diff --git a/Pkgfile b/Pkgfile
index 123c4e7f..5d0bcea7 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -3,7 +3,7 @@
 format: v1alpha2
 
 vars:
-  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.8.0-alpha.0-3-g7e5a248
+  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.8.0-alpha.0-4-g06ba64e
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
   cni_version: v1.4.1
@@ -11,10 +11,10 @@ vars:
   cni_sha512: 349e0b2fa55856774f7f04d0f6f87ea393e6efd37fd0b6a1e9305ab973a0b3dec77bac25770667d4f81d55459650439600ea353ba6069d7d9e8078a9dac2fc6e
 
   # renovate: datasource=github-tags depName=containerd/containerd
-  containerd_version: v1.7.16
-  containerd_ref: 83031836b2cf55637d7abf847b17134c51b38e53
-  containerd_sha256: 72250bf9a9470585bd4e31c91b83cd831eec2931c93104fb35bdc7c568283814
-  containerd_sha512: 2d6aa4b11d75c1e94de90737cfb16cd34b5c802f5de6f10786856f5c57b69f70ebf6402ac935293cb977da76b142bca4bf5630658c2ee375947db72f14847a35
+  containerd_version: v2.0.0-rc.2
+  containerd_ref: 28b77e33ade2112f7585e0caf36c553d65e4c860
+  containerd_sha256: 70fb8d079935828c6b3bb3ff4d715820f7006b6d82cb31b4250b5574d946d261
+  containerd_sha512: ecfd908104e6e99339ec6f8edb70ed5f52eeff2f54fada3051e8266cac9a78493c13581fe5d1114a13cafa338de2d16e129c43a9d1cd317dd961f84177c0dd34
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git
   cryptsetup_version: 2.7.2
@@ -143,10 +143,10 @@ vars:
   openssl_sha512: 1f9daeee6542e1b831c65f1f87befaef98ccedc3abc958c9d17f064ef771924c30849e3ff880f94eed4aaa9d81ea105e3bc8815e6d2e4d6b60b5e890f14fc5da
 
   # renovate: datasource=github-tags depName=opencontainers/runc
-  runc_version: v1.1.12
-  runc_ref: 51d5e94601ceffbbd85688df1c928ecccbfa4685
-  runc_sha256: 47d9e34500e478d860512b3b646724ee4b9e638692122ddaa82af417668ca4d7
-  runc_sha512: 61afae94dc78253c2f6b305b48ddf76c71813f5735e69fde7f3ae6f51539f10131a37a0917cbcb23b303490c62ac78dafd79eb2a6f2849ec17638f3bd5833136
+  runc_version: v1.2.0-rc.1
+  runc_ref: 275e6d85f78a9d0a90d9a714ba5f667561a4b0b9
+  runc_sha256: 3f6fed97bf5db1d4eac43b622a62379e07f3f73dd1c3e5ee5c0f82a1c960e1f7
+  runc_sha512: c6bf8bb1d29f93f34aa44949f544d96399be3666e7effaf3d46007647c6ac94a0a2d26ccad3ce215908c44cb84d1bcc94b0a6536f8dfcd8454d6bfd7715e4703
 
   # renovate: datasource=git-tags extractVersion=^tag-(?<version>.*)$ depName=git://repo.or.cz/socat.git
   socat_version: 1.8.0.0
diff --git a/containerd/pkg.yaml b/containerd/pkg.yaml
index 9ed6d7f2..8444098f 100644
--- a/containerd/pkg.yaml
+++ b/containerd/pkg.yaml
@@ -11,22 +11,23 @@ steps:
         destination: containerd.tar.gz
         sha256: "{{ .containerd_sha256 }}"
         sha512: "{{ .containerd_sha512 }}"
+    env:
+      PKG_CONFIG_PATH: /usr/lib/pkgconfig
+      CC: /toolchain/bin/gcc
+      PATH: /toolchain/go/bin:/toolchain/bin:{{ .PATH }}
+      BUILDTAGS: 'seccomp no_aufs no_btrfs no_devmapper no_systemd no_zfs'
     prepare:
       - |
         tar -xzf containerd.tar.gz --strip-components=1
     build:
       - |
-        export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-        export CC=/toolchain/bin/cc
-        # This is required due to "loadinternal: cannot find runtime/cgo".
-        export CGO_ENABLED=1
-        export PATH=${PATH}:${TOOLCHAIN}/go/bin
-        export BUILDTAGS='seccomp no_aufs no_btrfs no_devmapper no_zfs'
-        make bin/containerd bin/containerd-shim bin/containerd-shim-runc-v2 VERSION={{ .containerd_version }} REVISION={{ .containerd_ref}}
+        make VERSION={{ .containerd_version }} REVISION={{ .containerd_ref }}
     install:
       - |
         mkdir -p /rootfs/bin
-        cp bin/{containerd,containerd-shim,containerd-shim-runc-v2} /rootfs/bin
+        make install PREFIX=/ DESTDIR=/rootfs
+
+        rm /rootfs/bin/{containerd-stress,ctr}
 finalize:
   - from: /rootfs
     to: /
diff --git a/libseccomp/pkg.yaml b/libseccomp/pkg.yaml
index 7de9cb8a..d5465ec4 100644
--- a/libseccomp/pkg.yaml
+++ b/libseccomp/pkg.yaml
@@ -17,8 +17,7 @@ steps:
         cd build
 
         ../configure \
-            --prefix=/usr \
-            --disable-static
+            --prefix=/usr
     build:
       - |
         cd build
diff --git a/runc/pkg.yaml b/runc/pkg.yaml
index d0d2bc70..9914c114 100644
--- a/runc/pkg.yaml
+++ b/runc/pkg.yaml
@@ -11,23 +11,25 @@ steps:
         destination: runc.tar.xz
         sha256: "{{ .runc_sha256 }}"
         sha512: "{{ .runc_sha512 }}"
+    env:
+      GOPATH: /go
+      GO: /toolchain/go/bin/go
+      PKG_CONFIG_PATH: /usr/lib/pkgconfig
+      CC: /toolchain/bin/cc
+      VERSION: {{ .runc_version }}
+      PATH: /toolchain/go/bin:/toolchain/bin:/bin
     prepare:
       - |
-        export GOPATH=/go
         mkdir -p runc
 
         tar -xJf runc.tar.xz --strip-components=1 -C runc
     build:
       - |
-        export GOPATH=/go
         cd runc
 
-        export PATH=${PATH}:/${TOOLCHAIN}/go/bin
-        export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-        export CC=/toolchain/bin/cc
-        # This is required due to "loadinternal: cannot find runtime/cgo".
-        export CGO_ENABLED=1
-        make EXTRA_LDFLAGS="-w -s -buildid=''" BUILDTAGS="seccomp" COMMIT={{ .runc_ref }} runc
+        ldflags="-w -s -buildid="
+
+        make COMMIT_NO= COMMIT={{ .runc_ref }} EXTRA_FLAGS="-a" EXTRA_LDFLAGS="${ldflags}" static
     install:
       - |
         cd runc