diff --git a/.tekton/hive-push.yaml b/.tekton/hive-push.yaml
index 9983bc6f34..f416d36e34 100644
--- a/.tekton/hive-push.yaml
+++ b/.tekton/hive-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:9.6
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/Dockerfile b/Dockerfile
index 9c3a187c32..c4ef55dd4f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 ARG CONTAINER_SUB_MANAGER_OFF=0
 ARG EL8_BUILD_IMAGE=${EL8_BUILD_IMAGE:-registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.24-openshift-4.20}
 ARG EL9_BUILD_IMAGE=${EL9_BUILD_IMAGE:-registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20}
-ARG BASE_IMAGE=${BASE_IMAGE:-registry.ci.openshift.org/ocp/4.20:base-rhel9}
+ARG BASE_IMAGE=${BASE_IMAGE:-registry.access.redhat.com/ubi9/ubi-minimal:9.6}
 
 FROM ${EL8_BUILD_IMAGE} as builder_rhel8
 ARG GO=${GO:-go}
@@ -37,19 +37,20 @@ RUN make build-hiveadmission build-manager build-operator && \
 FROM ${BASE_IMAGE}
 ARG CONTAINER_SUB_MANAGER_OFF
 ENV SMDEV_CONTAINER_OFF=${CONTAINER_SUB_MANAGER_OFF}
+ARG DNF=microdnf
 
 RUN if [ -e "/activation-key/org" ]; then unlink /etc/rhsm-host; subscription-manager register --force --org $(cat "/activation-key/org") --activationkey $(cat "/activation-key/activationkey"); fi
 
 
 ##
 # ssh-agent required for gathering logs in some situations:
-RUN if ! rpm -q openssh-clients; then dnf install -y openssh-clients && dnf clean all && rm -rf /var/cache/dnf/*; fi
+RUN if ! rpm -q openssh-clients; then ${DNF} install -y openssh-clients && ${DNF} clean all && rm -rf /var/cache/${DNF}/*; fi
 
 # libvirt libraries required for running bare metal installer.
-RUN if ! rpm -q libvirt-libs; then dnf install -y libvirt-libs && dnf clean all && rm -rf /var/cache/dnf/*; fi
+RUN if ! rpm -q libvirt-libs; then ${DNF} install -y libvirt-libs && ${DNF} clean all && rm -rf /var/cache/${DNF}/*; fi
 
 # tar is needed to package must-gathers on install failure
-RUN if ! command -v tar; then dnf install -y tar && dnf clean all && rm -rf /var/cache/dnf/*; fi
+RUN if ! command -v tar; then ${DNF} install -y tar && ${DNF} clean all && rm -rf /var/cache/${DNF}/*; fi
 
 COPY --from=builder_rhel9 /go/src/github.com/openshift/hive/bin/manager /opt/services/
 COPY --from=builder_rhel9 /go/src/github.com/openshift/hive/bin/hiveadmission /opt/services/
diff --git a/Makefile b/Makefile
index bef843f654..7225762247 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,7 @@ all: vendor update test build
 # These images need to be synced with the default values in the Dockerfile.
 EL8_BUILD_IMAGE ?= registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.24-openshift-4.20
 EL9_BUILD_IMAGE ?= registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20
-BASE_IMAGE ?= registry.ci.openshift.org/ocp/4.20:base-rhel9
+BASE_IMAGE ?= registry.access.redhat.com/ubi9/ubi-minimal:9.6
 
 # In openshift ci (Prow), we need to set $HOME to a writable directory else tests will fail
 # because they don't have permissions to create /.local or /.cache directories
@@ -322,7 +322,7 @@ podman-dev-build:
 
 podman-operatorhub-build:
 	podman build --tag ${IMG} ${GOCACHE_VOL_ARG} \
-		--build-arg=BASE_IMAGE=quay.io/centos/centos:stream9 \
+		--build-arg=BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:9.6 \
 		--build-arg=BUILD_IMAGE_CUSTOMIZATION=./hack/ubi-build-deps.sh \
 		--build-arg=EL8_BUILD_IMAGE=registry.access.redhat.com/ubi8/ubi:8.10 \
 		--build-arg=EL9_BUILD_IMAGE=registry.access.redhat.com/ubi9:9.5 \