diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6b660a3e..b4704622 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,6 +10,9 @@ on:
       - 'main'
   pull_request:
 
+env:
+  BUILDER_NAME: remote-builder
+
 jobs:
   validate:
     runs-on: ubuntu-20.04
@@ -48,8 +51,30 @@ jobs:
         name: Set up QEMU
         uses: docker/setup-qemu-action@v2
       -
-        name: Set up Docker Buildx
+        name: Set up BuildKit container
+        id: builder
         uses: docker/setup-buildx-action@v2
+      -
+        name: Set up Docker Buildx
+        # FIXME: use docker/setup-buildx-action@v2 when https://github.com/docker/setup-buildx-action/pull/165 merged
+        uses: crazy-max/docker-setup-buildx-action@append
+        with:
+          driver: remote
+          endpoint: docker-container://buildx_buildkit_${{ steps.builder.outputs.name }}0
+          append: |
+            - name: aws_graviton2
+              endpoint: tcp://${{ secrets.AWS_ARM64_HOST }}:1234
+              platforms: darwin/arm64,linux/arm64,linux/arm/v5,linux/arm/v6,linux/arm/v7,windows/arm64
+            - name: linuxone_s390x
+              endpoint: tcp://${{ secrets.LINUXONE_S390X_HOST }}:1234
+              platforms: linux/s390x
+        env:
+          BUILDER_NODE_1_AUTH_TLS_CACERT: ${{ secrets.AWS_ARM64_CACERT }}
+          BUILDER_NODE_1_AUTH_TLS_CERT: ${{ secrets.AWS_ARM64_CERT }}
+          BUILDER_NODE_1_AUTH_TLS_KEY: ${{ secrets.AWS_ARM64_KEY }}
+          BUILDER_NODE_2_AUTH_TLS_CACERT: ${{ secrets.LINUXONE_S390X_CACERT }}
+          BUILDER_NODE_2_AUTH_TLS_CERT: ${{ secrets.LINUXONE_S390X_CERT }}
+          BUILDER_NODE_2_AUTH_TLS_KEY: ${{ secrets.LINUXONE_S390X_KEY }}
       -
         # necessary to use gha cache export
         name: Expose GitHub Runtime
@@ -64,6 +89,10 @@ jobs:
         name: List artifacts
         run: |
           tree -nh ./pkg/${{ matrix.name }}/bin
+
+
+
+
 # FIXME: Uncomment when repo made public
 #      -
 #        name: Upload artifacts
diff --git a/pkg/buildx/Dockerfile b/pkg/buildx/Dockerfile
index 22b66337..fc374425 100644
--- a/pkg/buildx/Dockerfile
+++ b/pkg/buildx/Dockerfile
@@ -15,7 +15,7 @@
 # limitations under the License.
 
 ARG ALPINE_VERSION="3.16"
-ARG NFPM_VERSION="2.15.1"
+ARG NFPM_VERSION="v2.15.1"
 ARG XX_VERSION="1.1.2"
 ARG MODE="download"
 
@@ -28,8 +28,12 @@ ARG PKG_SUITE="bullseye"
 # cross compilation helper
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
-# nFPM is Not FPM - a simple deb, rpm and apk packager
-FROM --platform=$BUILDPLATFORM goreleaser/nfpm:v${NFPM_VERSION} AS nfpm
+# nFPM
+FROM --platform=$BUILDPLATFORM golang:1.18-alpine AS nfpm
+RUN apk add --no-cache git
+ARG GO111MODULE="on"
+ARG NFPM_VERSION
+RUN go install github.com/goreleaser/nfpm/v2/cmd/nfpm@${NFPM_VERSION}
 
 FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS base
 COPY --from=xx / /
@@ -83,7 +87,7 @@ ARG TARGETPLATFORM
 RUN --mount=type=bind,source=internal/pkg-build.sh,target=/usr/local/bin/pkg-build \
     --mount=type=bind,source=internal/nfpm.yml,target=nfpm.yml \
     --mount=type=bind,from=src,source=/src,target=/src \
-    --mount=type=bind,from=nfpm,source=/usr/bin/nfpm,target=/usr/bin/nfpm <<EOT
+    --mount=type=bind,from=nfpm,source=/go/bin/nfpm,target=/usr/bin/nfpm <<EOT
   set -e
   if [ "$MODE" != "download" ]; then
     export BUILDX_VERSION="$(git -C "/src" describe --match 'v[0-9]*' --dirty='.m' --always --tags)"
diff --git a/pkg/compose/Dockerfile b/pkg/compose/Dockerfile
index 453a521a..fe82efc8 100644
--- a/pkg/compose/Dockerfile
+++ b/pkg/compose/Dockerfile
@@ -15,7 +15,7 @@
 # limitations under the License.
 
 ARG ALPINE_VERSION="3.16"
-ARG NFPM_VERSION="2.15.1"
+ARG NFPM_VERSION="v2.15.1"
 ARG XX_VERSION="1.1.2"
 ARG MODE="download"
 
@@ -28,8 +28,12 @@ ARG PKG_SUITE="bullseye"
 # cross compilation helper
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
-# nFPM is Not FPM - a simple deb, rpm and apk packager
-FROM --platform=$BUILDPLATFORM goreleaser/nfpm:v${NFPM_VERSION} AS nfpm
+# nFPM
+FROM --platform=$BUILDPLATFORM golang:1.18-alpine AS nfpm
+RUN apk add --no-cache git
+ARG GO111MODULE="on"
+ARG NFPM_VERSION
+RUN go install github.com/goreleaser/nfpm/v2/cmd/nfpm@${NFPM_VERSION}
 
 FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS base
 COPY --from=xx / /
@@ -86,7 +90,7 @@ ARG TARGETPLATFORM
 RUN --mount=type=bind,source=internal/pkg-build.sh,target=/usr/local/bin/pkg-build \
     --mount=type=bind,source=internal/nfpm.yml,target=nfpm.yml \
     --mount=type=bind,from=src,source=/src,target=/src \
-    --mount=type=bind,from=nfpm,source=/usr/bin/nfpm,target=/usr/bin/nfpm <<EOT
+    --mount=type=bind,from=nfpm,source=/go/bin/nfpm,target=/usr/bin/nfpm <<EOT
   set -e
   if [ "$MODE" != "download" ]; then
     export COMPOSE_VERSION="$(git -C "/src" describe --match 'v[0-9]*' --dirty='.m' --always --tags)"