diff --git a/cpp-low-level/Dockerfile b/cpp-low-level/Dockerfile
index b590fab..5a0bf04 100644
--- a/cpp-low-level/Dockerfile
+++ b/cpp-low-level/Dockerfile
@@ -1,18 +1,35 @@
 # syntax=docker.io/docker/dockerfile:1
-FROM --platform=linux/riscv64 ubuntu:22.04 AS builder
+
+# This enforces that the packages downloaded from the repositories are the same
+# for the defined date, no matter when the image is built.
+ARG UBUNTU_TAG=noble-20241009
+ARG APT_UPDATE_SNAPSHOT=20241010T030400Z
+
+################################################################################
+# riscv64 base stage
+FROM --platform=linux/riscv64 ubuntu:${UBUNTU_TAG} AS base
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# riscv64 builder stage
+FROM base AS builder
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
   autoconf \
   automake \
   build-essential \
-  ca-certificates \
-  curl \
-  libtool \
-  wget
+  libtool
 rm -rf /var/lib/apt/lists/*
 EOF
 
@@ -21,7 +38,9 @@ WORKDIR /opt/cartesi/dapp
 COPY . .
 RUN make
 
-FROM --platform=linux/riscv64 ubuntu:22.04
+################################################################################
+# runtime stage: produces final image that will be executed
+FROM base
 
 ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
 ADD https://github.com/cartesi/machine-emulator-tools/releases/download/v${MACHINE_EMULATOR_TOOLS_VERSION}/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb /
@@ -34,9 +53,8 @@ LABEL io.cartesi.rollups.ram_size=128Mi
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-  busybox-static=1:1.30.1-7ubuntu3
+  busybox-static
 rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/*
 useradd --create-home --user-group dapp
 EOF
diff --git a/cpp-low-level/dapp.cpp b/cpp-low-level/dapp.cpp
index b52e90b..eed2aa6 100644
--- a/cpp-low-level/dapp.cpp
+++ b/cpp-low-level/dapp.cpp
@@ -39,7 +39,7 @@ static int open_rollup_device()
     return fd;
 }
 
-static std::string get_ioctl_name(int request)
+static std::string get_ioctl_name(long int request)
 {
     switch (request)
     {
diff --git a/cpp/3rdparty/Makefile b/cpp/3rdparty/Makefile
index 1bb4b43..679c6d0 100644
--- a/cpp/3rdparty/Makefile
+++ b/cpp/3rdparty/Makefile
@@ -3,13 +3,13 @@
 all: cpp-httplib picojson
 
 cpp-httplib:
-	wget https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.10.4.tar.gz && \
+	curl -fsSL -O https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.10.4.tar.gz && \
   tar xvf v0.10.4.tar.gz && \
   rm v0.10.4.tar.gz && \
   mv cpp-httplib-0.10.4 cpp-httplib
 
 picojson:
-	wget https://github.com/kazuho/picojson/archive/refs/tags/v1.3.0.tar.gz && \
+	curl -fsSL -O https://github.com/kazuho/picojson/archive/refs/tags/v1.3.0.tar.gz && \
   tar xvf v1.3.0.tar.gz && \
   rm v1.3.0.tar.gz && \
   mv picojson-1.3.0 picojson
diff --git a/cpp/Dockerfile b/cpp/Dockerfile
index 386578b..0c25d56 100644
--- a/cpp/Dockerfile
+++ b/cpp/Dockerfile
@@ -1,18 +1,35 @@
 # syntax=docker.io/docker/dockerfile:1
-FROM --platform=linux/riscv64 ubuntu:22.04 AS builder
+
+# This enforces that the packages downloaded from the repositories are the same
+# for the defined date, no matter when the image is built.
+ARG UBUNTU_TAG=noble-20241009
+ARG APT_UPDATE_SNAPSHOT=20241010T030400Z
+
+################################################################################
+# riscv64 base stage
+FROM --platform=linux/riscv64 ubuntu:${UBUNTU_TAG} AS base
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# riscv64 builder stage
+FROM base AS builder
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
   autoconf \
   automake \
   build-essential \
-  ca-certificates \
-  curl \
-  libtool \
-  wget
+  libtool
 rm -rf /var/lib/apt/lists/*
 EOF
 
@@ -20,7 +37,9 @@ WORKDIR /opt/cartesi/dapp
 COPY . .
 RUN make
 
-FROM --platform=linux/riscv64 ubuntu:22.04
+################################################################################
+# runtime stage: produces final image that will be executed
+FROM base
 
 ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
 ADD https://github.com/cartesi/machine-emulator-tools/releases/download/v${MACHINE_EMULATOR_TOOLS_VERSION}/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb /
@@ -33,9 +52,8 @@ LABEL io.cartesi.rollups.ram_size=128Mi
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-  busybox-static=1:1.30.1-7ubuntu3
+  busybox-static
 rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/*
 useradd --create-home --user-group dapp
 EOF
diff --git a/go/Dockerfile b/go/Dockerfile
index 1f2e97e..740ad96 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -1,23 +1,55 @@
 # syntax=docker.io/docker/dockerfile:1
-FROM ubuntu:22.04 AS build-stage
 
+# This enforces that the packages downloaded from the repositories are the same
+# for the defined date, no matter when the image is built.
+ARG UBUNTU_TAG=noble-20241009
+ARG APT_UPDATE_SNAPSHOT=20241010T030400Z
+
+################################################################################
+# riscv64 base stage
+FROM --platform=linux/riscv64 ubuntu:${UBUNTU_TAG} AS base-riscv64
+
+ARG APT_UPDATE_SNAPSHOT
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
-set -e
+set -eu
 apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# cross base stage
+FROM --platform=$BUILDPLATFORM ubuntu:${UBUNTU_TAG} AS base-cross
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# cross build stage
+FROM base-cross AS cross-build-stage
+
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -e
 apt install -y --no-install-recommends \
-    build-essential=12.9ubuntu3 \
+    build-essential \
     ca-certificates \
-    g++-riscv64-linux-gnu=4:11.2.0--1ubuntu1 \
-    wget
+    g++-riscv64-linux-gnu
 EOF
 
-ARG GOVERSION=1.20.5
+ARG GOVERSION=1.23.2
 
 WORKDIR /opt/build
 
-RUN wget https://go.dev/dl/go${GOVERSION}.linux-$(dpkg --print-architecture).tar.gz && \
-  tar -C /usr/local -xzf go${GOVERSION}.linux-$(dpkg --print-architecture).tar.gz
+RUN curl -fsSL https://go.dev/dl/go${GOVERSION}.linux-$(dpkg --print-architecture).tar.gz | \
+  tar -C /usr/local -xzf -
 
 ENV GOOS=linux
 ENV GOARCH=riscv64
@@ -29,8 +61,9 @@ COPY src .
 
 RUN make
 
+################################################################################
 # runtime stage: produces final image that will be executed
-FROM --platform=linux/riscv64 ubuntu:22.04
+FROM base-riscv64
 
 ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
 ADD https://github.com/cartesi/machine-emulator-tools/releases/download/v${MACHINE_EMULATOR_TOOLS_VERSION}/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb /
@@ -43,9 +76,8 @@ LABEL io.cartesi.rollups.ram_size=128Mi
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-  busybox-static=1:1.30.1-7ubuntu3
+  busybox-static
 rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/*
 useradd --create-home --user-group dapp
 EOF
@@ -53,7 +85,7 @@ EOF
 ENV PATH="/opt/cartesi/bin:${PATH}"
 
 WORKDIR /opt/cartesi/dapp
-COPY --from=build-stage /opt/build/dapp .
+COPY --from=cross-build-stage /opt/build/dapp .
 
 ENV ROLLUP_HTTP_SERVER_URL="http://127.0.0.1:5004"
 
diff --git a/go/src/dapp.go b/go/src/dapp.go
index 88796d2..cb97db1 100644
--- a/go/src/dapp.go
+++ b/go/src/dapp.go
@@ -2,91 +2,90 @@ package main
 
 import (
 	"encoding/json"
-	"io/ioutil"
-  "strconv"
-  "fmt"
-  "log"
-  "os"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"strconv"
 
-  "dapp/rollups"
+	"dapp/rollups"
 )
 
 var (
-  infolog  = log.New(os.Stderr, "[ info ]  ", log.Lshortfile)
-  errlog   = log.New(os.Stderr, "[ error ] ", log.Lshortfile)
+	infolog = log.New(os.Stderr, "[ info ]  ", log.Lshortfile)
+	errlog  = log.New(os.Stderr, "[ error ] ", log.Lshortfile)
 )
 
 func HandleAdvance(data *rollups.AdvanceResponse) error {
-  dataMarshal, err := json.Marshal(data)
-  if err != nil {
-    return fmt.Errorf("HandleAdvance: failed marshaling json: %w", err)
-  }
-  infolog.Println("Received advance request data", string(dataMarshal))
-  return nil
+	dataMarshal, err := json.Marshal(data)
+	if err != nil {
+		return fmt.Errorf("HandleAdvance: failed marshaling json: %w", err)
+	}
+	infolog.Println("Received advance request data", string(dataMarshal))
+	return nil
 }
 
-
 func HandleInspect(data *rollups.InspectResponse) error {
-  dataMarshal, err := json.Marshal(data)
-  if err != nil {
-    return fmt.Errorf("HandleInspect: failed marshaling json: %w", err)
-  }
-  infolog.Println("Received inspect request data", string(dataMarshal))
-  return nil
+	dataMarshal, err := json.Marshal(data)
+	if err != nil {
+		return fmt.Errorf("HandleInspect: failed marshaling json: %w", err)
+	}
+	infolog.Println("Received inspect request data", string(dataMarshal))
+	return nil
 }
 
 func Handler(response *rollups.FinishResponse) error {
-  var err error
+	var err error
 
-  switch response.Type {
-  case "advance_state":
-    data := new(rollups.AdvanceResponse)
-    if err = json.Unmarshal(response.Data, data); err != nil {
-      return fmt.Errorf("Handler: Error unmarshaling advance:", err)
-    }
-    err = HandleAdvance(data)
-  case "inspect_state":
-    data := new(rollups.InspectResponse)
-    if err = json.Unmarshal(response.Data, data); err != nil {
-      return fmt.Errorf("Handler: Error unmarshaling inspect:", err)
-    }
-    err = HandleInspect(data)
-  }
-  return err
+	switch response.Type {
+	case "advance_state":
+		data := new(rollups.AdvanceResponse)
+		if err = json.Unmarshal(response.Data, data); err != nil {
+			return fmt.Errorf("Handler: Error unmarshaling advance: %s", err)
+		}
+		err = HandleAdvance(data)
+	case "inspect_state":
+		data := new(rollups.InspectResponse)
+		if err = json.Unmarshal(response.Data, data); err != nil {
+			return fmt.Errorf("Handler: Error unmarshaling inspect: %s", err)
+		}
+		err = HandleInspect(data)
+	}
+	return err
 }
 
 func main() {
-  finish := rollups.FinishRequest{"accept"}
+	finish := rollups.FinishRequest{Status: "accept"}
+
+	for {
+		infolog.Println("Sending finish")
+		res, err := rollups.SendFinish(&finish)
+		if err != nil {
+			errlog.Panicln("Error: error making http request: ", err)
+		}
+		infolog.Println("Received finish status ", strconv.Itoa(res.StatusCode))
 
-  for true {
-    infolog.Println("Sending finish")
-    res, err := rollups.SendFinish(&finish)
-    if err != nil {
-      errlog.Panicln("Error: error making http request: ", err)
-    }
-    infolog.Println("Received finish status ", strconv.Itoa(res.StatusCode))
-    
-    if (res.StatusCode == 202){
-      infolog.Println("No pending rollup request, trying again")
-    } else {
+		if res.StatusCode == 202 {
+			infolog.Println("No pending rollup request, trying again")
+		} else {
 
-      resBody, err := ioutil.ReadAll(res.Body)
-      if err != nil {
-        errlog.Panicln("Error: could not read response body: ", err)
-      }
-      
-      var response rollups.FinishResponse
-      err = json.Unmarshal(resBody, &response)
-      if err != nil {
-        errlog.Panicln("Error: unmarshaling body:", err)
-      }
+			resBody, err := io.ReadAll(res.Body)
+			if err != nil {
+				errlog.Panicln("Error: could not read response body: ", err)
+			}
 
-      finish.Status = "accept"
-      err = Handler(&response)
-      if err != nil {
-        errlog.Println(err)
-        finish.Status = "reject"
-      }
-    }
-  }
-}
\ No newline at end of file
+			var response rollups.FinishResponse
+			err = json.Unmarshal(resBody, &response)
+			if err != nil {
+				errlog.Panicln("Error: unmarshaling body:", err)
+			}
+
+			finish.Status = "accept"
+			err = Handler(&response)
+			if err != nil {
+				errlog.Println(err)
+				finish.Status = "reject"
+			}
+		}
+	}
+}
diff --git a/go/src/rollups/helpers.go b/go/src/rollups/helpers.go
index 624dd17..22204df 100644
--- a/go/src/rollups/helpers.go
+++ b/go/src/rollups/helpers.go
@@ -1,79 +1,79 @@
 package rollups
 
 import (
-	"encoding/json"
+	"bytes"
 	"encoding/hex"
+	"encoding/json"
 	"net/http"
-	"bytes"
-  "os"
+	"os"
 )
 
 var rollup_server = os.Getenv("ROLLUP_HTTP_SERVER_URL")
 
 func SendPost(endpoint string, jsonData []byte) (*http.Response, error) {
-  req, err := http.NewRequest(http.MethodPost, rollup_server + "/" + endpoint, bytes.NewBuffer(jsonData))
-  if err != nil {
-    return &http.Response{}, err
-  }
-  req.Header.Set("Content-Type", "application/json; charset=UTF-8")
+	req, err := http.NewRequest(http.MethodPost, rollup_server+"/"+endpoint, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return &http.Response{}, err
+	}
+	req.Header.Set("Content-Type", "application/json; charset=UTF-8")
 
-  return http.DefaultClient.Do(req)
+	return http.DefaultClient.Do(req)
 }
 
 func SendFinish(finish *FinishRequest) (*http.Response, error) {
-  body, err := json.Marshal(finish)
-  if err != nil {
-    return &http.Response{}, err
-  }
-  
-  return SendPost("finish", body)
+	body, err := json.Marshal(finish)
+	if err != nil {
+		return &http.Response{}, err
+	}
+
+	return SendPost("finish", body)
 }
 
 func SendReport(report *ReportRequest) (*http.Response, error) {
-  body, err := json.Marshal(report)
-  if err != nil {
-    return &http.Response{}, err
-  }
-  
-  return SendPost("report", body)
+	body, err := json.Marshal(report)
+	if err != nil {
+		return &http.Response{}, err
+	}
+
+	return SendPost("report", body)
 }
 
 func SendNotice(notice *NoticeRequest) (*http.Response, error) {
-  body, err := json.Marshal(notice)
-  if err != nil {
-    return &http.Response{}, err
-  }
-  
-  return SendPost("notice", body)
+	body, err := json.Marshal(notice)
+	if err != nil {
+		return &http.Response{}, err
+	}
+
+	return SendPost("notice", body)
 }
 
 func SendVoucher(voucher *VoucherRequest) (*http.Response, error) {
-  body, err := json.Marshal(voucher)
-  if err != nil {
-    return &http.Response{}, err
-  }
-  
-  return SendPost("voucher", body)
+	body, err := json.Marshal(voucher)
+	if err != nil {
+		return &http.Response{}, err
+	}
+
+	return SendPost("voucher", body)
 }
 
 func SendException(exception *ExceptionRequest) (*http.Response, error) {
-  body, err := json.Marshal(exception)
-  if err != nil {
-    return &http.Response{}, err
-  }
-  
-  return SendPost("exception", body)
+	body, err := json.Marshal(exception)
+	if err != nil {
+		return &http.Response{}, err
+	}
+
+	return SendPost("exception", body)
 }
 
 func Hex2Str(hx string) (string, error) {
-  str, err := hex.DecodeString(hx[2:])
+	str, err := hex.DecodeString(hx[2:])
 	if err != nil {
-    return string(str), err
+		return string(str), err
 	}
-  return string(str), nil
+	return string(str), nil
 }
 
 func Str2Hex(str string) string {
-  hx := hex.EncodeToString([]byte(str))
-  return "0x"+string(hx)
+	hx := hex.EncodeToString([]byte(str))
+	return "0x" + string(hx)
 }
diff --git a/go/src/rollups/model.go b/go/src/rollups/model.go
index a8a1fb9..a463228 100644
--- a/go/src/rollups/model.go
+++ b/go/src/rollups/model.go
@@ -5,48 +5,48 @@ import (
 )
 
 type FinishRequest struct {
-  Status string         `json:"status"`
+	Status string `json:"status"`
 }
 
 type FinishResponse struct {
-  Type string           `json:"request_type"`
-  Data json.RawMessage  `json:"data"`
+	Type string          `json:"request_type"`
+	Data json.RawMessage `json:"data"`
 }
 
 type InspectResponse struct {
-  Payload string        `json:"payload"`
+	Payload string `json:"payload"`
 }
 
 type AdvanceResponse struct {
-  Metadata Metadata     `json:"metadata"`
-  Payload string        `json:"payload"`
+	Metadata Metadata `json:"metadata"`
+	Payload  string   `json:"payload"`
 }
 
 type Metadata struct {
-  MsgSender string      `json:"msg_sender"`
-  EpochIndex uint64     `json:"epoch_index"`
-  InputIndex uint64     `json:"input_index"`
-  BlockNumber uint64    `json:"block_number"`
-  Timestamp uint64      `json:"timestamp"`
+	MsgSender   string `json:"msg_sender"`
+	EpochIndex  uint64 `json:"epoch_index"`
+	InputIndex  uint64 `json:"input_index"`
+	BlockNumber uint64 `json:"block_number"`
+	Timestamp   uint64 `json:"timestamp"`
 }
 
 type ReportRequest struct {
-  Payload string        `json:"payload"`
+	Payload string `json:"payload"`
 }
 
 type NoticeRequest struct {
-  Payload string        `json:"payload"`
+	Payload string `json:"payload"`
 }
 
 type VoucherRequest struct {
-  Destination string    `json:"destination"`
-  Payload string        `json:"payload"`
+	Destination string `json:"destination"`
+	Payload     string `json:"payload"`
 }
 
 type ExceptionRequest struct {
-  Payload string        `json:"payload"`
+	Payload string `json:"payload"`
 }
 
 type IndexResponse struct {
-  Index uint64        `json:"index"`
+	Index uint64 `json:"index"`
 }
diff --git a/lua/Dockerfile b/lua/Dockerfile
index 8019356..ef981d3 100644
--- a/lua/Dockerfile
+++ b/lua/Dockerfile
@@ -1,22 +1,44 @@
 # syntax=docker.io/docker/dockerfile:1
-FROM --platform=linux/riscv64 ubuntu:22.04 AS builder
+
+# This enforces that the packages downloaded from the repositories are the same
+# for the defined date, no matter when the image is built.
+ARG UBUNTU_TAG=noble-20241009
+ARG APT_UPDATE_SNAPSHOT=20241010T030400Z
+
+################################################################################
+# riscv64 base stage
+FROM --platform=linux/riscv64 ubuntu:${UBUNTU_TAG} AS base
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# riscv64 builder stage
+FROM base AS builder
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-  build-essential=12.9ubuntu3 \
-  lua5.4=5.4.4-1 \
-  liblua5.4-dev=5.4.4-1 \
-  luarocks=3.8.0+dfsg1-1
+  build-essential \
+  liblua5.4-dev \
+  lua5.4 \
+  luarocks
 rm -rf /var/lib/apt/lists/*
 
 luarocks install --lua-version=5.4 luasocket 3.1.0-1
 luarocks install --lua-version=5.4 dkjson 2.6-1
 EOF
 
-FROM --platform=linux/riscv64 ubuntu:22.04
+################################################################################
+# riscv64 final stage
+FROM base
 
 ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
 ADD https://github.com/cartesi/machine-emulator-tools/releases/download/v${MACHINE_EMULATOR_TOOLS_VERSION}/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb /
@@ -29,11 +51,10 @@ LABEL io.cartesi.rollups.ram_size=128Mi
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-  busybox-static=1:1.30.1-7ubuntu3 \
-  liblua5.4-dev=5.4.4-1 \
-  lua5.4=5.4.4-1
+  busybox-static \
+  liblua5.4-dev \
+  lua5.4
 rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/*
 useradd --create-home --user-group dapp
 EOF
diff --git a/ruby/Dockerfile b/ruby/Dockerfile
index 287adda..0cb173d 100644
--- a/ruby/Dockerfile
+++ b/ruby/Dockerfile
@@ -1,17 +1,34 @@
 # syntax=docker.io/docker/dockerfile:1
-FROM --platform=linux/riscv64 ubuntu:22.04 AS base
 
-RUN apt-get update
+# This enforces that the packages downloaded from the repositories are the same
+# for the defined date, no matter when the image is built.
+ARG UBUNTU_TAG=noble-20241009
+ARG APT_UPDATE_SNAPSHOT=20241010T030400Z
 
+################################################################################
+# riscv64 base stage
+FROM --platform=linux/riscv64 ubuntu:${UBUNTU_TAG} AS base
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# riscv64 builder stage
 FROM base AS builder
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
 apt-get install -y --no-install-recommends \
-  build-essential=12.9ubuntu3 \
-  ruby-dev="1:3.0~exp1" \
-  ruby="1:3.0~exp1"
+  build-essential \
+  ruby-dev \
+  ruby
 rm -rf /var/apt/lists/*
 gem install bundler --no-document
 EOF
@@ -24,6 +41,8 @@ bundle config set --without 'development test'
 bundle install --jobs=3 --retry=3
 EOF
 
+################################################################################
+# runtime stage: produces final image that will be executed
 FROM base
 
 ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
@@ -37,10 +56,9 @@ LABEL io.cartesi.rollups.ram_size=128Mi
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-  busybox-static=1:1.30.1-7ubuntu3 \
-  ruby="1:3.0~exp1"
+  busybox-static \
+  ruby
 rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/*
 useradd --create-home --user-group dapp
 EOF
diff --git a/rust/Dockerfile b/rust/Dockerfile
index d6c3288..354ac05 100644
--- a/rust/Dockerfile
+++ b/rust/Dockerfile
@@ -1,41 +1,74 @@
 # syntax=docker.io/docker/dockerfile:1
-FROM ubuntu:22.04 AS builder
+
+# This enforces that the packages downloaded from the repositories are the same
+# for the defined date, no matter when the image is built.
+ARG UBUNTU_TAG=noble-20241009
+ARG APT_UPDATE_SNAPSHOT=20241010T030400Z
+
+################################################################################
+# riscv64 base stage
+FROM --platform=linux/riscv64 ubuntu:${UBUNTU_TAG} AS base-riscv64
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# cross base stage
+FROM --platform=$BUILDPLATFORM ubuntu:${UBUNTU_TAG} AS base-cross
+
+ARG APT_UPDATE_SNAPSHOT
+ARG DEBIAN_FRONTEND=noninteractive
+RUN <<EOF
+set -eu
+apt update
+apt install -y --no-install-recommends ca-certificates curl
+apt update --snapshot=${APT_UPDATE_SNAPSHOT}
+EOF
+
+################################################################################
+# cross build stage
+FROM base-cross AS cross-build-stage
 
 ENV RUSTUP_HOME=/usr/local/rustup \
     CARGO_HOME=/usr/local/cargo \
     PATH=/usr/local/cargo/bin:$PATH \
-    RUST_VERSION=1.72.0
+    RUST_VERSION=1.81.0
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt update
 apt install -y --no-install-recommends \
-    build-essential=12.9ubuntu3 \
-    ca-certificates=20230311ubuntu0.22.04.1 \
-    g++-riscv64-linux-gnu=4:11.2.0--1ubuntu1 \
-    wget=1.21.2-2ubuntu1
+    build-essential \
+    g++-riscv64-linux-gnu
 EOF
 
-RUN set -eux; \
-    dpkgArch="$(dpkg --print-architecture)"; \
-    case "${dpkgArch##*-}" in \
-    amd64) rustArch='x86_64-unknown-linux-gnu'; rustupSha256='0b2f6c8f85a3d02fde2efc0ced4657869d73fccfce59defb4e8d29233116e6db' ;; \
-    armhf) rustArch='armv7-unknown-linux-gnueabihf'; rustupSha256='f21c44b01678c645d8fbba1e55e4180a01ac5af2d38bcbd14aa665e0d96ed69a' ;; \
-    arm64) rustArch='aarch64-unknown-linux-gnu'; rustupSha256='673e336c81c65e6b16dcdede33f4cc9ed0f08bde1dbe7a935f113605292dc800' ;; \
-    i386) rustArch='i686-unknown-linux-gnu'; rustupSha256='e7b0f47557c1afcd86939b118cbcf7fb95a5d1d917bdd355157b63ca00fc4333' ;; \
-    *) echo >&2 "unsupported architecture: ${dpkgArch}"; exit 1 ;; \
-    esac; \
-    url="https://static.rust-lang.org/rustup/archive/1.26.0/${rustArch}/rustup-init"; \
-    wget "$url"; \
-    echo "${rustupSha256} *rustup-init" | sha256sum -c -; \
-    chmod +x rustup-init; \
-    ./rustup-init -y --no-modify-path --profile minimal --default-toolchain $RUST_VERSION --default-host ${rustArch}; \
-    rm rustup-init; \
-    chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \
-    rustup --version; \
-    cargo --version; \
-    rustc --version;
+RUN <<EOF
+set -eux
+dpkgArch="$(dpkg --print-architecture)"
+case "${dpkgArch##*-}" in \
+    amd64) rustArch='x86_64-unknown-linux-gnu'; rustupSha256='6aeece6993e902708983b209d04c0d1dbb14ebb405ddb87def578d41f920f56d' ;;
+    armhf) rustArch='armv7-unknown-linux-gnueabihf'; rustupSha256='3c4114923305f1cd3b96ce3454e9e549ad4aa7c07c03aec73d1a785e98388bed' ;;
+    arm64) rustArch='aarch64-unknown-linux-gnu'; rustupSha256='1cffbf51e63e634c746f741de50649bbbcbd9dbe1de363c9ecef64e278dba2b2' ;;
+    i386) rustArch='i686-unknown-linux-gnu'; rustupSha256='0a6bed6e9f21192a51f83977716466895706059afb880500ff1d0e751ada5237' ;;
+    *) echo >&2 "unsupported architecture: ${dpkgArch}"; exit 1 ;;
+esac
+url="https://static.rust-lang.org/rustup/archive/1.27.1/${rustArch}/rustup-init"
+curl -fsSL -O "$url"
+echo "${rustupSha256} *rustup-init" | sha256sum -c -
+chmod +x rustup-init
+./rustup-init -y --no-modify-path --profile minimal --default-toolchain $RUST_VERSION --default-host ${rustArch}
+rm rustup-init
+chmod -R a+w $RUSTUP_HOME $CARGO_HOME
+rustup --version
+cargo --version
+rustc --version
+EOF
 
 RUN rustup target add riscv64gc-unknown-linux-gnu
 
@@ -43,7 +76,9 @@ WORKDIR /opt/cartesi/dapp
 COPY . .
 RUN cargo build --release
 
-FROM --platform=linux/riscv64 ubuntu:22.04
+################################################################################
+# runtime stage: produces final image that will be executed
+FROM base-riscv64
 
 ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
 ADD https://github.com/cartesi/machine-emulator-tools/releases/download/v${MACHINE_EMULATOR_TOOLS_VERSION}/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb /
@@ -56,9 +91,8 @@ LABEL io.cartesi.rollups.ram_size=128Mi
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 set -e
-apt-get update
 apt-get install -y --no-install-recommends \
-    busybox-static=1:1.30.1-7ubuntu3
+    busybox-static
 rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/*
 useradd --create-home --user-group dapp
 EOF
@@ -66,7 +100,7 @@ EOF
 ENV PATH="/opt/cartesi/bin:/opt/cartesi/dapp:${PATH}"
 
 WORKDIR /opt/cartesi/dapp
-COPY --from=builder /opt/cartesi/dapp/target/riscv64gc-unknown-linux-gnu/release/dapp .
+COPY --from=cross-build-stage /opt/cartesi/dapp/target/riscv64gc-unknown-linux-gnu/release/dapp .
 
 ENV ROLLUP_HTTP_SERVER_URL="http://127.0.0.1:5004"