diff --git a/.github/workflows/.build.yml b/.github/workflows/.build.yml
index e140f03d..6772c9c1 100644
--- a/.github/workflows/.build.yml
+++ b/.github/workflows/.build.yml
@@ -374,11 +374,11 @@ jobs:
           rm -rf /tmp/release-squashed
       -
         name: Prepare release
-        env:
-          BUILD_METADATA: ${{ steps.build.outputs.metadata }}
         run: |
-          printf '%s\n' "$BUILD_METADATA" > /tmp/release-metadata.json
-          
+          cat > "/tmp/release-metadata.json" <<-'EOF'
+          ${{ steps.build.outputs.metadata }}
+          EOF
+
           for tag in $(jq -r '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON"); do
             echo "* \`${tag}\`" >> /tmp/tags.txt
           done
diff --git a/hack/scripts/rpm-init.sh b/hack/scripts/rpm-init.sh
index cb1c8bc8..f6353bcc 100755
--- a/hack/scripts/rpm-init.sh
+++ b/hack/scripts/rpm-init.sh
@@ -88,7 +88,9 @@ case "$pkgrelease" in
     ;;
   rhel*)
     # skipping rpmlint as it requires dependencies not available in ubi images
-    dnf install -y git rpm-build dnf-plugins-core
+    # UBI images can ship newer RPM packages than their repositories provide.
+    # Allow removing conflicting packages so RPM can match rpm-build's version.
+    dnf install -y --allowerasing git rpm-build dnf-plugins-core
     ;;
 esac
 
diff --git a/hack/scripts/verify-rpm-init.sh b/hack/scripts/verify-rpm-init.sh
index 8a9d661b..39a1ca26 100755
--- a/hack/scripts/verify-rpm-init.sh
+++ b/hack/scripts/verify-rpm-init.sh
@@ -52,7 +52,13 @@ case "$pkgrelease" in
     dnf config-manager --enable ol10_addons ol10_codeready_builder
     dnf install -y findutils
     ;;
-  fedora*|rhel*)
+  rhel*)
+    # UBI images can ship newer RPM packages than their repositories provide.
+    # Align RPM before package dependencies pull in plugins such as SELinux.
+    dnf distro-sync -y --allowerasing 'rpm*'
+    dnf install -y findutils dnf-plugins-core
+    ;;
+  fedora*)
     dnf install -y findutils dnf-plugins-core
     ;;
   rockylinux8|almalinux8)