diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 1254bea..907934e 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: gitea.okami101.io/okami101/toolchain
+          images: gitea.okami101.io/okami101/toolchain-siderolabs
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
       - uses: docker/login-action@v3
@@ -25,16 +25,17 @@ jobs:
           registry: ${{ vars.CONTAINER_REGISTRY }}
           username: ${{ vars.CONTAINER_REGISTRY_USERNAME }}
           password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
+      # - uses: docker/build-push-action@v6
+      #   with:
+      #     context: .
+      #     push: true
+      #     target: toolchain-musl
+      #     tags: ${{ steps.meta-musl.outputs.tags }}
+      #     labels: ${{ steps.meta-musl.outputs.labels }}
       - uses: docker/build-push-action@v6
         with:
           context: .
-          push: true
-          target: toolchain-musl
-          tags: ${{ steps.meta-musl.outputs.tags }}
-          labels: ${{ steps.meta-musl.outputs.labels }}
-      - uses: docker/build-push-action@v6
-        with:
-          context: .
+          dockerfile: Dockerfile.siderolabs
           push: true
           target: toolchain
           tags: ${{ steps.meta.outputs.tags }}
diff --git a/Dockerfile.siderolabs b/Dockerfile.siderolabs
new file mode 100644
index 0000000..f901de6
--- /dev/null
+++ b/Dockerfile.siderolabs
@@ -0,0 +1,131 @@
+FROM gitea.okami101.io/siderolabs/stagex/core-binutils:latest AS core-binutils
+FROM gitea.okami101.io/siderolabs/stagex/core-gcc:latest AS core-gcc
+FROM gitea.okami101.io/siderolabs/stagex/core-make:latest AS core-make
+FROM gitea.okami101.io/siderolabs/stagex/core-musl:latest AS core-musl
+FROM gitea.okami101.io/siderolabs/stagex/core-busybox:latest AS core-busybox
+FROM gitea.okami101.io/siderolabs/stagex/core-diffutils:latest AS core-diffutils
+FROM gitea.okami101.io/siderolabs/stagex/core-go:latest AS core-go
+
+FROM scratch AS bootstrap-c-toolchain
+COPY --from=core-make / /
+COPY --from=core-musl / /
+COPY --from=core-busybox / /
+
+FROM bootstrap-c-toolchain AS build-make
+ARG VERSION=4.4.1
+
+WORKDIR /source
+
+RUN wget https://ftp.gnu.org/gnu/make/make-${VERSION}.tar.gz -O make.tar.gz
+
+RUN tar -xzf make.tar.gz --strip-components=1 && \
+    mkdir build && \
+    cd build && \
+    ../configure --prefix=/usr --without-guile
+
+RUN cd build && \
+    make -j$(nproc)
+
+RUN cd build && \
+    make DESTDIR=/rootfs install
+
+FROM bootstrap-c-toolchain AS build-linux-headers
+ARG VERSION=6.12.21
+
+WORKDIR /source
+
+RUN wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${VERSION}.tar.xz -O linux.tar.xz
+
+RUN tar -xJf linux.tar.xz --strip-components=1
+
+RUN make -j $(nproc) headers ARCH=x86_64 && \
+    find usr/include -name '.*' -delete && \
+    rm usr/include/Makefile
+
+RUN mkdir -p /rootfs/usr/include && \
+    cp -rv usr/include/* /rootfs/usr/include
+
+FROM bootstrap-c-toolchain AS build-musl
+COPY --from=core-diffutils / /
+
+ENV CFLAGS=""
+ENV CXXFLAGS=""
+ENV LDFLAGS=""
+
+ARG VERSION=1.2.5
+
+WORKDIR /source
+
+RUN wget https://www.musl-libc.org/releases/musl-${VERSION}.tar.gz -O musl.tar.gz
+
+RUN tar -xzf musl.tar.gz --strip-components=1 && \
+    mkdir build && \
+    cd build && \
+    ../configure --prefix=/usr
+
+RUN cd build && \
+    make -j $(nproc)
+
+RUN cd build && \
+    make DESTDIR=/rootfs install && \
+    ARCH=$(uname -m) && \
+    mkdir -p /rootfs/usr/bin /rootfs/usr/lib && \
+    rm -rf /rootfs/lib && \
+    ln -sf /usr/lib/ld-musl-${ARCH}.so.1 /rootfs/usr/bin/ldd && \
+    mv -f /rootfs/usr/lib/libc.so /rootfs/usr/lib/ld-musl-${ARCH}.so.1 && \
+    ln -sf ld-musl-${ARCH}.so.1 /rootfs/usr/lib/libc.musl-${ARCH}.so.1 && \
+    ln -sf /usr/lib/ld-musl-${ARCH}.so.1 /rootfs/usr/lib/libc.so
+
+FROM core-busybox AS build-go
+COPY --from=core-go / /
+ARG VERSION=1.24.2
+ENV GOROOT_FINAL=/rootfs/go
+USER root
+
+WORKDIR /source
+
+RUN wget https://dl.google.com/go/go${VERSION}.src.tar.gz -O go.src.tar.gz
+
+RUN tar -xzf go.src.tar.gz --strip-components=1 && \
+    rm go.src.tar.gz
+
+RUN cd src && sh make.bash
+
+RUN rm -rf pkg/obj && \
+    rm -rf pkg/bootstrap && \
+    rm -f pkg/tool/*/api && \
+    find src \( -type f -a -name "*_test.go" \) -exec rm -rf \{\} \+ && \
+    find src \( -type d -a -name "testdata" \) -exec rm -rf \{\} \+ && \
+    find src -type f -a \( -name "*.bash" -o -name "*.rc" -o -name "*.bat" \) -exec rm -rf \{\} \+ && \
+    mkdir -p "${GOROOT_FINAL}" && \
+    mv * "${GOROOT_FINAL}" && \
+    mkdir -p /rootfs/usr/bin && \
+    ln -s /go/bin/go /rootfs/usr/bin/go && \
+    ln -s /go/bin/gofmt /rootfs/usr/bin/gofmt
+
+FROM scratch AS final
+COPY --from=core-busybox / /
+COPY --from=build-binutils /rootfs/ /
+COPY --from=build-gcc /rootfs/ /
+COPY --from=build-linux-headers /rootfs/ /
+COPY --from=build-musl /rootfs/ /
+COPY --from=build-make /rootfs/ /
+COPY --from=build-go /rootfs/ /
+
+RUN mkdir -p /usr/bin /usr/lib && \
+    [ -L /bin ] && [ -d /bin ] && \
+    [ -L /lib ] && [ -d /lib ] && \
+    [ -L /lib64 ] && [ -d /lib64 ] && \
+    [ -L /usr/lib64 ] && [ -d /usr/lib64 ] && \
+    [ ! -e /sbin ] || [ -z "$(ls -A /sbin 2>/dev/null)" ] && \
+    [ ! -e /usr/sbin ] || [ -z "$(ls -A /usr/sbin 2>/dev/null)" ] && \
+    rm -rf /sbin && \
+    rm -rf /usr/sbin && \
+    ln -sT usr/bin /sbin && \
+    ln -sT bin /usr/sbin
+
+FROM scratch AS toolchain-musl
+COPY --from=build-musl /rootfs /
+
+FROM scratch AS toolchain
+COPY --from=final / /