733c75..1f0d7947c 100644
--- a/raspberrypi-firmware/pkg.yaml
+++ b/raspberrypi-firmware/pkg.yaml
@@ -6,10 +6,10 @@ dependencies:
 steps:
 # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr restricting build to arm64 only
   - sources:
-      - url: https://github.com/raspberrypi/firmware/archive/refs/tags/1.20220331.tar.gz
+      - url: https://github.com/raspberrypi/firmware/archive/refs/tags/{{ .raspberrypi_firmware_version }}.tar.gz
         destination: raspberrypi-firmware.tar.gz
-        sha256: e186889be44a80bc148c0a020aaf580633ddb10ee314c1c7299c74fd73db3dd1
-        sha512: c510ddb5eb1c6ea1aa69f0063551445dd21092f68e19b64b885558d2c47735d4e9f781ef9674fbe3a9894d66eb07ccbb004541c9a85005318911fabda899c2cc
+        sha256: "{{ .raspberrypi_firmware_sha256 }}"
+        sha512: "{{ .raspberrypi_firmware_sha512 }}"
     prepare:
       - |
         tar -xzf raspberrypi-firmware.tar.gz --strip-components=1
diff --git a/runc/pkg.yaml b/runc/pkg.yaml
index 5048c70da..ef9f660d8 100644
--- a/runc/pkg.yaml
+++ b/runc/pkg.yaml
@@ -7,10 +7,10 @@ dependencies:
 steps:
   - sources:
       # sync with commit in build
-      - url: https://github.com/opencontainers/runc/releases/download/v1.1.4/runc.tar.xz
+      - url: https://github.com/opencontainers/runc/releases/download/{{ .runc_version }}/runc.tar.xz
         destination: runc.tar.xz
-        sha256: 9f5972715dffb0b2371e4d678c1206cc8c4ec5eb80f2d48755d150bac49be35b
-        sha512: 73f7b266a2aaabf180bf99d04e96a171ef12cc3c3ff43189caff324f1e4ac127a646c3c15489801d48291d997de4c88384ae957a8af4a96b3e779bcb09bc58ac
+        sha256: "{{ .runc_sha256 }}"
+        sha512: "{{ .runc_sha512 }}"
     prepare:
       - |
         export GOPATH=/go
@@ -27,7 +27,7 @@ steps:
         export CC=/toolchain/bin/cc
         # This is required due to "loadinternal: cannot find runtime/cgo".
         export CGO_ENABLED=1
-        make EXTRA_LDFLAGS="-w -s" BUILDTAGS="seccomp" COMMIT=5fd4c4d144137e991c4acebb2146ab1483a97925 runc
+        make EXTRA_LDFLAGS="-w -s" BUILDTAGS="seccomp" COMMIT={{ .runc_ref }} runc
     install:
       - |
         export GOPATH=/go
diff --git a/syslinux/pkg.yaml b/syslinux/pkg.yaml
index 83ee4ce53..18b54a69b 100644
--- a/syslinux/pkg.yaml
+++ b/syslinux/pkg.yaml
@@ -6,10 +6,10 @@ dependencies:
   - stage: util-linux
 steps:
   - sources:
-      - url: https://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-6.03.tar.xz
+      - url: https://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-{{ .syslinux_version }}.tar.xz
         destination: syslinux.tar.xz
-        sha256: 26d3986d2bea109d5dc0e4f8c4822a459276cf021125e8c9f23c3cca5d8c850e
-        sha512: dd2b2916962b9e93bc1e714182e3ca2a727a229b8afabe913050bcfdd43ee2af51ee3acf79121d8c20caf434583efaa7f3196871e0e07c04d82191323a50fe31
+        sha256: "{{ .syslinux_sha256 }}"
+        sha512: "{{ .syslinux_sha512 }}"
     prepare:
       - |
         tar -xJf syslinux.tar.xz --strip-components=1
diff --git a/u-boot/pkg.yaml b/u-boot/pkg.yaml
index 26f7a7af7..78de847f8 100644
--- a/u-boot/pkg.yaml
+++ b/u-boot/pkg.yaml
@@ -17,14 +17,14 @@ dependencies:
 steps:
   # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr restricting build to arm64 only
   - sources:
-      - url: https://github.com/ARM-software/arm-trusted-firmware/archive/v2.7.tar.gz
+      - url: https://github.com/ARM-software/arm-trusted-firmware/archive/{{ .arm_trusted_firmware_version }}.tar.gz
         destination: arm-trusted-firmware.tar.gz
-        sha256: 327c65b1bc231608a7a808b068b00c1a22310e9fc86158813cd10a9711d5725e
-        sha512: ff9bd87bf74653275ef9abdf2079974c214e13bd1861bdb3dc4240bdf7e972f3a91c8c6ef86e26afcffe51b29b856c8cf6ffb3d4150d7ccd6a4d3b696bb6f55f
-      - url: https://ftp.denx.de/pub/u-boot/u-boot-2022.04.tar.bz2
+        sha256: "{{ .arm_trusted_firmware_sha256 }}"
+        sha512: "{{ .arm_trusted_firmware_sha512 }}"
+      - url: https://ftp.denx.de/pub/u-boot/u-boot-{{ .uboot_version }}.tar.bz2
         destination: u-boot.tar.bz2
-        sha256: 68e065413926778e276ec3abd28bb32fa82abaa4a6898d570c1f48fbdb08bcd0
-        sha512: 113056e542db049eea3b1d1ccbbe52c79539a2f9bb6129d284ec9200dcffec7bd5969821913a9899631575b80991c84ad01bc845b4bba614e42e54466d9f0d64
+        sha256: "{{ .uboot_sha256 }}"
+        sha512: "{{ .uboot_sha512 }}"
     env:
       SUN50I_A64_ARM_TRUSTED_FIRMWARE: sun50i_a64_arm-trusted-firmware
       RPI_4_A64_ARM_TRUSTED_FIRMWARE: rpi_4_a64_arm-trusted-firmware
diff --git a/util-linux/pkg.yaml b/util-linux/pkg.yaml
index 4280753ed..d483229bb 100644
--- a/util-linux/pkg.yaml
+++ b/util-linux/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://www.kernel.org/pub/linux/utils/util-linux/v2.38/util-linux-2.38.tar.xz
+      - url: https://www.kernel.org/pub/linux/utils/util-linux/v{{ .util_linux_version }}/util-linux-{{ .util_linux_version }}.tar.xz
         destination: util-linux.tar.xz
-        sha256: 6d111cbe4d55b336db2f1fbeffbc65b89908704c01136371d32aa9bec373eb64
-        sha512: d0f7888f457592067938e216695871ce6475a45d83a092cc3fd72b8cf8fca145ca5f3a99122f1744ef60b4f773055cf4e178dc6c59cd30837172aee0b5597e8c
+        sha256: "{{ .util_linux_sha256 }}"
+        sha512: "{{ .util_linux_sha512 }}"
     prepare:
       - |
         tar -xJf util-linux.tar.xz --strip-components=1
diff --git a/xfsprogs/pkg.yaml b/xfsprogs/pkg.yaml
index 5145083fe..ae8a70d1e 100644
--- a/xfsprogs/pkg.yaml
+++ b/xfsprogs/pkg.yaml
@@ -8,10 +8,10 @@ dependencies:
   - stage: liburcu
 steps:
   - sources:
-      - url: https://mirrors.edge.kernel.org/pub/linux/utils/fs/xfs/xfsprogs/xfsprogs-5.14.2.tar.xz
+      - url: https://mirrors.edge.kernel.org/pub/linux/utils/fs/xfs/xfsprogs/xfsprogs-{{ .xfsprogs_version }}.tar.xz
         destination: xfsprogs.tar.xz
-        sha256: 01ccd3ef9df2837753a5d876b8da84ea957d13d7a461b8c46e8afa4eb09aabc8
-        sha512: cb9794247a2eed8bd9f10ff811d38f97e4adbed97bad334b0fa8a26503ec224237eddd92fd78892584a153967417ab2009fb2fc8bab6ef12cd53fd20bdba1b4e
+        sha256: "{{ .xfsprogs_sha256 }}"
+        sha512: "{{ .xfsprogs_sha512 }}"
     env:
       DEBUG: "-DNDEBUG"
     prepare: