diff --git a/hack/qemu-metadata-api/BUILD.bazel b/hack/qemu-metadata-api/BUILD.bazel
index c67018e05..ffd112b99 100644
--- a/hack/qemu-metadata-api/BUILD.bazel
+++ b/hack/qemu-metadata-api/BUILD.bazel
@@ -1,4 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
+load("//bazel/go:platform.bzl", "platform_binary")
 
 go_library(
     name = "qemu-metadata-api_lib",
@@ -20,3 +23,31 @@ go_binary(
     embed = [":qemu-metadata-api_lib"],
     visibility = ["//visibility:public"],
 )
+
+platform_binary(
+    name = "qemu_metadata_api_linux_amd64",
+    platform = "@zig_sdk//libc_aware/platform:linux_amd64_gnu.2.34",
+    target_file = ":qemu-metadata-api",
+    visibility = ["//visibility:public"],
+)
+
+pkg_tar(
+    name = "layer",
+    srcs = [
+        ":qemu_metadata_api_linux_amd64",
+    ],
+    mode = "0755",
+    remap_paths = {"/platform:linux_amd64_gnu.2.34": "/server"},
+)
+
+oci_image(
+    name = "qemumetadata",
+    architecture = "amd64",
+    entrypoint = ["/server"],
+    os = "linux",
+    tars = [
+        "//rpm:libvirt-devel",
+        ":layer",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/joinservice/cmd/BUILD.bazel b/joinservice/cmd/BUILD.bazel
index b1ae0dcfd..5dbb56f43 100644
--- a/joinservice/cmd/BUILD.bazel
+++ b/joinservice/cmd/BUILD.bazel
@@ -1,4 +1,6 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -36,3 +38,31 @@ go_binary(
     pure = "on",
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "joinservice_linux_amd64",
+    platform = "@io_bazel_rules_go//go/toolchain:linux_amd64",
+    target = ":cmd",
+    visibility = ["//visibility:public"],
+)
+
+pkg_tar(
+    name = "layer",
+    srcs = [
+        ":joinservice_linux_amd64",
+    ],
+    mode = "0755",
+    remap_paths = {"/joinservice_linux_amd64": "/joinservice"},
+)
+
+oci_image(
+    name = "joinservice",
+    architecture = "amd64",
+    base = "@distroless_static",
+    entrypoint = ["/joinservice"],
+    os = "linux",
+    tars = [
+        ":layer",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/keyservice/cmd/BUILD.bazel b/keyservice/cmd/BUILD.bazel
index a827096cb..6ef11d958 100644
--- a/keyservice/cmd/BUILD.bazel
+++ b/keyservice/cmd/BUILD.bazel
@@ -1,4 +1,6 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -25,3 +27,31 @@ go_binary(
     pure = "on",
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "keyservice_linux_amd64",
+    platform = "@io_bazel_rules_go//go/toolchain:linux_amd64",
+    target = ":cmd",
+    visibility = ["//visibility:public"],
+)
+
+pkg_tar(
+    name = "layer",
+    srcs = [
+        ":keyservice_linux_amd64",
+    ],
+    mode = "0755",
+    remap_paths = {"/keyservice_linux_amd64": "/keyservice"},
+)
+
+oci_image(
+    name = "keyservice",
+    architecture = "amd64",
+    base = "@distroless_static",
+    entrypoint = ["/keyservice"],
+    os = "linux",
+    tars = [
+        ":layer",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/operators/constellation-node-operator/BUILD.bazel b/operators/constellation-node-operator/BUILD.bazel
index 15504ff43..36dff6e1b 100644
--- a/operators/constellation-node-operator/BUILD.bazel
+++ b/operators/constellation-node-operator/BUILD.bazel
@@ -1,4 +1,6 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
 
 # gazelle:prefix github.com/edgelesssys/constellation/v2/operators/constellation-node-operator/v2
 
@@ -36,3 +38,31 @@ go_binary(
     pure = "on",
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "node_operator_amd64",
+    platform = "@io_bazel_rules_go//go/toolchain:linux_amd64",
+    target = ":constellation-node-operator",
+    visibility = ["//visibility:public"],
+)
+
+pkg_tar(
+    name = "layer",
+    srcs = [
+        ":node_operator_amd64",
+    ],
+    mode = "0755",
+    remap_paths = {"/node_operator_amd64": "/node-operator"},
+)
+
+oci_image(
+    name = "node_operator",
+    architecture = "amd64",
+    base = "@distroless_static",
+    entrypoint = ["/node-operator"],
+    os = "linux",
+    tars = [
+        ":layer",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/verify/cmd/BUILD.bazel b/verify/cmd/BUILD.bazel
index d6228a7e8..c90eb9777 100644
--- a/verify/cmd/BUILD.bazel
+++ b/verify/cmd/BUILD.bazel
@@ -1,4 +1,6 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -22,3 +24,31 @@ go_binary(
     pure = "on",
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "verify_linux_amd64",
+    platform = "@io_bazel_rules_go//go/toolchain:linux_amd64",
+    target = ":cmd",
+    visibility = ["//visibility:public"],
+)
+
+pkg_tar(
+    name = "layer",
+    srcs = [
+        ":verify_linux_amd64",
+    ],
+    mode = "0755",
+    remap_paths = {"/verify_linux_amd64": "/verify"},
+)
+
+oci_image(
+    name = "verificationservice",
+    architecture = "amd64",
+    base = "@distroless_static",
+    entrypoint = ["/verify"],
+    os = "linux",
+    tars = [
+        ":layer",
+    ],
+    visibility = ["//visibility:public"],
+)