diff --git a/builders/build-linux-rust/Dockerfile b/builders/build-linux-rust/Dockerfile
index d6da632..be81176 100644
--- a/builders/build-linux-rust/Dockerfile
+++ b/builders/build-linux-rust/Dockerfile
@@ -1,4 +1,4 @@
-FROM rust:1.89.0-bullseye
+FROM buildpack-deps:22.04
 
 ARG REVISION
 
@@ -14,6 +14,49 @@ COPY --from=ghcr.io/nordsecurity/uniffi-generators:v0.28.3-4 /bin/uniffi-bindgen
 
 ENV QDK_TAG=v2.3.14
 
+# Rust installation is based on https://github.com/rust-lang/docker-rust/blob/master/stable/trixie/Dockerfile
+# Builds equivalent of rust:RUST_VERSION-ubuntu22.04.
+# Ubuntu 22.04 is selected to support glibc 2.35 (debian 12 is 2.36).
+# It can be moved to separate base image but right now build-linux-rust is the only user of it.
+# Other crosscompilation platforms can use newer os.
+ENV RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH \
+    RUST_VERSION=1.89.0
+
+RUN set -eux; \
+    \
+    arch="$(dpkg --print-architecture)"; \
+    case "$arch" in \
+        'amd64') \
+            rustArch='x86_64-unknown-linux-gnu'; \
+            rustupSha256='4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10'; \
+            ;; \
+        'arm64'|'aarch64') \
+            rustArch='aarch64-unknown-linux-gnu'; \
+            rustupSha256='9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792'; \
+            ;; \
+        *) \
+            echo >&2 "unsupported rustup architecture: $arch"; \
+            exit 1; \
+            ;; \
+    esac; \
+    \
+    url="https://static.rust-lang.org/rustup/archive/1.29.0/${rustArch}/rustup-init"; \
+    wget --progress=dot:giga "$url"; \
+    echo "${rustupSha256} *rustup-init" | sha256sum -c -; \
+    \
+    chmod +x rustup-init; \
+    ./rustup-init -y --no-modify-path --profile minimal --default-toolchain $RUST_VERSION --default-host ${rustArch}; \
+    rm rustup-init; \
+    chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \
+    \
+    rustup --version; \
+    cargo --version; \
+    rustc --version;
+# end of rust installation
+
+
 # Multilib is not present in an arm64 debian but is used by libtelio
 RUN set -eux; \
     export DEBIAN_FRONTEND=noninteractive; \
diff --git a/builders/build-openwrt-rust/Dockerfile b/builders/build-openwrt-rust/Dockerfile
index a8a538c..c368ccd 100644
--- a/builders/build-openwrt-rust/Dockerfile
+++ b/builders/build-openwrt-rust/Dockerfile
@@ -1,4 +1,4 @@
-FROM rust:1.89.0-bullseye
+FROM rust:1.89.0
 
 ARG REVISION
 
@@ -24,6 +24,10 @@ RUN set -eux; \
     else \
         apt-get install -y python3-pip; \
     fi; \
+    dpkg --add-architecture arm64; \
+    apt-get update; \
+    # for aarch64 musl headers, should not use glibc headers
+    apt-get install -y musl-dev:arm64; \
     rm -rf /var/lib/apt/lists/*
 
 # protoc
@@ -69,8 +73,8 @@ RUN rustup component add clippy rustfmt
 # Cargo linker config for cross-compilation
 COPY builders/build-openwrt-rust/cargo-config.toml ${CARGO_HOME}/config.toml
 
-# AWS LC includes for cross-compilation
-ENV AWS_LC_SYS_INCLUDES_aarch64_unknown_linux_musl="/usr/aarch64-linux-gnu/include"
-ENV AWS_LC_SYS_INCLUDES_armv7_unknown_linux_musleabihf="/opt/arm-linux-musleabihf-cross/arm-linux-musleabihf/include"
+# musl include for cross-compilation (needed for AWS_LC)
+# rustup doesn't bundle musl includes and includes are picked from linker aarch64-linux-gnu-gcc
+ENV CFLAGS_aarch64_unknown_linux_musl="-isystem /usr/include/aarch64-linux-musl"
 
 ENV BYPASS_LLT_SECRETS=1
diff --git a/builders/package-aar-jdk-17/Dockerfile b/builders/package-aar-jdk-17/Dockerfile
index d4efa50..1886b13 100644
--- a/builders/package-aar-jdk-17/Dockerfile
+++ b/builders/package-aar-jdk-17/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim
+FROM debian:trixie-slim
 
 ARG REVISION
 
@@ -7,30 +7,41 @@ LABEL org.opencontainers.image.description="AAR packaging image"
 LABEL org.opencontainers.image.licenses=GPL-3.0
 LABEL org.opencontainers.image.revision=$REVISION
 
-ENV ANDROID_COMPILE_SDK 29
-ENV ANDROID_BUILD_TOOLS 29.0.2
-ENV ANDROID_SDK_TOOLS 10406996
+ENV ANDROID_COMPILE_SDK=29
+ENV ANDROID_BUILD_TOOLS=29.0.2
+ENV ANDROID_SDK_TOOLS=10406996
 
-ENV ANDROID_SDK_ROOT /root/android-sdk-linux/
+ENV ANDROID_SDK_ROOT=/root/android-sdk-linux/
 
-ENV WORKDIR /root
+ENV WORKDIR=/root
 WORKDIR ${WORKDIR}
 
-# Install Android SDK
-RUN apt-get update && apt-get install -y \
-        openjdk-17-jdk \
-        openjdk-11-jdk \
+RUN export DEBIAN_FRONTEND=noninteractive \
+    && apt-get update \
+    && apt-get install -y \
+        apt-transport-https \
         bash \
         curl \
         git \
+        gnupg \
         python3 \
         python3-requests \
         python3-pip \
         unzip \
         wget \
+    && . /etc/os-release \
+    && install -d -m 0755 /etc/apt/keyrings \
+    && wget -qO- https://packages.adoptium.net/artifactory/api/gpg/key/public \
+        | gpg --dearmor -o /etc/apt/keyrings/adoptium.gpg \
+    && printf 'Types: deb\nURIs: https://packages.adoptium.net/artifactory/deb\nSuites: %s\nComponents: main\nSigned-By: /etc/apt/keyrings/adoptium.gpg\n' \
+        "$VERSION_CODENAME" > /etc/apt/sources.list.d/adoptium.sources \
+    && apt-get update \
+    && apt-get install -y  \
+        temurin-17-jdk \
+        temurin-11-jdk \
     && rm -rf /var/lib/apt/lists/*
 
-ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
+ENV JAVA_HOME=/usr/lib/jvm/temurin-17-jdk-amd64
     
 RUN ARCH=$(uname -m) && \
     case $ARCH in \
@@ -50,7 +61,7 @@ RUN ARCH=$(uname -m) && \
 
 ENV PATH="$PATH:/root/.local/bin"
 
-ENV ANDROID_SDK_CHECKSUM 8919e8752979db73d8321e9babe2caedcc393750817c1a5f56c128ec442fb540
+ENV ANDROID_SDK_CHECKSUM=8919e8752979db73d8321e9babe2caedcc393750817c1a5f56c128ec442fb540
 RUN wget --output-document=android-sdk.zip https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_SDK_TOOLS}_latest.zip && \
     echo "${ANDROID_SDK_CHECKSUM} android-sdk.zip" | sha256sum --check && \
     mkdir android-sdk-linux && \
@@ -68,8 +79,8 @@ ENV ANDROID_HOME=${WORKDIR}/android-sdk-linux
 ENV PATH=${PATH}:${ANDROID_HOME}/platform-tools
 
 # Install gradle
-ENV GRADLE_VERSION 9.0.0
-ENV GRADLE_CHECKSUM f759b8dd5204e2e3fa4ca3e73f452f087153cf81bac9561eeb854229cc2c5365
+ENV GRADLE_VERSION=9.0.0
+ENV GRADLE_CHECKSUM=f759b8dd5204e2e3fa4ca3e73f452f087153cf81bac9561eeb854229cc2c5365
 
 RUN wget https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-all.zip && \
     echo "${GRADLE_CHECKSUM} gradle-${GRADLE_VERSION}-all.zip" | sha256sum --check && \
@@ -77,6 +88,6 @@ RUN wget https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-all.
     rm gradle-${GRADLE_VERSION}-all.zip
 ENV PATH=${PATH}:${WORKDIR}/gradle-${GRADLE_VERSION}/bin
 
-ENTRYPOINT /bin/bash
+CMD ["/bin/bash"] 
 
-ENV WORKDIR ""
+ENV WORKDIR=""