diff --git a/auth-center/Dockerfile b/auth-center/Dockerfile
index 7640a038..85c6d32f 100644
--- a/auth-center/Dockerfile
+++ b/auth-center/Dockerfile
@@ -15,17 +15,13 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY auth-center/ auth-center/
 COPY lib/ lib/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d auth-center build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="Auth center service exposes Users, Role and Auth control interfaces"
@@ -36,7 +32,11 @@ ARG APP_NAME=auth-center
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
 COPY --from=builder /go/src/repo/${APP_NAME}/*.txt /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/cluster-manager/Dockerfile b/cluster-manager/Dockerfile
index 779f9502..82aed045 100644
--- a/cluster-manager/Dockerfile
+++ b/cluster-manager/Dockerfile
@@ -15,17 +15,13 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY cluster-manager/ cluster-manager/
 COPY lib/ lib/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d cluster-manager build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="This is a Cluster Manager service which controls child clusters from the main cluster"
@@ -35,7 +31,11 @@ ARG APP_NAME=cluster-manager
 
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/cs-manager/Dockerfile b/cs-manager/Dockerfile
index cbac7023..1c0fc76f 100644
--- a/cs-manager/Dockerfile
+++ b/cs-manager/Dockerfile
@@ -15,10 +15,6 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY cs-manager/ cs-manager/
 COPY lib/ lib/
@@ -26,7 +22,7 @@ COPY cluster-manager/api/ cluster-manager/api/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d cs-manager build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="CS Manager is responsible for installation-wide tasks such as child cluster registration, serving /api/v1/info/* endpoints, etc"
@@ -37,7 +33,11 @@ ARG APP_NAME=cs-manager
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/unregister/unregister /unregister
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/event-processor/Dockerfile b/event-processor/Dockerfile
index 898ec925..baf4e293 100644
--- a/event-processor/Dockerfile
+++ b/event-processor/Dockerfile
@@ -15,10 +15,6 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY event-processor/ event-processor/
 COPY lib/ lib/
@@ -31,7 +27,7 @@ COPY kube-manager/api/ kube-manager/api/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d event-processor build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="Event processor processes events from `runtime-monitor`"
@@ -42,7 +38,11 @@ ARG APP_NAME=event-processor
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
 COPY --from=builder /go/src/repo/event-processor/deploy/*.wasm /deploy/
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/history-api/Dockerfile b/history-api/Dockerfile
index 7d050001..0f827c23 100644
--- a/history-api/Dockerfile
+++ b/history-api/Dockerfile
@@ -15,10 +15,6 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY history-api/ history-api/
 COPY lib/ lib/
@@ -28,7 +24,7 @@ COPY policy-enforcer/pkg/model/ policy-enforcer/pkg/model/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d history-api build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="History API service saves and retrieves historic data in the system"
@@ -38,7 +34,11 @@ ARG APP_NAME=history-api
 
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/kube-manager/Dockerfile b/kube-manager/Dockerfile
index 497b4b14..487ade04 100644
--- a/kube-manager/Dockerfile
+++ b/kube-manager/Dockerfile
@@ -15,17 +15,13 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY kube-manager/ kube-manager/
 COPY lib/ lib/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d kube-manager build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="The Kube Manager service collects information about entities in the K8S cluster and provides interfaces for obtaining this data"
@@ -35,7 +31,11 @@ ARG APP_NAME=kube-manager
 
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/notifier/Dockerfile b/notifier/Dockerfile
index 8720b0b0..b83a13e2 100644
--- a/notifier/Dockerfile
+++ b/notifier/Dockerfile
@@ -15,10 +15,6 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY notifier/ notifier/
 COPY lib/ lib/
@@ -30,7 +26,7 @@ COPY event-processor/api/ event-processor/api/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d notifier build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="Notifier service is responsible for sending notifications"
@@ -41,7 +37,11 @@ ARG APP_NAME=notifier
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
 COPY --from=builder /go/src/repo/notifier/templates /templates
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/policy-enforcer/Dockerfile b/policy-enforcer/Dockerfile
index 6ff3a237..fcfb3146 100644
--- a/policy-enforcer/Dockerfile
+++ b/policy-enforcer/Dockerfile
@@ -15,17 +15,13 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY policy-enforcer/ policy-enforcer/
 COPY lib/ lib/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d policy-enforcer build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="Policy Enforcer service evaluates Policy and exposes Scope and Rule control interfaces"
@@ -35,7 +31,11 @@ ARG APP_NAME=policy-enforcer
 
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/public-api/Dockerfile b/public-api/Dockerfile
index 5bea363a..e861e949 100644
--- a/public-api/Dockerfile
+++ b/public-api/Dockerfile
@@ -15,10 +15,6 @@ COPY go.mod go.sum ./
 COPY vendor/ vendor/
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY public-api/ public-api/
 COPY lib/ lib/
@@ -29,7 +25,7 @@ COPY kube-manager/ kube-manager/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d public-api build
 
-FROM debian:12.0-slim AS runner
+FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="REST API for using CS functionality in client services"
@@ -39,7 +35,11 @@ ARG APP_NAME=public-api
 
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
+
+# Certificates are loaded by relative paths, so run from the directory they are copied to.
+WORKDIR /
+# Numeric UID lets Kubernetes verify runAsNonRoot.
+USER 65532:65532
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]
diff --git a/runtime-monitor/Dockerfile b/runtime-monitor/Dockerfile
index fbcf4691..1d900165 100644
--- a/runtime-monitor/Dockerfile
+++ b/runtime-monitor/Dockerfile
@@ -17,17 +17,14 @@ COPY pkg/tools/tools.go pkg/tools/
 
 ENV GOCACHE=/root/.cache/go-build
 
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    mkdir -p bin && \
-    GOBIN=/go/src/repo/bin go install github.com/google/gops
-
 COPY --from=tools /usr/bin/task /usr/bin
 COPY runtime-monitor/ runtime-monitor/
 COPY lib/ lib/
 
 RUN --mount=type=cache,target="/root/.cache/go-build" task -d runtime-monitor build
 
-FROM debian:12.0-slim AS runner
+# Runs as root: runtime-monitor talks to Tetragon, which runs as root in the same pod.
+FROM gcr.io/distroless/static-debian13 AS runner
 
 LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
 LABEL org.opencontainers.image.description="Runtime monitor monitors runtime events in k8s"
@@ -37,7 +34,6 @@ ARG APP_NAME=runtime-monitor
 
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
 COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
-COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops
 
 EXPOSE 8000 9000
 ENTRYPOINT ["/app"]