diff --git a/.github/actions/build-push-image-with-apko/action.yml b/.github/actions/build-push-image-with-apko/action.yml
index eb5314ed79..bd0a312e2f 100644
--- a/.github/actions/build-push-image-with-apko/action.yml
+++ b/.github/actions/build-push-image-with-apko/action.yml
@@ -28,6 +28,7 @@ runs:
   using: "composite"
   steps:
     - id: check-image-exists
+      if: ${{ inputs.overwrite == 'false' }}
       shell: bash
       run: |
         set -euo pipefail
diff --git a/.github/workflows/image-deps-updater.yaml b/.github/workflows/image-deps-updater.yaml
index e016e0b5fc..544d26de76 100644
--- a/.github/workflows/image-deps-updater.yaml
+++ b/.github/workflows/image-deps-updater.yaml
@@ -19,22 +19,23 @@ jobs:
     - name: Get tags
       id: get-tags
       run: |
-        minio_yaml=$(curl -s --fail --show-error https://raw.githubusercontent.com/wolfi-dev/os/main/minio.yaml)
-        minio_version=$(echo "$minio_yaml" | grep "version:" | awk '{print $2}' | tr -d '\n')
-        minio_epoch=$(echo "$minio_yaml" | grep "epoch:" | awk '{print $2}' | tr -d '\n')
+        set -euo pipefail
 
-        rqlite_yaml=$(curl -s --fail --show-error https://raw.githubusercontent.com/wolfi-dev/os/main/rqlite.yaml)
-        rqlite_version=$(echo "$rqlite_yaml" | grep "version:" | awk '{print $2}' | tr -d '\n')
-        rqlite_epoch=$(echo "$rqlite_yaml" | grep "epoch:" | awk '{print $2}' | tr -d '\n')
+        curl -LO --fail --show-error https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz
+        tar -xzvf APKINDEX.tar.gz
 
-        dex_yaml=$(curl -s --fail --show-error https://raw.githubusercontent.com/wolfi-dev/os/main/dex.yaml)
-        dex_version=$(echo "$dex_yaml" | grep "version:" | awk '{print $2}' | tr -d '\n')
-        dex_epoch=$(echo "$dex_yaml" | grep "epoch:" | awk '{print $2}' | tr -d '\n')
+        minio_version=$(< APKINDEX grep -A1 "^P:minio$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')
+        rqlite_version=$(< APKINDEX grep -A1 "^P:rqlite$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')
+        dex_version=$(< APKINDEX grep -A1 "^P:dex$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')
+
+        sed "s/__MINIO_VERSION__/$minio_version/g" deploy/minio/apko.yaml.tmpl > deploy/minio/apko.yaml
+        sed "s/__RQLITE_VERSION__/$rqlite_version/g" deploy/rqlite/apko.yaml.tmpl > deploy/rqlite/apko.yaml
+        sed "s/__DEX_VERSION__/$dex_version/g" deploy/dex/apko.yaml.tmpl > deploy/dex/apko.yaml
 
         {
-          echo "minio-tag=$minio_version-$minio_epoch"
-          echo "rqlite-tag=$rqlite_version-$rqlite_epoch"
-          echo "dex-tag=$dex_version-$dex_epoch"
+          echo "minio-tag=$minio_version"
+          echo "rqlite-tag=$rqlite_version"
+          echo "dex-tag=$dex_version"
         } >> "$GITHUB_OUTPUT"
 
     - name: Build and push minio image
@@ -64,6 +65,7 @@ jobs:
         registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
         overwrite: ${{ github.event.inputs.overwrite }}
 
+
   update-image-deps:
     needs: [build-3rd-party-images]
     runs-on: ubuntu-20.04
diff --git a/cmd/imagedeps/image-spec b/cmd/imagedeps/image-spec
index 2b81f185a7..31646d1ae8 100644
--- a/cmd/imagedeps/image-spec
+++ b/cmd/imagedeps/image-spec
@@ -1,5 +1,5 @@
-minio kotsadm/minio ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-([0-9]|[1-9][0-9]*)$
-rqlite kotsadm/rqlite ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-([0-9]|[1-9][0-9]*)$
-dex kotsadm/dex ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-([0-9]|[1-9][0-9]*)$
+minio kotsadm/minio ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-r([0-9]*)$
+rqlite kotsadm/rqlite ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-r([0-9]*)$
+dex kotsadm/dex ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-r([0-9]*)$
 schemahero schemahero/schemahero ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)$
 lvp replicated/local-volume-provider ^v([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)$
\ No newline at end of file
diff --git a/cmd/imagedeps/main.go b/cmd/imagedeps/main.go
index a6238fca5a..ef2575aa66 100644
--- a/cmd/imagedeps/main.go
+++ b/cmd/imagedeps/main.go
@@ -55,9 +55,6 @@ var (
 	replacers = []*replacer{
 		getMakefileReplacer("Makefile"),
 		getMakefileReplacer("migrations/Makefile"),
-		getApkoFileReplacer("deploy/minio/apko.yaml"),
-		getApkoFileReplacer("deploy/rqlite/apko.yaml"),
-		getApkoFileReplacer("deploy/dex/apko.yaml"),
 	}
 )
 
@@ -229,15 +226,3 @@ func getDockerfileReplacer(path string) *replacer {
 		},
 	}
 }
-
-func getApkoFileReplacer(path string) *replacer {
-	return &replacer{
-		path: path,
-		regexFn: func(ir *ImageRef) string {
-			return fmt.Sprintf(`- %s~\d+\.\d+\.\d+(?:-\d+)?`, ir.name)
-		},
-		valueFn: func(ir *ImageRef) string {
-			return ir.GetApkoFileLine(ir.name)
-		},
-	}
-}
diff --git a/cmd/imagedeps/main_test.go b/cmd/imagedeps/main_test.go
index 96b6762366..d421083ca7 100644
--- a/cmd/imagedeps/main_test.go
+++ b/cmd/imagedeps/main_test.go
@@ -14,9 +14,9 @@ import (
 
 var (
 	minioTags = []string{
-		"0.20231101.183725-2",
-		"0.20231101.183725-1",
-		"0.20231101.183725-0",
+		"0.20231101.183725-r2",
+		"0.20231101.183725-r1",
+		"0.20231101.183725-r0",
 		"0.20231101.183725",
 		"0.20231100.183724",
 		"0.20231031.183723",
@@ -24,8 +24,8 @@ var (
 	}
 
 	rqliteTags = []string{
-		"7.21.4-1",
-		"7.21.4-0",
+		"7.21.4-r1",
+		"7.21.4-r0",
 		"7.21.4",
 		"7.20.3",
 		"7.19.2",
@@ -33,7 +33,7 @@ var (
 	}
 
 	dexTags = []string{
-		"2.37.0-0",
+		"2.37.0-r0",
 		"2.37.0",
 		"2.36.0",
 		"2.35.0",
@@ -85,9 +85,6 @@ func TestFunctional(t *testing.T) {
 					},
 				),
 			),
-			replacers: []*replacer{
-				getApkoFileReplacer("test.apko.yaml"),
-			},
 		},
 		{
 			name: "schemahero",
@@ -112,9 +109,6 @@ func TestFunctional(t *testing.T) {
 					},
 				),
 			),
-			replacers: []*replacer{
-				getApkoFileReplacer("test.apko.yaml"),
-			},
 		},
 		{
 			name: "dex",
@@ -125,9 +119,6 @@ func TestFunctional(t *testing.T) {
 					},
 				),
 			),
-			replacers: []*replacer{
-				getApkoFileReplacer("test.apko.yaml"),
-			},
 		},
 		{
 			name: "lvp",
diff --git a/cmd/imagedeps/tag-finder.go b/cmd/imagedeps/tag-finder.go
index 831e69efb8..84f3c62d98 100644
--- a/cmd/imagedeps/tag-finder.go
+++ b/cmd/imagedeps/tag-finder.go
@@ -42,11 +42,6 @@ func (ir ImageRef) GetDockerfileLine() string {
 	return fmt.Sprintf("ARG %s=%s", getDockerfileVarName(ir.name), ir.tag)
 }
 
-// GetApkoFileLine generates a line of text intended for use in an Apko file.
-func (ir ImageRef) GetApkoFileLine(pkg string) string {
-	return fmt.Sprintf("- %s~%s", pkg, ir.tag)
-}
-
 type getTagsFn func(string) ([]string, error)
 type getReleaseFn func(string, string) ([]*github.RepositoryRelease, error)
 type tagFinderFn func(inputLine string) (*ImageRef, error)
diff --git a/cmd/imagedeps/testdata/dex/.image.env b/cmd/imagedeps/testdata/dex/.image.env
index e017ba16d3..c99f3e97bd 100644
--- a/cmd/imagedeps/testdata/dex/.image.env
+++ b/cmd/imagedeps/testdata/dex/.image.env
@@ -1,4 +1,4 @@
 # Generated file, do not modify.  This file is generated from a text file containing a list of images. The
 # most recent tag is interpolated from the source repository and used to generate a fully qualified image
 # name.
-DEX_TAG='2.37.0-0'
\ No newline at end of file
+DEX_TAG='2.37.0-r0'
\ No newline at end of file
diff --git a/cmd/imagedeps/testdata/dex/constants.go b/cmd/imagedeps/testdata/dex/constants.go
index 66da32d43e..f16ed4c267 100644
--- a/cmd/imagedeps/testdata/dex/constants.go
+++ b/cmd/imagedeps/testdata/dex/constants.go
@@ -5,5 +5,5 @@ package image
 // image name.
 
 const (
-	Dex = "kotsadm/dex:2.37.0-0"
+	Dex = "kotsadm/dex:2.37.0-r0"
 )
diff --git a/cmd/imagedeps/testdata/dex/input-spec b/cmd/imagedeps/testdata/dex/input-spec
index 572ef7e9ba..9b19aad0dc 100644
--- a/cmd/imagedeps/testdata/dex/input-spec
+++ b/cmd/imagedeps/testdata/dex/input-spec
@@ -1 +1 @@
-dex kotsadm/dex ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-([0-9]|[1-9][0-9]*)$
\ No newline at end of file
+dex kotsadm/dex ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-r([0-9]*)$
\ No newline at end of file
diff --git a/cmd/imagedeps/testdata/dex/replacers/input/test.apko.yaml b/cmd/imagedeps/testdata/dex/replacers/input/test.apko.yaml
deleted file mode 100644
index 484f0b1abb..0000000000
--- a/cmd/imagedeps/testdata/dex/replacers/input/test.apko.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-contents:
-  repositories:
-    - https://packages.wolfi.dev/os
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  packages:
-    - dex~2.36.0
-    - gomplate
-    - bash
-    - busybox
-    - wolfi-baselayout
-
-accounts:
-  groups:
-    - groupname: dex
-      gid: 1001
-  users:
-    - username: dex
-      uid: 1001
-      gid: 1001
-  run-as: dex
-
-entrypoint:
-  command: docker-entrypoint
-
-cmd: dex serve /etc/dex/config.docker.yaml
diff --git a/cmd/imagedeps/testdata/minio/.image.env b/cmd/imagedeps/testdata/minio/.image.env
index 42885dee48..4b59761c5b 100644
--- a/cmd/imagedeps/testdata/minio/.image.env
+++ b/cmd/imagedeps/testdata/minio/.image.env
@@ -1,4 +1,4 @@
 # Generated file, do not modify.  This file is generated from a text file containing a list of images. The
 # most recent tag is interpolated from the source repository and used to generate a fully qualified image
 # name.
-MINIO_TAG='0.20231101.183725-2'
\ No newline at end of file
+MINIO_TAG='0.20231101.183725-r2'
\ No newline at end of file
diff --git a/cmd/imagedeps/testdata/minio/constants.go b/cmd/imagedeps/testdata/minio/constants.go
index 0253a92aad..cf1f1fadf7 100644
--- a/cmd/imagedeps/testdata/minio/constants.go
+++ b/cmd/imagedeps/testdata/minio/constants.go
@@ -5,5 +5,5 @@ package image
 // image name.
 
 const (
-	Minio = "kotsadm/minio:0.20231101.183725-2"
+	Minio = "kotsadm/minio:0.20231101.183725-r2"
 )
diff --git a/cmd/imagedeps/testdata/minio/input-spec b/cmd/imagedeps/testdata/minio/input-spec
index 78a8c6ed90..ee162022a6 100644
--- a/cmd/imagedeps/testdata/minio/input-spec
+++ b/cmd/imagedeps/testdata/minio/input-spec
@@ -1 +1 @@
-minio kotsadm/minio ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-([0-9]|[1-9][0-9]*)$
\ No newline at end of file
+minio kotsadm/minio ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-r([0-9]*)$
\ No newline at end of file
diff --git a/cmd/imagedeps/testdata/minio/replacers/expected/test.apko.yaml b/cmd/imagedeps/testdata/minio/replacers/expected/test.apko.yaml
deleted file mode 100644
index a07f428801..0000000000
--- a/cmd/imagedeps/testdata/minio/replacers/expected/test.apko.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-contents:
-  repositories:
-    - https://packages.wolfi.dev/os
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  packages:
-    - minio~0.20231101.183725-2
-    - mc
-    - bash
-    - busybox
-    - wolfi-baselayout
-
-accounts:
-  groups:
-    - groupname: minio
-      gid: 1001
-  users:
-    - username: minio
-      uid: 1001
-      gid: 1001
-  run-as: minio
-
-entrypoint:
-  command: minio
diff --git a/cmd/imagedeps/testdata/minio/replacers/input/test.apko.yaml b/cmd/imagedeps/testdata/minio/replacers/input/test.apko.yaml
deleted file mode 100644
index 5280ecd15c..0000000000
--- a/cmd/imagedeps/testdata/minio/replacers/input/test.apko.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-contents:
-  repositories:
-    - https://packages.wolfi.dev/os
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  packages:
-    - minio~0.20231101.183725-1
-    - mc
-    - bash
-    - busybox
-    - wolfi-baselayout
-
-accounts:
-  groups:
-    - groupname: minio
-      gid: 1001
-  users:
-    - username: minio
-      uid: 1001
-      gid: 1001
-  run-as: minio
-
-entrypoint:
-  command: minio
diff --git a/cmd/imagedeps/testdata/rqlite/.image.env b/cmd/imagedeps/testdata/rqlite/.image.env
index 33ee59c27c..87938276c8 100644
--- a/cmd/imagedeps/testdata/rqlite/.image.env
+++ b/cmd/imagedeps/testdata/rqlite/.image.env
@@ -1,4 +1,4 @@
 # Generated file, do not modify.  This file is generated from a text file containing a list of images. The
 # most recent tag is interpolated from the source repository and used to generate a fully qualified image
 # name.
-RQLITE_TAG='7.21.4-1'
\ No newline at end of file
+RQLITE_TAG='7.21.4-r1'
\ No newline at end of file
diff --git a/cmd/imagedeps/testdata/rqlite/constants.go b/cmd/imagedeps/testdata/rqlite/constants.go
index 390384a462..f5ad3beb49 100644
--- a/cmd/imagedeps/testdata/rqlite/constants.go
+++ b/cmd/imagedeps/testdata/rqlite/constants.go
@@ -5,5 +5,5 @@ package image
 // image name.
 
 const (
-	Rqlite = "kotsadm/rqlite:7.21.4-1"
+	Rqlite = "kotsadm/rqlite:7.21.4-r1"
 )
diff --git a/cmd/imagedeps/testdata/rqlite/input-spec b/cmd/imagedeps/testdata/rqlite/input-spec
index e265eb88eb..c5e76dda96 100644
--- a/cmd/imagedeps/testdata/rqlite/input-spec
+++ b/cmd/imagedeps/testdata/rqlite/input-spec
@@ -1 +1 @@
-rqlite kotsadm/rqlite ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-([0-9]|[1-9][0-9]*)$
+rqlite kotsadm/rqlite ^([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)\.([0-9]|[1-9][0-9]*)-r([0-9]*)$
diff --git a/cmd/imagedeps/testdata/rqlite/replacers/expected/test.apko.yaml b/cmd/imagedeps/testdata/rqlite/replacers/expected/test.apko.yaml
deleted file mode 100644
index f552669dd0..0000000000
--- a/cmd/imagedeps/testdata/rqlite/replacers/expected/test.apko.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-contents:
-  repositories:
-    - https://packages.wolfi.dev/os
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  packages:
-    - rqlite~7.21.4-1
-    - rqlite-oci-entrypoint
-    - bash
-    - busybox
-    - wolfi-baselayout
-
-accounts:
-  groups:
-    - groupname: rqlite
-      gid: 1001
-  users:
-    - username: rqlite
-      uid: 1001
-      gid: 1001
-  run-as: rqlite
-
-entrypoint:
-  command: docker-entrypoint.sh
-
-cmd: rqlite
diff --git a/cmd/imagedeps/testdata/rqlite/replacers/input/test.apko.yaml b/cmd/imagedeps/testdata/rqlite/replacers/input/test.apko.yaml
deleted file mode 100644
index d1f34f3069..0000000000
--- a/cmd/imagedeps/testdata/rqlite/replacers/input/test.apko.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-contents:
-  repositories:
-    - https://packages.wolfi.dev/os
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  packages:
-    - rqlite~7.21.4-0
-    - rqlite-oci-entrypoint
-    - bash
-    - busybox
-    - wolfi-baselayout
-
-accounts:
-  groups:
-    - groupname: rqlite
-      gid: 1001
-  users:
-    - username: rqlite
-      uid: 1001
-      gid: 1001
-  run-as: rqlite
-
-entrypoint:
-  command: docker-entrypoint.sh
-
-cmd: rqlite
diff --git a/deploy/dex/apko.yaml b/deploy/dex/apko.yaml
deleted file mode 100644
index 5827458515..0000000000
--- a/deploy/dex/apko.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-contents:
-  repositories:
-    - https://packages.wolfi.dev/os
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  packages:
-    - dex~2.37.0
-    - gomplate
-    - bash
-    - busybox
-    - wolfi-baselayout
-
-accounts:
-  groups:
-    - groupname: dex
-      gid: 1001
-  users:
-    - username: dex
-      uid: 1001
-      gid: 1001
-  run-as: dex
-
-entrypoint:
-  command: docker-entrypoint
-
-cmd: dex serve /etc/dex/config.docker.yaml
diff --git a/cmd/imagedeps/testdata/dex/replacers/expected/test.apko.yaml b/deploy/dex/apko.yaml.tmpl
similarity index 94%
rename from cmd/imagedeps/testdata/dex/replacers/expected/test.apko.yaml
rename to deploy/dex/apko.yaml.tmpl
index 5ff9a0f64e..de5e83e831 100644
--- a/cmd/imagedeps/testdata/dex/replacers/expected/test.apko.yaml
+++ b/deploy/dex/apko.yaml.tmpl
@@ -4,7 +4,7 @@ contents:
   keyring:
     - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
   packages:
-    - dex~2.37.0-0
+    - dex=__DEX_VERSION__
     - gomplate
     - bash
     - busybox
diff --git a/deploy/minio/apko.yaml b/deploy/minio/apko.yaml.tmpl
similarity index 92%
rename from deploy/minio/apko.yaml
rename to deploy/minio/apko.yaml.tmpl
index 868c6dc88e..ece8c851e5 100644
--- a/deploy/minio/apko.yaml
+++ b/deploy/minio/apko.yaml.tmpl
@@ -4,7 +4,7 @@ contents:
   keyring:
     - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
   packages:
-    - minio~0.20231101.183725
+    - minio=__MINIO_VERSION__
     - mc
     - bash
     - busybox
diff --git a/deploy/rqlite/apko.yaml b/deploy/rqlite/apko.yaml.tmpl
similarity index 83%
rename from deploy/rqlite/apko.yaml
rename to deploy/rqlite/apko.yaml.tmpl
index 5f56ef4c35..d2d05a5b2e 100644
--- a/deploy/rqlite/apko.yaml
+++ b/deploy/rqlite/apko.yaml.tmpl
@@ -4,8 +4,8 @@ contents:
   keyring:
     - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
   packages:
-    - rqlite~7.21.4
-    - rqlite-oci-entrypoint
+    - rqlite=__RQLITE_VERSION__
+    - rqlite-oci-entrypoint=__RQLITE_VERSION__
     - bash
     - busybox
     - wolfi-baselayout