diff --git a/.dockerignore b/.dockerignore
index 038672e0..5e56e040 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,2 +1 @@
 /bin
-/release
diff --git a/.gitignore b/.gitignore
index 038672e0..5e56e040 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
 /bin
-/release
diff --git a/Dockerfile b/Dockerfile
index ebc1269e..e56d8903 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ FROM crazymax/osxcross:${OSXCROSS_VERSION} AS osxcross
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS gobase
 COPY --from=xx / /
-RUN apk add --no-cache clang file git lld llvm pkgconf rsync
+RUN apk add --no-cache clang file git lld llvm make pkgconf rsync
 ENV GOFLAGS="-mod=vendor"
 ENV CGO_ENABLED="1"
 WORKDIR /src
@@ -57,13 +57,6 @@ RUN --mount=type=bind,target=. \
     --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
     golangci-lint run ./...
 
-FROM gobase AS version
-ARG PKG
-RUN --mount=target=. \
-    VERSION=$(git describe --match 'v[0-9]*' --dirty='.m' --always --tags) REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi); \
-    echo "-s -w -X ${PKG}/credentials.Version=${VERSION} -X ${PKG}/credentials.Revision=${REVISION} -X ${PKG}/credentials.Package=${PKG}" | tee /tmp/.ldflags; \
-    echo -n "${VERSION}" | tee /tmp/.version;
-
 FROM gobase AS base
 ARG TARGETPLATFORM
 RUN xx-apk add musl-dev gcc libsecret-dev pass
@@ -99,13 +92,12 @@ ARG TARGETARCH
 ARG TARGETVARIANT
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache \
-    --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=bind,from=version,source=/tmp/.ldflags,target=/tmp/.ldflags <<EOT
+    --mount=type=cache,target=/go/pkg/mod <<EOT
   set -ex
-  mkdir /out
-  xx-go build -ldflags "$(cat /tmp/.ldflags) -X ${PKG}/credentials.Name=docker-credential-pass" -o /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} ./pass/cmd/
+  xx-go --wrap
+  make build-pass DESTDIR=/out BINNAME=docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
   xx-verify /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
-  xx-go build -ldflags "$(cat /tmp/.ldflags) -X ${PKG}/credentials.Name=docker-credential-secretservice" -o /out/docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} ./secretservice/cmd/
+  make build-secretservice DESTDIR=/out BINNAME=docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
   xx-verify /out/docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
 EOT
 
@@ -117,15 +109,13 @@ ARG TARGETVARIANT
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache \
     --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=bind,from=osxcross,src=/osxsdk,target=/xx-sdk \
-    --mount=type=bind,from=version,source=/tmp/.ldflags,target=/tmp/.ldflags <<EOT
+    --mount=type=bind,from=osxcross,src=/osxsdk,target=/xx-sdk <<EOT
   set -ex
-  mkdir /out
-  xx-go install std
-  xx-go build -ldflags "$(cat /tmp/.ldflags) -X ${PKG}/credentials.Name=docker-credential-osxkeychain" -o /out/docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT} ./osxkeychain/cmd/
+  xx-go --wrap
+  go install std
+  make build-osxkeychain DESTDIR=/out BINNAME=docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT}
   xx-verify /out/docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT}
-
-  xx-go build -ldflags "$(cat /tmp/.ldflags) -X ${PKG}/credentials.Name=docker-credential-pass" -o /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} ./pass/cmd/
+  make build-pass DESTDIR=/out BINNAME=docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
   xx-verify /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
 EOT
 
@@ -135,11 +125,10 @@ ARG TARGETARCH
 ARG TARGETVARIANT
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache \
-    --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=bind,from=version,source=/tmp/.ldflags,target=/tmp/.ldflags <<EOT
+    --mount=type=cache,target=/go/pkg/mod <<EOT
   set -ex
-  mkdir /out
-  xx-go build -ldflags "$(cat /tmp/.ldflags) -X ${PKG}/credentials.Name=docker-credential-wincred" -o /out/docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe ./wincred/cmd/
+  xx-go --wrap
+  make build-wincred DESTDIR=/out BINNAME=docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe
   xx-verify /out/docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe
 EOT
 
diff --git a/Makefile b/Makefile
index 671d0c0f..72ad2620 100644
--- a/Makefile
+++ b/Makefile
@@ -1,68 +1,80 @@
-.PHONY: all osxkeychain secretservice test lint validate-vendor fmt validate wincred pass deb vendor
-
 PKG := github.com/docker/docker-credential-helpers
 VERSION ?= $(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
 REVISION ?= $(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
 
-LDFLAGS=-s -w -X ${PKG}/credentials.Version=${VERSION} -X ${PKG}/credentials.Revision=${REVISION} -X ${PKG}/credentials.Package=${PKG}
+GO_LDFLAGS=-s -w -X ${PKG}/credentials.Version=${VERSION} -X ${PKG}/credentials.Revision=${REVISION} -X ${PKG}/credentials.Package=${PKG}
+
+BUILDX_CMD ?= docker buildx
+DESTDIR ?= ./bin/build
 
-all: test
+.PHONY: all
+all: cross
 
+.PHONY: clean
 clean:
 	rm -rf bin
-	rm -rf release
 
-osxkeychain:
-	mkdir -p bin
-	go build -ldflags="$(LDFLAGS) -X ${PKG}/credentials.Name=docker-credential-osxkeychain" -o bin/docker-credential-osxkeychain ./osxkeychain/cmd/
-
-osxcodesign: osxkeychain
-	$(eval SIGNINGHASH = $(shell security find-identity -v -p codesigning | grep "Developer ID Application: Docker Inc" | cut -d ' ' -f 4))
-	xcrun -log codesign -s $(SIGNINGHASH) --force --verbose bin/docker-credential-osxkeychain
-	xcrun codesign --verify --deep --strict --verbose=2 --display bin/docker-credential-osxkeychain
+.PHONY: build-%
+build-%: # build, can be one of build-osxkeychain build-pass build-secretservice build-wincred
+	$(eval BINNAME ?= docker-credential-$*)
+	go build -trimpath -ldflags="$(GO_LDFLAGS) -X ${PKG}/credentials.Name=docker-credential-$*" -o $(DESTDIR)/$(BINNAME) ./$*/cmd/
 
-secretservice:
-	mkdir -p bin
-	go build -ldflags="$(LDFLAGS) -X ${PKG}/credentials.Name=docker-credential-secretservice" -o bin/docker-credential-secretservice ./secretservice/cmd/
+# aliases for build-* targets
+.PHONY: osxkeychain secretservice pass wincred
+osxkeychain: build-osxkeychain
+secretservice: build-secretservice
+pass: build-pass
+wincred: build-wincred
 
-pass:
-	mkdir -p bin
-	go build -ldflags="$(LDFLAGS) -X ${PKG}/credentials.Name=docker-credential-pass" -o bin/docker-credential-pass ./pass/cmd/
-
-wincred:
-	mkdir -p bin
-	go build -ldflags="$(LDFLAGS) -X ${PKG}/credentials.Name=docker-credential-wincred" -o bin/docker-credential-wincred.exe ./wincred/cmd/
+.PHONY: osxcodesign
+osxcodesign: build-osxkeychain
+	$(eval SIGNINGHASH = $(shell security find-identity -v -p codesigning | grep "Developer ID Application: Docker Inc" | cut -d ' ' -f 4))
+	xcrun -log codesign -s $(SIGNINGHASH) --force --verbose bin/build/docker-credential-osxkeychain
+	xcrun codesign --verify --deep --strict --verbose=2 --display bin/build/docker-credential-osxkeychain
 
+.PHONY: linuxrelease
 linuxrelease:
 	mkdir -p release
 	cd bin && tar cvfz ../release/docker-credential-pass-$(VERSION)-amd64.tar.gz docker-credential-pass
 	cd bin && tar cvfz ../release/docker-credential-secretservice-$(VERSION)-amd64.tar.gz docker-credential-secretservice
 
+.PHONY: osxrelease
 osxrelease:
 	mkdir -p release
 	cd bin && tar cvfz ../release/docker-credential-osxkeychain-$(VERSION)-amd64.tar.gz docker-credential-osxkeychain
 	cd bin && tar cvfz ../release/docker-credential-pass-$(VERSION)-darwin-amd64.tar.gz docker-credential-pass
 
+.PHONY: winrelease
 winrelease:
 	mkdir -p release
 	cd bin && zip ../release/docker-credential-wincred-$(VERSION)-amd64.zip docker-credential-wincred.exe
 
+.PHONY: cross
+cross: # cross build all supported credential helpers
+	$(BUILDX_CMD) bake cross
+
+.PHONY: test
 test:
 	# tests all packages except vendor
 	go test -v `go list ./... | grep -v /vendor/`
 
+.PHONY: lint
 lint:
-	docker buildx bake lint
+	$(BUILDX_CMD) bake lint
 
+.PHONY: validate-vendor
 validate-vendor:
-	docker buildx bake vendor-validate
+	$(BUILDX_CMD) bake vendor-validate
 
+.PHONY: fmt
 fmt:
 	gofmt -s -l `ls **/*.go | grep -v vendor`
 
+.PHONY: validate
 validate: lint validate-vendor fmt
 
 BUILDIMG:=docker-credential-secretservice-$(VERSION)
+.PHONY: deb
 deb:
 	mkdir -p release
 	docker build -f deb/Dockerfile \
@@ -73,9 +85,10 @@ deb:
 	docker run --rm --net=none $(BUILDIMG) tar cf - /release | tar xf -
 	docker rmi $(BUILDIMG)
 
+.PHONY: vendor
 vendor:
 	$(eval $@_TMP_OUT := $(shell mktemp -d -t docker-output.XXXXXXXXXX))
-	docker buildx bake --set "*.output=type=local,dest=$($@_TMP_OUT)" vendor
+	$(BUILDX_CMD) bake --set "*.output=type=local,dest=$($@_TMP_OUT)" vendor
 	rm -rf ./vendor
 	cp -R "$($@_TMP_OUT)"/* .
 	rm -rf "$($@_TMP_OUT)"