diff --git a/.dockerignore b/.dockerignore
index 14b0e0c4..9931c830 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,6 +5,7 @@ config/
 docs/
 hack/
 images/
+!images/agent-base/goose-src/
 skills/
 test/
 changes/
diff --git a/.github/workflows/image-build-push.yml b/.github/workflows/image-build-push.yml
index 7412c5d1..a9951a89 100644
--- a/.github/workflows/image-build-push.yml
+++ b/.github/workflows/image-build-push.yml
@@ -126,7 +126,7 @@ jobs:
       registry: "quay.io/konveyor"
       image_name: skills
       containerfile: catalog/Containerfile
-      context: catalog
+      context: .
       architectures: '["amd64"]'
     secrets:
       registry_username: ${{ vars.QUAY_USERNAME }}
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index c82372c0..4fdd201c 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -83,6 +83,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+          submodules: true
 
       - name: Build and upload agent-base artifact
         uses: konveyor/ci/build-image@e45ec039d03d41be52ae0c9abef260ee3ae8172a # main
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..239d6f78
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "images/agent-base/goose-src"]
+	path = images/agent-base/goose-src
+	url = https://github.com/aaif-goose/goose
diff --git a/Makefile b/Makefile
index f1046d30..cf3d1187 100644
--- a/Makefile
+++ b/Makefile
@@ -300,7 +300,7 @@ SKILL_IMAGE ?= quay.io/konveyor/skills:latest
 
 .PHONY: skill-build
 skill-build: ## Build the skill bundle image.
-	$(CONTAINER_TOOL) build -t $(SKILL_IMAGE) -f catalog/Containerfile catalog
+	$(CONTAINER_TOOL) build -t $(SKILL_IMAGE) -f catalog/Containerfile .
 
 .PHONY: skill-push
 skill-push: skill-build ## Build and push the skill bundle image.
diff --git a/catalog/Containerfile b/catalog/Containerfile
index 4db053a7..8a9f6910 100644
--- a/catalog/Containerfile
+++ b/catalog/Containerfile
@@ -10,7 +10,7 @@
 # the single-skill shape live in catalog/examples/ and are deliberately
 # outside this build context, so they never ship in the bundle.
 #
-#   podman build -t quay.io/konveyor/skills:dev -f catalog/Containerfile catalog
+#   podman build -t quay.io/konveyor/skills:dev -f catalog/Containerfile .
 #
 # The repository's own maintainer workflow skills (grill-me, submit-pr, …)
 # live in the top-level skills/ directory, not here, so they cannot leak
@@ -22,7 +22,7 @@ FROM scratch
 # subdirectory (plan, execute, verify, javaee-to-quarkus) becomes one skill
 # at /<name>/SKILL.md. Because catalog/skills holds only shipped skills,
 # this needs no per-skill allowlist.
-COPY skills/ /
+COPY catalog/skills/ /
 
 LABEL org.opencontainers.image.title="konveyor-skills" \
       org.opencontainers.image.description="Konveyor migration skills (AgentSkills.io format)" \
diff --git a/images/agent-base/Containerfile b/images/agent-base/Containerfile
index 920d997b..d2033bb1 100644
--- a/images/agent-base/Containerfile
+++ b/images/agent-base/Containerfile
@@ -7,29 +7,18 @@
 # --- Build stage ---
 FROM golang:1.26 AS builder
 
-# Goose CLI build deps
+# Goose CLI build deps (Debian/Ubuntu for local builds; ocp-build-data replaces with dnf for RHEL)
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
-    && apt-get update && apt-get install -y \
-        build-essential \
-        git \
-        cmake \
-        pkg-config \
-        libssl-dev \
-        libclang-dev \
-        clang \
-        libdbus-1-dev \
-        libxcb1-dev \
-        perl \
+    && apt-get update && apt-get install -y build-essential git cmake pkg-config libssl-dev libclang-dev clang libdbus-1-dev libxcb1-dev perl \
     && rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/root/.cargo/bin:${PATH}"
 
-# Build goose from source (BUILDING_LINUX.md)
-ARG GOOSE_VERSION=v1.45.0
+# Build goose from the submodule source (images/agent-base/goose-src/).
+# Run `git submodule update --init images/agent-base/goose-src` before building locally.
 WORKDIR /src/goose
-RUN git clone https://github.com/aaif-goose/goose.git . \
-    && git checkout ${GOOSE_VERSION} \
-    && cargo build --release -p goose-cli --bin goose \
+COPY images/agent-base/goose-src/ .
+RUN cargo build --release -p goose-cli --bin goose \
     && mv target/release/goose /usr/local/bin/goose
 
 # The harness replaces github.com/konveyor/agentic-controller/api with ../api,
@@ -37,7 +26,9 @@ RUN git clone https://github.com/aaif-goose/goose.git . \
 # the same way it is in the repository. Manifests first, so the download layer
 # still caches on go.mod alone.
 WORKDIR /src/harness
+COPY api/go.mod api/go.sum /src/api/
 COPY harness/go.mod harness/go.sum ./
+RUN go mod download
 COPY api/ /src/api/
 COPY harness/cmd/ cmd/
 COPY harness/internal/ internal/
@@ -51,9 +42,12 @@ RUN dnf install -y \
     ca-certificates \
     bzip2 \
     tar \
-    python3.11 \
-    python3.11-pip \
-    && python3.11 -m pip install --no-cache-dir --no-index --find-links /cachi2/output/deps/pip/ graphifyy==0.7.17 \
+    python3-pip \
+    && if [ -d /cachi2/output/deps/pip ]; then \
+        python3 -m pip install --no-cache-dir --no-index --find-links /cachi2/output/deps/pip/ graphifyy==0.7.17; \
+    else \
+        python3 -m pip install --no-cache-dir graphifyy==0.7.17; \
+    fi \
     && dnf clean all
 
 ENV PYTHONUNBUFFERED=1
diff --git a/images/agent-base/goose-src b/images/agent-base/goose-src
new file mode 160000
index 00000000..4dc0420f
--- /dev/null
+++ b/images/agent-base/goose-src
@@ -0,0 +1 @@
+Subproject commit 4dc0420f5704a92806c6628c8f0a3497d7a88759