diff --git a/README.md b/README.md
index da98710..0c2428b 100644
--- a/README.md
+++ b/README.md
@@ -54,7 +54,6 @@ https://docs.mono.si/gateway-development-kit/getting-started
 Prerequisites
 * make
 * Docker
-* curl (downloading dependency packages, kubelet, crio, etc)
 * git (cloning uboot repo because uboot does not provide direct downloads)
 
 ```
diff --git a/docker/download-packages.Dockerfile b/docker/download-packages.Dockerfile
new file mode 100644
index 0000000..d423894
--- /dev/null
+++ b/docker/download-packages.Dockerfile
@@ -0,0 +1,109 @@
+FROM alpine:3.23.0 AS base
+RUN apk add --no-cache curl ca-certificates
+
+# ---- kubelet ----
+FROM base AS kubelet
+ARG KUBE_VERSION
+ARG ARCH
+WORKDIR /out/kubernetes
+RUN curl -fL --retry 3 -o "kubelet-${KUBE_VERSION}" \
+    "https://dl.k8s.io/${KUBE_VERSION}/bin/linux/${ARCH}/kubelet" && \
+    chmod +x "kubelet-${KUBE_VERSION}"
+
+# ---- kubeadm ----
+FROM base AS kubeadm
+ARG KUBE_VERSION
+ARG ARCH
+WORKDIR /out/kubernetes
+RUN curl -fL --retry 3 -o "kubeadm-${KUBE_VERSION}" \
+    "https://dl.k8s.io/${KUBE_VERSION}/bin/linux/${ARCH}/kubeadm" && \
+    chmod +x "kubeadm-${KUBE_VERSION}"
+
+# ---- kubectl ----
+FROM base AS kubectl
+ARG KUBE_VERSION
+ARG ARCH
+WORKDIR /out/kubernetes
+RUN curl -fL --retry 3 -o "kubectl-${KUBE_VERSION}" \
+    "https://dl.k8s.io/${KUBE_VERSION}/bin/linux/${ARCH}/kubectl" && \
+    chmod +x "kubectl-${KUBE_VERSION}"
+
+# ---- busybox ----
+FROM base AS busybox
+ARG BUSYBOX_VERSION
+WORKDIR /out
+RUN curl -fL --retry 3 -o "busybox-${BUSYBOX_VERSION}.tar.gz" \
+    "https://github.com/mirror/busybox/archive/refs/tags/${BUSYBOX_VERSION}.tar.gz"
+
+# ---- e2fsprogs ----
+FROM base AS e2fsprogs
+ARG E2FSPROGS_VERSION
+WORKDIR /out
+RUN curl -fL --retry 3 -o "e2fsprogs-v${E2FSPROGS_VERSION}.tar.gz" \
+    "https://github.com/tytso/e2fsprogs/archive/refs/tags/v${E2FSPROGS_VERSION}.tar.gz"
+
+# ---- dpdk ----
+FROM base AS dpdk
+ARG DPDK_VERSION
+WORKDIR /out/nxp/dpdk
+RUN curl -fL --retry 3 -o "${DPDK_VERSION}.tar.gz" \
+    "https://github.com/nxp-qoriq/dpdk/archive/refs/tags/${DPDK_VERSION}.tar.gz"
+
+# ---- fmlib ----
+FROM base AS fmlib
+ARG FMLIB_VERSION
+WORKDIR /out/nxp/fmlib
+RUN curl -fL --retry 3 -o "${FMLIB_VERSION}.tar.gz" \
+    "https://github.com/nxp-qoriq/fmlib/archive/refs/tags/${FMLIB_VERSION}.tar.gz"
+
+# ---- fmc ----
+FROM base AS fmc
+ARG FMC_VERSION
+WORKDIR /out/nxp/fmc
+RUN curl -fL --retry 3 -o "${FMC_VERSION}.tar.gz" \
+    "https://github.com/nxp-qoriq/fmc/archive/refs/tags/${FMC_VERSION}.tar.gz"
+
+# ---- vpp ----
+FROM base AS vpp
+ARG VPP_VERSION
+WORKDIR /out/nxp/vpp
+RUN curl -fL --retry 3 -o "${VPP_VERSION}.tar.gz" \
+    "https://github.com/nxp-qoriq/vpp/archive/refs/tags/${VPP_VERSION}.tar.gz"
+
+# ---- alpine rootfs ----
+FROM base AS alpine_rootfs
+ARG ALPINE_SERIES
+ARG ALPINE_ARCH
+ARG ALPINE_VER
+WORKDIR /out
+RUN curl -fL --retry 3 -o "alpine-minirootfs-${ALPINE_VER}-${ALPINE_ARCH}.tar.gz" \
+    "https://dl-cdn.alpinelinux.org/alpine/v${ALPINE_SERIES}/releases/${ALPINE_ARCH}/alpine-minirootfs-${ALPINE_VER}-${ALPINE_ARCH}.tar.gz"
+
+# ---- nxp linux ----
+FROM base AS nxp_linux
+ARG NXP_VERSION
+WORKDIR /out/nxp/kernel
+RUN curl -fL --retry 3 -o "${NXP_VERSION}.tar.gz" \
+    "https://github.com/nxp-qoriq/linux/archive/refs/tags/${NXP_VERSION}.tar.gz"
+
+# ---- crio ----
+FROM base AS crio
+ARG CRIO_VERSION
+WORKDIR /out
+RUN curl -fL --retry 3 -o "${CRIO_VERSION}.tar.gz" \
+    "https://storage.googleapis.com/cri-o/artifacts/${CRIO_VERSION}.tar.gz"
+
+# ---- final exported artifact set ----
+FROM scratch
+COPY --from=kubelet /out/ /
+COPY --from=kubeadm /out/ /
+COPY --from=kubectl /out/ /
+COPY --from=busybox /out/ /
+COPY --from=e2fsprogs /out/ /
+COPY --from=dpdk /out/ /
+COPY --from=fmlib /out/ /
+COPY --from=fmc /out/ /
+COPY --from=vpp /out/ /
+COPY --from=alpine_rootfs /out/ /
+COPY --from=nxp_linux /out/ /
+COPY --from=crio /out/ /
diff --git a/docker/kernel-build.Dockerfile b/docker/kernel-build.Dockerfile
index 9673b6f..7986c6c 100644
--- a/docker/kernel-build.Dockerfile
+++ b/docker/kernel-build.Dockerfile
@@ -14,7 +14,7 @@ RUN test -n "${NXP_VERSION}" || (echo "Please specify NXP_VERSION" >&2; exit 1);
     test -n "${CROSS_COMPILE}" || (echo "Please specify CROSS_COMPILE" >&2; exit 1); \
     test -n "${DEVICE_TREE_TARGET}" || (echo "Please specify DEVICE_TREE_TARGET" >&2; exit 1)
 
-COPY packages/${NXP_VERSION}.tar.gz ./
+COPY packages/nxp/kernel/${NXP_VERSION}.tar.gz ./
 RUN tar -xf ${NXP_VERSION}.tar.gz \
  && mv "linux-${NXP_VERSION}" nxplinux \
  && rm -f ${NXP_VERSION}.tar.gz
diff --git a/docs/ota.md b/docs/ota.md
index f373263..9de4041 100644
--- a/docs/ota.md
+++ b/docs/ota.md
@@ -39,7 +39,7 @@ spec:
         - v1.34.0
 ```
 
-catalog also accepts URL or ※ConfigMap
+catalog also accepts URL or ConfigMap※
 ```yaml
 catalog:
   URL: https://example.com/images.yaml
@@ -48,8 +48,8 @@ catalog:
   ConfigMap: images-cm
 ```
 
-※ ConfigMap requires additional RBAC permission which is not enabled by default. You can edit
-the control-agent's ClusterRole and add `cnofigmaps: get` to allow this.
+※ ConfigMap requires additional RBAC permissions which is not enabled by default. You can edit
+the control-agent's ClusterRole and add `configmaps: get` to allow this.
 
 Contents should look like this
 ```yaml
diff --git a/makefile b/makefile
index 57574a0..569674d 100644
--- a/makefile
+++ b/makefile
@@ -9,11 +9,11 @@ OUT_DIR      := out
 E2FSPROGS_TAR := $(PACKAGES_DIR)/e2fsprogs-$(E2FSPROGS_VERSION).tar.gz
 BUSYBOX_TAR   := $(PACKAGES_DIR)/busybox-$(BUSYBOX_VERSION).tar.gz
 ALPINE_TAR    := $(PACKAGES_DIR)/alpine-minirootfs-$(ALPINE_VER)-$(ALPINE_ARCH).tar.gz
-NXP_TAR       := $(PACKAGES_DIR)/$(NXP_VERSION).tar.gz
-FMLIB_TAR     := $(PACKAGES_DIR)/fmlib/$(FMLIB_VERSION).tar.gz
-FMC_TAR       := $(PACKAGES_DIR)/fmc/$(FMC_VERSION).tar.gz
-VPP_TAR       := $(PACKAGES_DIR)/vpp/$(VPP_VERSION).tar.gz
-DPDK_TAR      := $(PACKAGES_DIR)/dpdk/$(DPDK_VERSION).tar.gz
+NXP_TAR       := $(PACKAGES_DIR)/nxp/kernel/$(NXP_VERSION).tar.gz
+FMLIB_TAR     := $(PACKAGES_DIR)/nxp/fmlib/$(FMLIB_VERSION).tar.gz
+FMC_TAR       := $(PACKAGES_DIR)/nxp/fmc/$(FMC_VERSION).tar.gz
+VPP_TAR       := $(PACKAGES_DIR)/nxp/vpp/$(VPP_VERSION).tar.gz
+DPDK_TAR      := $(PACKAGES_DIR)/nxp/dpdk/$(DPDK_VERSION).tar.gz
 CRIO_TAR      := $(PACKAGES_DIR)/$(CRIO_VERSION).tar.gz
 
 # Kubernetes components
@@ -21,6 +21,8 @@ KUBELET_BIN := $(PACKAGES_DIR)/kubernetes/kubelet-$(KUBE_VERSION)
 KUBEADM_BIN := $(PACKAGES_DIR)/kubernetes/kubeadm-$(KUBE_VERSION)
 KUBECTL_BIN := $(PACKAGES_DIR)/kubernetes/kubectl-$(KUBE_VERSION)
 
+CLITOOLS_BIN := bin/ctl-linux-$(ARCH)-$(TAG)
+
 CONFIGS_DIR          := configs
 SCRIPTS_DIR          := scripts
 CLUSTER_ENV_DEFAULT  := $(CONFIGS_DIR)/cluster.env.default
@@ -33,11 +35,10 @@ INITRAMFS     := $(OUT_DIR)/initramfs.cpio.gz
 CATALOG       := $(OUT_DIR)/catalog-$(KUBE_VERSION)-$(TAG).txt
 RELEASE_IMAGE := $(OUT_DIR)/monok8s-$(KUBE_VERSION)-$(TAG).img.gz
 PART_IMAGE    := $(OUT_DIR)/monok8s-$(KUBE_VERSION)-$(TAG).ext4.zst
-
 KERNEL_IMAGE  := $(OUT_DIR)/Image.gz
 
-BUILD_BASE_STAMP := $(OUT_DIR)/.build-base-$(TAG).stamp
-CLITOOLS_BIN := bin/ctl-linux-$(ARCH)-$(TAG)
+BUILD_BASE_STAMP        := $(OUT_DIR)/.build-base-$(TAG).stamp
+DOWNLOAD_PACKAGES_STAMP := $(PACKAGES_DIR)/.download-packages.stamp
 
 ALPINE_SERIES := $(word 1,$(subst ., ,$(ALPINE_VER))).$(word 2,$(subst ., ,$(ALPINE_VER)))
 
@@ -62,7 +63,6 @@ BUILD_BASE_DEPS := \
 
 KERNEL_DEPS := \
 	$(BUILD_BASE_STAMP) \
-	$(NXP_TAR) \
 	docker/kernel-build.Dockerfile \
 	kernel-extra.config \
 	$(KERNEL_SRCS) \
@@ -71,8 +71,6 @@ KERNEL_DEPS := \
 
 INITRAMFS_DEPS := \
 	$(KERNEL_IMAGE) \
-	$(BUSYBOX_TAR) \
-	$(E2FSPROGS_TAR) \
 	docker/initramfs.Dockerfile \
 	$(INITRAMFS_SRCS) \
 	$(BUILD_INFO_FILE) \
@@ -93,12 +91,7 @@ RELEASE_DEPS := \
 	$(BUILD_BASE_STAMP) \
 	$(BUILD_INFO_FILE) \
 	$(BOARD_ITB) \
-	$(ALPINE_TAR) \
 	$(CLITOOLS_BIN) \
-	$(CRIO_TAR) \
-	$(KUBELET_BIN) \
-	$(KUBEADM_BIN) \
-	$(KUBECTL_BIN) \
 	docker/alpine.Dockerfile \
 	$(ALPINE_SRCS) \
 	build.env \
@@ -109,50 +102,36 @@ RELEASE_DEPS := \
 $(PACKAGES_DIR):
 	mkdir -p $@ \
 		$@/kubernetes \
-		$@/vpp
+		$@/nxp/vpp \
+		$@/nxp/fmc \
+		$@/nxp/fmlib \
+		$@/nxp/kernel \
+		$@/nxp/dpdk
 
 $(OUT_DIR):
 	mkdir -p $@
 
 # ---- Package downloads -------------------------------------------------------
-$(KUBELET_BIN): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://dl.k8s.io/$(KUBE_VERSION)/bin/linux/$(ARCH)/kubelet"
-
-$(KUBEADM_BIN): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://dl.k8s.io/$(KUBE_VERSION)/bin/linux/$(ARCH)/kubeadm"
-
-$(KUBECTL_BIN): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://dl.k8s.io/$(KUBE_VERSION)/bin/linux/$(ARCH)/kubectl"
-
-$(BUSYBOX_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/mirror/busybox/archive/refs/tags/$(BUSYBOX_VERSION).tar.gz"
-
-$(E2FSPROGS_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/tytso/e2fsprogs/archive/refs/tags/v$(E2FSPROGS_VERSION).tar.gz"
-
-$(DPDK_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/nxp-qoriq/dpdk/archive/refs/tags/$(DPDK_VERSION).tar.gz"
-
-$(FMLIB_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/nxp-qoriq/fmlib/archive/refs/tags/$(FMLIB_VERSION).tar.gz"
-
-$(FMC_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/nxp-qoriq/fmc/archive/refs/tags/$(FMC_VERSION).tar.gz"
-
-$(VPP_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/nxp-qoriq/vpp/archive/refs/tags/$(VPP_VERSION).tar.gz"
-
-$(ALPINE_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://dl-cdn.alpinelinux.org/alpine/v$(ALPINE_SERIES)/releases/$(ALPINE_ARCH)/alpine-minirootfs-$(ALPINE_VER)-$(ALPINE_ARCH).tar.gz"
-
-$(NXP_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://github.com/nxp-qoriq/linux/archive/refs/tags/$(NXP_VERSION).tar.gz"
-
-$(CRIO_TAR): | $(PACKAGES_DIR)
-	curl -L -o $@ "https://storage.googleapis.com/cri-o/artifacts/$(CRIO_VERSION).tar.gz"
+$(DOWNLOAD_PACKAGES_STAMP): docker/download-packages.Dockerfile build.env makefile | $(PACKAGES_DIR)
+	docker build \
+		-f docker/download-packages.Dockerfile \
+		--build-arg KUBE_VERSION=$(KUBE_VERSION) \
+		--build-arg ARCH=$(ARCH) \
+		--build-arg BUSYBOX_VERSION=$(BUSYBOX_VERSION) \
+		--build-arg E2FSPROGS_VERSION=$(E2FSPROGS_VERSION) \
+		--build-arg DPDK_VERSION=$(DPDK_VERSION) \
+		--build-arg FMLIB_VERSION=$(FMLIB_VERSION) \
+		--build-arg FMC_VERSION=$(FMC_VERSION) \
+		--build-arg VPP_VERSION=$(VPP_VERSION) \
+		--build-arg ALPINE_SERIES=$(ALPINE_SERIES) \
+		--build-arg ALPINE_ARCH=$(ALPINE_ARCH) \
+		--build-arg ALPINE_VER=$(ALPINE_VER) \
+		--build-arg NXP_VERSION=$(NXP_VERSION) \
+		--build-arg CRIO_VERSION=$(CRIO_VERSION) \
+		--output type=local,dest=./$(PACKAGES_DIR) .
+	@touch $@
 
 # ---- Build stages ------------------------------------------------------------
-
 $(BUILD_INFO_FILE):
 	@mkdir -p $(dir $@)
 	@printf '%s\n' \
@@ -172,7 +151,7 @@ $(BUILD_BASE_STAMP): $(BUILD_BASE_DEPS) | $(OUT_DIR)
 	docker tag monok8s/build-base:$(TAG) monok8s/build-base:$$iid; \
 	touch $@
 
-$(KERNEL_IMAGE): $(KERNEL_DEPS) | $(OUT_DIR)
+$(KERNEL_IMAGE): $(KERNEL_DEPS) $(DOWNLOAD_PACKAGES_STAMP) | $(OUT_DIR)
 	docker build \
 		-f docker/kernel-build.Dockerfile \
 		--build-arg DOCKER_IMAGE_ROOT=$(DOCKER_IMAGE_ROOT) \
@@ -184,7 +163,7 @@ $(KERNEL_IMAGE): $(KERNEL_DEPS) | $(OUT_DIR)
 		--output type=local,dest=./$(OUT_DIR) .
 	test -f $@
 
-$(INITRAMFS): $(INITRAMFS_DEPS) | $(OUT_DIR)
+$(INITRAMFS): $(INITRAMFS_DEPS) $(DOWNLOAD_PACKAGES_STAMP) | $(OUT_DIR)
 	docker build \
 		-f docker/initramfs.Dockerfile \
 		--build-arg DOCKER_IMAGE_ROOT=$(DOCKER_IMAGE_ROOT) \
@@ -239,7 +218,7 @@ $(BOARD_ITB): $(ITB_DEPS) | $(OUT_DIR)
 		--output type=local,dest=./$(OUT_DIR) .
 	test -f $@
 
-$(RELEASE_IMAGE): $(RELEASE_DEPS) | $(OUT_DIR)
+$(RELEASE_IMAGE): $(RELEASE_DEPS) $(DOWNLOAD_PACKAGES_STAMP) | $(OUT_DIR)
 	@build_base_tag=$$(docker image inspect $(DOCKER_IMAGE_ROOT)/build-base:$(TAG) | jq -r '.[0].Id' | cut -d':' -f2 | cut -c -8); \
 	docker build \
 		-f docker/alpine.Dockerfile \
@@ -305,6 +284,7 @@ build-base: $(BUILD_BASE_STAMP)
 clitools: $(CLITOOLS_BIN)
 
 clean:
+	make -C clean clitools
 	rm -f \
 		$(BUILD_BASE_STAMP) \
 		$(KERNEL_IMAGE) \