diff --git a/engine/schema/pom.xml b/engine/schema/pom.xml
index 6e078d7ec9f8..a92845184e95 100644
--- a/engine/schema/pom.xml
+++ b/engine/schema/pom.xml
@@ -88,8 +88,15 @@
                                 <script><![CDATA[
                                     def projectVersion = project.properties.getProperty('project.systemvm.template.version')
                                     String[] versionParts = projectVersion.tokenize('.')
-                                    project.properties.setProperty('cs.version', versionParts[0] + "." + versionParts[1])
-                                    project.properties.setProperty('patch.version', versionParts[2])
+                                    if (versionParts[0].toInteger() >= 24) {
+                                        // new versioning: directory 24, templates systemvmtemplate-24.0-...
+                                        project.properties.setProperty('cs.version', versionParts[0])
+                                        project.properties.setProperty('patch.version', versionParts[1])
+                                    } else {
+                                        // legacy versioning: directory 4.22, templates systemvmtemplate-4.22.0-...
+                                        project.properties.setProperty('cs.version', versionParts[0] + "." + versionParts[1])
+                                        project.properties.setProperty('patch.version', versionParts[2])
+                                    }
                                 ]]></script>
                             </scripts>
                         </configuration>
diff --git a/engine/schema/templateConfig.sh b/engine/schema/templateConfig.sh
index 7a8283e77c1c..71b395689c15 100755
--- a/engine/schema/templateConfig.sh
+++ b/engine/schema/templateConfig.sh
@@ -28,9 +28,7 @@ function getTemplateVersion() {
   subversion2="$(cut -d'.' -f2 <<<"$version")"
   minorversion="$(cut -d'.' -f3 <<<"$version")"
   fourthversion="$(cut -d'.' -f4 <<<"$version")"
-  export CS_VERSION="${subversion1}"."${subversion2}"
   export CS_MINOR_VERSION="${minorversion}"
-  export VERSION="${CS_VERSION}.${CS_MINOR_VERSION}"
   if [[ "$subversion1" -ge "$NEW_VERSIONING_CUTOVER_MAJOR_VERSION" ]]; then
     # New versioning (major.minor.security): the third component is the
     # security release itself, there is no separate patch component. A
@@ -40,11 +38,17 @@ function getTemplateVersion() {
       echo "Invalid version '${projVersion}': major versions at or above ${NEW_VERSIONING_CUTOVER_MAJOR_VERSION} do not support a 4-component major.minor.patch.security format" >&2
       exit 1
     fi
-    export FULL_VERSION="${VERSION}"
+    # The templates are in the directory named after the major version (24),
+    # and the file names contain major.minor (24.0), like 4.22 and 4.22.0 before
+    export CS_VERSION="${subversion1}"
+    export VERSION="${subversion1}.${subversion2}"
+    export FULL_VERSION="${subversion1}.${subversion2}.${minorversion}"
   else
     # Legacy versioning: major.minor.patch, or major.minor.patch.security when a 4th
     # component is present. Without a 4th component, VERSION is already correct as-is;
     # appending an empty security component would leave a dangling trailing dot.
+    export CS_VERSION="${subversion1}"."${subversion2}"
+    export VERSION="${CS_VERSION}.${CS_MINOR_VERSION}"
     if [[ -n "$fourthversion" ]]; then
       export FULL_VERSION="${VERSION}.${fourthversion}"
     else
diff --git a/engine/schema/test_templateConfig.sh b/engine/schema/test_templateConfig.sh
index 2acb4281edb7..95cab07fb280 100755
--- a/engine/schema/test_templateConfig.sh
+++ b/engine/schema/test_templateConfig.sh
@@ -51,6 +51,7 @@ assert_eq "legacy: VERSION" "4.22.0" "$VERSION"
 assert_eq "legacy: FULL_VERSION keeps the 4th (security) component" "4.22.0.0" "$FULL_VERSION"
 
 getTemplateVersion "4.23.0.1-SNAPSHOT"
+assert_eq "legacy with -SNAPSHOT suffix: CS_VERSION" "4.23" "$CS_VERSION"
 assert_eq "legacy with -SNAPSHOT suffix: VERSION" "4.23.0" "$VERSION"
 assert_eq "legacy with -SNAPSHOT suffix: FULL_VERSION" "4.23.0.1" "$FULL_VERSION"
 
@@ -62,16 +63,18 @@ assert_eq "legacy 3-component (no security): FULL_VERSION has no trailing dot" "
 # --- getTemplateVersion: new versioning (major >= 24, post-cutover) ---
 
 getTemplateVersion "24.0.0"
-assert_eq "cutover: CS_VERSION" "24.0" "$CS_VERSION"
-assert_eq "cutover: VERSION" "24.0.0" "$VERSION"
+assert_eq "cutover: CS_VERSION (directory) is the major version" "24" "$CS_VERSION"
+assert_eq "cutover: VERSION (file names) is major.minor" "24.0" "$VERSION"
 assert_eq "cutover: FULL_VERSION has no trailing dot (patch dropped)" "24.0.0" "$FULL_VERSION"
 
 getTemplateVersion "24.1.2-SNAPSHOT"
-assert_eq "cutover with -SNAPSHOT suffix: VERSION" "24.1.2" "$VERSION"
+assert_eq "cutover with -SNAPSHOT suffix: CS_VERSION" "24" "$CS_VERSION"
+assert_eq "cutover with -SNAPSHOT suffix: VERSION" "24.1" "$VERSION"
 assert_eq "cutover with -SNAPSHOT suffix: FULL_VERSION" "24.1.2" "$FULL_VERSION"
 
 getTemplateVersion "99.9.9"
-assert_eq "future major: VERSION" "99.9.9" "$VERSION"
+assert_eq "future major: CS_VERSION" "99" "$CS_VERSION"
+assert_eq "future major: VERSION" "99.9" "$VERSION"
 assert_eq "future major: FULL_VERSION" "99.9.9" "$FULL_VERSION"
 
 # A 4-component major.minor.patch.security value is invalid at/after the cutover (matches
@@ -96,7 +99,7 @@ run_create_metadata_file() {
   : > "$METADATAFILE"
 
   createMetadataFile
-  grep '^version = ' "$METADATAFILE" | head -1 | cut -d' ' -f3
+  grep "^${2:-version} = " "$METADATAFILE" | head -1 | cut -d' ' -f3
 
   rm -rf "$workdir"
 }
@@ -107,6 +110,26 @@ assert_eq "metadata.ini legacy 'version' line" "4.22.0.0" "$actual"
 actual="$(run_create_metadata_file "24.0.0")"
 assert_eq "metadata.ini cutover 'version' line has no trailing dot" "24.0.0" "$actual"
 
+# --- createMetadataFile: file names, directory, template name and checksum ---
+
+actual="$(run_create_metadata_file "4.22.0.0" downloadurl)"
+assert_eq "metadata.ini legacy downloadurl" "https://download.cloudstack.org/systemvm//4.22/systemvmtemplate-4.22.0-x86_64-kvm.qcow2.bz2" "$actual"
+actual="$(run_create_metadata_file "4.22.0.0" templatename)"
+assert_eq "metadata.ini legacy templatename" "systemvm-kvm-4.22.0-x86_64" "$actual"
+actual="$(run_create_metadata_file "4.22.0.0" checksum)"
+assert_eq "metadata.ini legacy checksum is found" "abc123" "$actual"
+
+actual="$(run_create_metadata_file "24.0.0" downloadurl)"
+assert_eq "metadata.ini cutover downloadurl" "https://download.cloudstack.org/systemvm//24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual"
+actual="$(run_create_metadata_file "24.0.0" filename)"
+assert_eq "metadata.ini cutover filename" "systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual"
+actual="$(run_create_metadata_file "24.0.0" templatename)"
+assert_eq "metadata.ini cutover templatename" "systemvm-kvm-24.0-x86_64" "$actual"
+actual="$(run_create_metadata_file "24.0.0" checksum)"
+assert_eq "metadata.ini cutover checksum is found" "abc123" "$actual"
+actual="$(run_create_metadata_file "24.0.1" downloadurl)"
+assert_eq "metadata.ini cutover security release uses the same template" "https://download.cloudstack.org/systemvm//24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual"
+
 echo ""
 echo "${pass} passed, ${fail} failed"
 [[ $fail -eq 0 ]]
diff --git a/pom.xml b/pom.xml
index 80111b26a4ab..8a1c7a27652d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -50,7 +50,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <project.systemvm.template.location>https://download.cloudstack.org/systemvm</project.systemvm.template.location>
-        <project.systemvm.template.version>4.22.0.0</project.systemvm.template.version>
+        <project.systemvm.template.version>24.0.0</project.systemvm.template.version>
         <sonar.organization>apache</sonar.organization>
         <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <sonar.exclusions>engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingDetailsVO.java</sonar.exclusions>
diff --git a/scripts/installer/export-templates.sh b/scripts/installer/export-templates.sh
index 820596837131..5d38ac54472a 100755
--- a/scripts/installer/export-templates.sh
+++ b/scripts/installer/export-templates.sh
@@ -26,8 +26,8 @@ TEMPLATE_VERSION=$(awk -F "=" '/version/ {print $2}' ${IMAGE_PATH}${METADATA_FIL
 TEMPLATE_PATH="/usr/share/cloudstack-management/templates/systemvm/"
 TEMPLATE_MAJOR_VERSION="$(cut -d'.' -f1 <<<"$TEMPLATE_VERSION")"
 if [[ "$TEMPLATE_MAJOR_VERSION" -ge "$NEW_VERSIONING_CUTOVER_MAJOR_VERSION" ]]; then
-  # New versioning (major.minor.security): the generated template files use the full version as-is.
-  VERSION="${TEMPLATE_VERSION}"
+  # New versioning (major.minor.security): the template files contain major.minor, without the security component.
+  VERSION="$(cut -d'.' -f1,2 <<<"$TEMPLATE_VERSION")"
 else
   # Legacy versioning drops the trailing security component only for four-component metadata;
   # a valid three-component major.minor.patch value is already the filename version.
diff --git a/tools/appliance/build.sh b/tools/appliance/build.sh
index fa5d0e853cc6..a38b740daea5 100755
--- a/tools/appliance/build.sh
+++ b/tools/appliance/build.sh
@@ -31,6 +31,9 @@ Usage:
      (or use command line arg, default to current architecture. Currently x86_64 and aarch64 are implemented)
    * Set \$BUILD_NUMBER to provide build number to apply to built appliance
      (or use command line arg, default empty)
+   * Set \$ALLOW_MISSING_EXPORT_TOOLS=1 to only warn (and skip the export) when
+     vhd-util, faketime or ovftool are missing
+   * Set \$SKIP_DEPENDENCY_CHECK=1 to skip the check of build dependencies
    * Set \$DEBUG=1 to enable debug logging
    * Set \$TRACE=1 to enable trace logging
 END
@@ -99,6 +102,12 @@ version="${2:-${version:-}}"
 # which architecture to build the template for
 target_arch="${3:-${target_arch:-${base_arch}}}"
 
+# only warn instead of failing if the tools for XenServer/VMware exports are missing
+ALLOW_MISSING_EXPORT_TOOLS="${ALLOW_MISSING_EXPORT_TOOLS:-}"
+
+# skip the check of the build dependencies
+SKIP_DEPENDENCY_CHECK="${SKIP_DEPENDENCY_CHECK:-}"
+
 # optional (jenkins) build number tag to put into the image filename
 BUILD_NUMBER="${4:-${BUILD_NUMBER:-}}"
 
@@ -201,6 +210,122 @@ function retry() {
 ### Script logic
 ###
 
+# Check the tools needed by the build before anything is touched, and report all
+# the missing ones at once. Package names are for Debian/Ubuntu.
+function check_dependencies() {
+  if [ -n "${SKIP_DEPENDENCY_CHECK}" ]; then
+    log WARN "skipping the check of build dependencies"
+    return
+  fi
+
+  log INFO "checking build dependencies"
+  local missing=()
+  local warnings=()
+
+  # check_cmd <command> <package or hint> [warn]: record a missing command
+  function check_cmd() {
+    if ! command -v "$1" > /dev/null 2>&1; then
+      if [ "${3:-}" == "warn" ]; then
+        warnings+=("$1 not found ($2)")
+      else
+        missing+=("$1 not found ($2)")
+      fi
+    fi
+  }
+
+  # tools needed for every build
+  check_cmd packer "https://developer.hashicorp.com/packer/install"
+  check_cmd qemu-img "apt install qemu-utils"
+  check_cmd shar "apt install sharutils"
+  check_cmd uuencode "apt install sharutils"
+  check_cmd bzip2 "apt install bzip2"
+  check_cmd tar "apt install tar"
+  check_cmd md5sum "apt install coreutils"
+  check_cmd sha512sum "apt install coreutils"
+
+  # the emulator packer uses for the target architecture
+  local qemu_binary="qemu-system-${target_arch}"
+  if [ "${target_arch}" == "x86_64" ]; then
+    check_cmd qemu-system-x86_64 "apt install qemu-system-x86"
+  else
+    check_cmd "${qemu_binary}" "apt install qemu-system-arm"
+  fi
+
+  # packer needs the qemu plugin (not installed with packer itself)
+  if command -v packer > /dev/null 2>&1; then
+    if ! packer plugins installed 2> /dev/null | grep -q "packer-plugin-qemu"; then
+      missing+=("packer qemu plugin not installed (packer plugins install github.com/hashicorp/qemu)")
+    fi
+  fi
+
+  # KVM acceleration, if the packer template asks for it
+  local template_json="${appliance}/template-base_${base_arch}-target_${target_arch}.json"
+  if [ -f "${template_json}" ] && grep -q '"accelerator": *"kvm"' "${template_json}"; then
+    if [ ! -r /dev/kvm ] || [ ! -w /dev/kvm ]; then
+      missing+=("/dev/kvm is not accessible for the current user (add the user to the kvm group)")
+    fi
+  fi
+
+  # UEFI firmware for building aarch64 on another architecture
+  if [ "${target_arch}" == "aarch64" ] && [ "${base_arch}" != "aarch64" ]; then
+    if [ ! -f /usr/share/qemu-efi-aarch64/QEMU_EFI.fd ]; then
+      missing+=("/usr/share/qemu-efi-aarch64/QEMU_EFI.fd not found (apt install qemu-efi-aarch64)")
+    fi
+  fi
+
+  # exports, which are only done for x86_64
+  if [ "${target_arch}" == "x86_64" ]; then
+    local export_level=
+    if [ -n "${ALLOW_MISSING_EXPORT_TOOLS}" ]; then
+      export_level=warn
+    fi
+    check_cmd zip "apt install zip"
+
+    # XenServer
+    check_cmd faketime "apt install faketime" ${export_level}
+    check_cmd vhd-util "see the comments in build.sh, or http://packages.shapeblue.com/systemvmtemplate/vhd-util" ${export_level}
+    if command -v vhd-util > /dev/null 2>&1; then
+      # vhd-util is a 32-bit binary: it needs the i386 libraries, and faketime
+      # needs to be preloadable into it (faketime:i386)
+      local vhd_util_out
+      vhd_util_out=$(ldd "$(command -v vhd-util)" 2>&1 || true)
+      if echo "${vhd_util_out}" | grep -qE "not found|not a dynamic|No such file"; then
+        local msg="vhd-util cannot be run, missing libraries (apt install libuuid1:i386 libc6:i386, libvhd.so.1.0 in ldconfig path)"
+        if [ -n "${export_level}" ]; then warnings+=("${msg}"); else missing+=("${msg}"); fi
+      elif command -v faketime > /dev/null 2>&1; then
+        vhd_util_out=$(faketime '2010-01-01' vhd-util 2>&1 || true)
+        if echo "${vhd_util_out}" | grep -q "cannot be preloaded"; then
+          local msg="faketime cannot be used with 32-bit vhd-util (apt install faketime:i386, dpkg --add-architecture i386)"
+          if [ -n "${export_level}" ]; then warnings+=("${msg}"); else missing+=("${msg}"); fi
+        fi
+      fi
+    fi
+
+    # VMware
+    check_cmd ovftool "VMware OVF Tool, https://developer.broadcom.com/tools/open-virtualization-format-ovf-tool/latest" ${export_level}
+  fi
+
+  # the build needs the ISO, a 5G disk, and the raw images of the exports
+  local free_gb
+  free_gb=$(df -P -BG . | awk 'NR==2 {gsub("G","",$4); print $4}')
+  if [ -n "${free_gb}" ] && [ "${free_gb}" -lt 20 ] 2> /dev/null; then
+    warnings+=("only ${free_gb}G free in $(pwd), the build needs about 20G")
+  fi
+
+  local item
+  for item in "${warnings[@]}"; do
+    log WARN "${item}"
+  done
+  if [ ${#missing[@]} -gt 0 ]; then
+    for item in "${missing[@]}"; do
+      log ERROR "${item}"
+    done
+    error "${#missing[@]} build dependencies are missing or broken, see above (set SKIP_DEPENDENCY_CHECK=1 to ignore)"
+  fi
+  unset -f check_cmd
+  log INFO "all build dependencies are available"
+}
+
 function create_definition() {
   if [ "${appliance}" != "${appliance_build_name}" ]; then
     cp -r "${appliance}" "${appliance_build_name}"
@@ -350,6 +475,7 @@ function hyperv_export() {
 ###
 
 function main() {
+  check_dependencies
   prepare
 
   create_definition
diff --git a/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg b/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg
index 5262603deaa4..92e426d3d0d2 100644
--- a/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg
+++ b/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg
@@ -107,7 +107,7 @@ d-i passwd/user-default-groups string audio cdrom video admin
 
 ### Package selection
 tasksel tasksel/first multiselect ssh-server
-d-i pkgsel/include string openssh-server ntp acpid sudo bzip2 openssl
+d-i pkgsel/include string openssh-server chrony acpid sudo bzip2 openssl
 # Allowed values: none, safe-upgrade, full-upgrade
 d-i pkgsel/upgrade select full-upgrade
 d-i pkgsel/update-policy select none
diff --git a/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg b/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg
index 1ed0edd492f9..fdcfe83c1010 100644
--- a/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg
+++ b/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg
@@ -98,7 +98,7 @@ d-i passwd/user-default-groups string audio cdrom video admin
 
 ### Package selection
 tasksel tasksel/first multiselect ssh-server
-d-i pkgsel/include string openssh-server ntp acpid sudo bzip2 openssl
+d-i pkgsel/include string openssh-server chrony acpid sudo bzip2 openssl
 # Allowed values: none, safe-upgrade, full-upgrade
 d-i pkgsel/upgrade select full-upgrade
 d-i pkgsel/update-policy select none
diff --git a/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh b/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh
index 91a1dd3cdabc..38336dd0ac1d 100755
--- a/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh
+++ b/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh
@@ -32,12 +32,18 @@ function fix_tune2fs() {
 }
 
 function add_backports() {
-  sed -i '/cdrom/d' /etc/apt/sources.list
-  sed -i '/deb-src/d' /etc/apt/sources.list
-  sed -i '/backports/d' /etc/apt/sources.list
-  sed -i '/security/d' /etc/apt/sources.list
-  echo 'deb http://http.debian.net/debian bookworm-backports main' >> /etc/apt/sources.list
-  echo 'deb http://security.debian.org/debian-security bookworm-security main' >> /etc/apt/sources.list
+  # Debian 13 installs apt sources in /etc/apt/sources.list.d/debian.sources
+  # and /etc/apt/sources.list may not exist
+  if [ -f /etc/apt/sources.list ]; then
+    sed -i '/cdrom/d' /etc/apt/sources.list
+    sed -i '/deb-src/d' /etc/apt/sources.list
+    sed -i '/backports/d' /etc/apt/sources.list
+    sed -i '/security/d' /etc/apt/sources.list
+  fi
+  cat > /etc/apt/sources.list.d/backports-security.list << EOF
+deb http://http.debian.net/debian trixie-backports main
+deb http://security.debian.org/debian-security trixie-security main
+EOF
 }
 
 function apt_upgrade() {
diff --git a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh
index 8bc71d29c1c0..455e59915f87 100755
--- a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh
+++ b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh
@@ -19,7 +19,7 @@
 set -e
 set -x
 
-CLOUDSTACK_RELEASE=4.22.0
+CLOUDSTACK_RELEASE=24.0
 
 function configure_apache2() {
    # Enable ssl, rewrite and auth
@@ -41,7 +41,7 @@ function configure_issue() {
 
    __?.o/  Apache CloudStack SystemVM $CLOUDSTACK_RELEASE
   (  )#    https://cloudstack.apache.org
- (___(_)   Debian GNU/Linux 12 \n \l
+ (___(_)   Debian GNU/Linux 13 \n \l
 
 EOF
 }
@@ -142,8 +142,12 @@ datasource:
 EOF
 
   touch /etc/cloud/cloud-init.disabled
-  systemctl stop cloud-init
-  systemctl disable cloud-init
+  # cloud-init.service was split into several units in newer cloud-init versions
+  for svc in cloud-init cloud-init-local cloud-init-main cloud-init-network cloud-config cloud-final; do
+    if systemctl cat ${svc}.service > /dev/null 2>&1; then
+      systemctl disable ${svc}.service
+    fi
+  done
 
   configure_apache2
   configure_strongswan
diff --git a/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh b/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh
index d391b5c4e192..00ab7e194a33 100755
--- a/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh
+++ b/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh
@@ -66,7 +66,7 @@ function install_packages() {
     xenstore-utils libxenstore4 \
     ipvsadm conntrackd libnetfilter-conntrack3 \
     keepalived irqbalance \
-    openjdk-17-jre-headless \
+    openjdk-21-jre-headless \
     ipcalc ipset \
     iptables-persistent \
     libtcnative-1 libssl-dev libapr1-dev \
@@ -77,7 +77,7 @@ function install_packages() {
     sharutils genisoimage \
     strongswan libcharon-extra-plugins libstrongswan-extra-plugins strongswan-charon strongswan-starter \
     virt-what open-vm-tools qemu-guest-agent hyperv-daemons cloud-guest-utils \
-    conntrack apt-transport-https ca-certificates curl gnupg  gnupg-agent software-properties-common
+    conntrack apt-transport-https ca-certificates curl gnupg  gnupg-agent
 
   apt-get install -y python3-json-pointer python3-jsonschema cloud-init
 
@@ -91,17 +91,14 @@ function install_packages() {
   fi
 
   # Install docker and containerd for CKS
-  curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
-  apt-key fingerprint 0EBFCD88
-  if [ "${arch}" == "arm64" ]; then
-    add-apt-repository "deb [arch=arm64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
-  elif [ "${arch}" == "amd64" ]; then
-    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
-  elif [ "${arch}" == "s390x" ]; then
-    add-apt-repository "deb [arch=s390x] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
-  else
-    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
+  local docker_arch="${arch}"
+  if [[ "${arch}" != "arm64" && "${arch}" != "amd64" && "${arch}" != "s390x" ]]; then
+    docker_arch="amd64"
   fi
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+  chmod a+r /etc/apt/keyrings/docker.asc
+  echo "deb [arch=${docker_arch} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "${VERSION_CODENAME}") stable" > /etc/apt/sources.list.d/docker.list
   apt-get update
   ${apt_get} install containerd.io
 
diff --git a/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json b/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json
index f15552ca5cc4..fe1e363423e2 100644
--- a/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json
+++ b/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json
@@ -32,8 +32,8 @@
       "format": "qcow2",
       "headless": true,
       "http_directory": "http",
-      "iso_checksum": "sha512:55ab206cd8b0da2898767c3eb6ab5ebef101e3925ec91b3b5f0a286136195b7072588f6ac2d059c545c6938978704ae78cd18d7d9d2a86a7380e46ce27ee4e7b",
-      "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/arm64/iso-cd/debian-12.12.0-arm64-netinst.iso",
+      "iso_checksum": "sha512:cff08e2f29c2846f0503fe57ad1085b5067f29acab444acdf7cdf5b10f2a11140a0e87828e4ffeb9828d188053690467ebe50151c142551d6053fc3288808b86",
+      "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/arm64/iso-cd/debian-13.7.0-arm64-netinst.iso",
       "net_device": "virtio-net",
       "output_directory": "../dist",
       "qemu_binary": "qemu-system-aarch64",
diff --git a/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json b/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json
index c16bf1fb2a29..5c15d35888c3 100644
--- a/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json
+++ b/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json
@@ -31,8 +31,8 @@
       "format": "qcow2",
       "headless": true,
       "http_directory": "http",
-      "iso_checksum": "sha512:55ab206cd8b0da2898767c3eb6ab5ebef101e3925ec91b3b5f0a286136195b7072588f6ac2d059c545c6938978704ae78cd18d7d9d2a86a7380e46ce27ee4e7b",
-      "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/arm64/iso-cd/debian-12.12.0-arm64-netinst.iso",
+      "iso_checksum": "sha512:cff08e2f29c2846f0503fe57ad1085b5067f29acab444acdf7cdf5b10f2a11140a0e87828e4ffeb9828d188053690467ebe50151c142551d6053fc3288808b86",
+      "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/arm64/iso-cd/debian-13.7.0-arm64-netinst.iso",
       "net_device": "virtio-net",
       "output_directory": "../dist",
       "qemu_binary": "qemu-system-aarch64",
diff --git a/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json b/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json
index 941eea9dcd7b..967645b500d5 100644
--- a/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json
+++ b/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json
@@ -27,8 +27,8 @@
       "format": "qcow2",
       "headless": true,
       "http_directory": "http",
-      "iso_checksum": "sha512:c93055182057dd19a334260671c7e10880541b7721ad9c8df87be47e0a11d5bbf85018350ff224ff6a5f6a68320b07e95d539cef9dc020c93966bfaa86d4b2ce",
-      "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/amd64/iso-cd/debian-12.12.0-amd64-netinst.iso",
+      "iso_checksum": "sha512:ef04d0276850d70e4aaec0b55003628660e9631b26e35215a70ab3c8c707294a4b12731bc73c75a932902f703a7c278310ca99df28d6b36fb06d5618d8d0f678",
+      "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/amd64/iso-cd/debian-13.7.0-amd64-netinst.iso",
       "net_device": "virtio-net",
       "output_directory": "../dist",
       "qemuargs": [