diff --git a/ci/docker_ci.sh b/ci/docker_ci.sh
index a63a3358ca39..ba151430016d 100755
--- a/ci/docker_ci.sh
+++ b/ci/docker_ci.sh
@@ -20,6 +20,7 @@ set -e
 # AZP_BRANCH=refs/tags/v1.77.3
 ##
 
+
 function is_windows() {
     [[ -n "$DOCKER_FAKE_WIN" ]]  || [[ "$(uname -s)" == *NT* ]]
 }
@@ -197,6 +198,11 @@ build_and_maybe_push_image () {
     docker_image_tarball="${ENVOY_DOCKER_IMAGE_DIRECTORY}/envoy${image_type}.tar"
 
     if ! is_windows; then
+        # `--sbom` and `--provenance` args added for skopeo 1.5.0 compat,
+        # can probably be removed for later versions.
+        args+=(
+            "--sbom=false"
+            "--provenance=false")
         if [[ "${image_type}" =~ debug ]]; then
             # For linux if its the debug image then push immediately for release branches,
             # otherwise just test the build
@@ -283,12 +289,19 @@ push_image_from_tarball () {
     # dest="oci-archive:${docker_image_tarball2}"
 
     echo ">> PUSH: ${src} -> ${dest}"
-    echo "> skopeo copy --multi-arch all ${src} ${dest}"
+    echo "> skopeo copy --all ${src} ${dest}"
 
     if [[ -n "$DOCKER_CI_DRYRUN" ]]; then
         return
     fi
-    skopeo copy --multi-arch all "${src}" "${dest}"
+
+    # NB: this command works with skopeo 1.5.0, later versions may require
+    #   different flags, eg `--multi-arch all`
+    skopeo copy --all "${src}" "${dest}"
+
+    # Test specific versions using a container, eg
+    # docker run -v "${HOME}/.docker:/root/.docker" -v "${PWD}/build_images:/build_images" --rm -it \
+    #    quay.io/skopeo/stable:v1.5.0 copy --all "${src}" "${dest}"
 }
 
 tag_variants () {
diff --git a/ci/test/docker/linux/dev/main b/ci/test/docker/linux/dev/main
index 5a2828116269..5a85c40e8750 100644
--- a/ci/test/docker/linux/dev/main
+++ b/ci/test/docker/linux/dev/main
@@ -6,9 +6,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy.tar -> docker://docker.io/envoyproxy/envoy-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-dev:MOCKSHA -> envoyproxy/envoy:dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:dev-MOCKSHA
 >> TAG: envoyproxy/envoy-dev:MOCKSHA -> envoyproxy/envoy-dev:latest
@@ -18,7 +18,7 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> TAG: envoyproxy/envoy-debug-dev:MOCKSHA -> envoyproxy/envoy:debug-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-debug-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:debug-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-debug-dev:MOCKSHA -> envoyproxy/envoy-debug-dev:latest
@@ -28,9 +28,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-contrib.tar -> docker://docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-contrib-dev:MOCKSHA -> envoyproxy/envoy:contrib-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:contrib-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-contrib-dev:MOCKSHA -> envoyproxy/envoy-contrib-dev:latest
@@ -40,7 +40,7 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> TAG: envoyproxy/envoy-contrib-debug-dev:MOCKSHA -> envoyproxy/envoy:contrib-debug-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib-debug-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:contrib-debug-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-contrib-debug-dev:MOCKSHA -> envoyproxy/envoy-contrib-debug-dev:latest
@@ -50,9 +50,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-distroless.tar -> docker://docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-distroless-dev:MOCKSHA -> envoyproxy/envoy:distroless-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:distroless-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-distroless-dev:MOCKSHA -> envoyproxy/envoy-distroless-dev:latest
@@ -62,9 +62,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-google-vrp.tar -> docker://docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-google-vrp-dev:MOCKSHA -> envoyproxy/envoy:google-vrp-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:google-vrp-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-google-vrp-dev:MOCKSHA -> envoyproxy/envoy-google-vrp-dev:latest
@@ -74,9 +74,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-tools.tar -> docker://docker.io/envoyproxy/envoy-tools-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-tools-dev:MOCKSHA -> envoyproxy/envoy:tools-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-tools-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:tools-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-tools-dev:MOCKSHA -> envoyproxy/envoy-tools-dev:latest
diff --git a/ci/test/docker/linux/dev/other b/ci/test/docker/linux/dev/other
index 5ab4b03e08b5..2c7f64a8c711 100644
--- a/ci/test/docker/linux/dev/other
+++ b/ci/test/docker/linux/dev/other
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
diff --git a/ci/test/docker/linux/dev/release b/ci/test/docker/linux/dev/release
index 5ab4b03e08b5..2c7f64a8c711 100644
--- a/ci/test/docker/linux/dev/release
+++ b/ci/test/docker/linux/dev/release
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
diff --git a/ci/test/docker/linux/dev/tag b/ci/test/docker/linux/dev/tag
index 5ab4b03e08b5..2c7f64a8c711 100644
--- a/ci/test/docker/linux/dev/tag
+++ b/ci/test/docker/linux/dev/tag
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
diff --git a/ci/test/docker/linux/nondev/main b/ci/test/docker/linux/nondev/main
index 24c63eed50fa..3fbf0bfee1e9 100644
--- a/ci/test/docker/linux/nondev/main
+++ b/ci/test/docker/linux/nondev/main
@@ -6,15 +6,15 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy:v1.73.0
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.0 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.0 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy.tar -> docker://docker.io/envoyproxy/envoy:v1.73.0
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy:v1.73.0
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy:v1.73.0
 >> TAG: envoyproxy/envoy:v1.73.0 -> envoyproxy/envoy:v1.73-latest
 > docker buildx imagetools create docker.io/envoyproxy/envoy:v1.73.0 --tag docker.io/envoyproxy/envoy:v1.73-latest
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-debug:v1.73.0
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-debug:v1.73.0 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-debug:v1.73.0 .
 >> TAG: envoyproxy/envoy-debug:v1.73.0 -> envoyproxy/envoy:debug-v1.73.0
 > docker buildx imagetools create docker.io/envoyproxy/envoy-debug:v1.73.0 --tag docker.io/envoyproxy/envoy:debug-v1.73.0
 >> TAG: envoyproxy/envoy-debug:v1.73.0 -> envoyproxy/envoy-debug:v1.73-latest
@@ -24,9 +24,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib:v1.73.0
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.0 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.0 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-contrib.tar -> docker://docker.io/envoyproxy/envoy-contrib:v1.73.0
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib:v1.73.0
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib:v1.73.0
 >> TAG: envoyproxy/envoy-contrib:v1.73.0 -> envoyproxy/envoy:contrib-v1.73.0
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib:v1.73.0 --tag docker.io/envoyproxy/envoy:contrib-v1.73.0
 >> TAG: envoyproxy/envoy-contrib:v1.73.0 -> envoyproxy/envoy-contrib:v1.73-latest
@@ -36,7 +36,7 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-contrib-debug:v1.73.0
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-contrib-debug:v1.73.0 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-contrib-debug:v1.73.0 .
 >> TAG: envoyproxy/envoy-contrib-debug:v1.73.0 -> envoyproxy/envoy:contrib-debug-v1.73.0
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib-debug:v1.73.0 --tag docker.io/envoyproxy/envoy:contrib-debug-v1.73.0
 >> TAG: envoyproxy/envoy-contrib-debug:v1.73.0 -> envoyproxy/envoy-contrib-debug:v1.73-latest
@@ -46,9 +46,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless:v1.73.0
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.0 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.0 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-distroless.tar -> docker://docker.io/envoyproxy/envoy-distroless:v1.73.0
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless:v1.73.0
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless:v1.73.0
 >> TAG: envoyproxy/envoy-distroless:v1.73.0 -> envoyproxy/envoy:distroless-v1.73.0
 > docker buildx imagetools create docker.io/envoyproxy/envoy-distroless:v1.73.0 --tag docker.io/envoyproxy/envoy:distroless-v1.73.0
 >> TAG: envoyproxy/envoy-distroless:v1.73.0 -> envoyproxy/envoy-distroless:v1.73-latest
@@ -58,9 +58,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp:v1.73.0
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.0 .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.0 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-google-vrp.tar -> docker://docker.io/envoyproxy/envoy-google-vrp:v1.73.0
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp:v1.73.0
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp:v1.73.0
 >> TAG: envoyproxy/envoy-google-vrp:v1.73.0 -> envoyproxy/envoy:google-vrp-v1.73.0
 > docker buildx imagetools create docker.io/envoyproxy/envoy-google-vrp:v1.73.0 --tag docker.io/envoyproxy/envoy:google-vrp-v1.73.0
 >> TAG: envoyproxy/envoy-google-vrp:v1.73.0 -> envoyproxy/envoy-google-vrp:v1.73-latest
@@ -70,9 +70,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools:v1.73.0
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.0 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.0 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-tools.tar -> docker://docker.io/envoyproxy/envoy-tools:v1.73.0
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools:v1.73.0
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools:v1.73.0
 >> TAG: envoyproxy/envoy-tools:v1.73.0 -> envoyproxy/envoy:tools-v1.73.0
 > docker buildx imagetools create docker.io/envoyproxy/envoy-tools:v1.73.0 --tag docker.io/envoyproxy/envoy:tools-v1.73.0
 >> TAG: envoyproxy/envoy-tools:v1.73.0 -> envoyproxy/envoy-tools:v1.73-latest
diff --git a/ci/test/docker/linux/nondev/other b/ci/test/docker/linux/nondev/other
index 8b3042635a03..36978a8e86a9 100644
--- a/ci/test/docker/linux/nondev/other
+++ b/ci/test/docker/linux/nondev/other
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp:v1.73.3
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.3 .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.3 .
diff --git a/ci/test/docker/linux/nondev/release b/ci/test/docker/linux/nondev/release
index d208c58084c3..4efce8d9c55c 100644
--- a/ci/test/docker/linux/nondev/release
+++ b/ci/test/docker/linux/nondev/release
@@ -6,15 +6,15 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.3 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy.tar -> docker://docker.io/envoyproxy/envoy:v1.73.3
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy:v1.73.3
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy:v1.73.3
 >> TAG: envoyproxy/envoy:v1.73.3 -> envoyproxy/envoy:v1.73-latest
 > docker buildx imagetools create docker.io/envoyproxy/envoy:v1.73.3 --tag docker.io/envoyproxy/envoy:v1.73-latest
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-debug:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-debug:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-debug:v1.73.3 .
 >> TAG: envoyproxy/envoy-debug:v1.73.3 -> envoyproxy/envoy:debug-v1.73.3
 > docker buildx imagetools create docker.io/envoyproxy/envoy-debug:v1.73.3 --tag docker.io/envoyproxy/envoy:debug-v1.73.3
 >> TAG: envoyproxy/envoy-debug:v1.73.3 -> envoyproxy/envoy-debug:v1.73-latest
@@ -24,9 +24,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.3 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-contrib.tar -> docker://docker.io/envoyproxy/envoy-contrib:v1.73.3
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib:v1.73.3
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib:v1.73.3
 >> TAG: envoyproxy/envoy-contrib:v1.73.3 -> envoyproxy/envoy:contrib-v1.73.3
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib:v1.73.3 --tag docker.io/envoyproxy/envoy:contrib-v1.73.3
 >> TAG: envoyproxy/envoy-contrib:v1.73.3 -> envoyproxy/envoy-contrib:v1.73-latest
@@ -36,7 +36,7 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-contrib-debug:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-contrib-debug:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-contrib-debug:v1.73.3 .
 >> TAG: envoyproxy/envoy-contrib-debug:v1.73.3 -> envoyproxy/envoy:contrib-debug-v1.73.3
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib-debug:v1.73.3 --tag docker.io/envoyproxy/envoy:contrib-debug-v1.73.3
 >> TAG: envoyproxy/envoy-contrib-debug:v1.73.3 -> envoyproxy/envoy-contrib-debug:v1.73-latest
@@ -46,9 +46,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.3 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-distroless.tar -> docker://docker.io/envoyproxy/envoy-distroless:v1.73.3
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless:v1.73.3
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless:v1.73.3
 >> TAG: envoyproxy/envoy-distroless:v1.73.3 -> envoyproxy/envoy:distroless-v1.73.3
 > docker buildx imagetools create docker.io/envoyproxy/envoy-distroless:v1.73.3 --tag docker.io/envoyproxy/envoy:distroless-v1.73.3
 >> TAG: envoyproxy/envoy-distroless:v1.73.3 -> envoyproxy/envoy-distroless:v1.73-latest
@@ -58,9 +58,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp:v1.73.3
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.3 .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.3 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-google-vrp.tar -> docker://docker.io/envoyproxy/envoy-google-vrp:v1.73.3
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp:v1.73.3
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp:v1.73.3
 >> TAG: envoyproxy/envoy-google-vrp:v1.73.3 -> envoyproxy/envoy:google-vrp-v1.73.3
 > docker buildx imagetools create docker.io/envoyproxy/envoy-google-vrp:v1.73.3 --tag docker.io/envoyproxy/envoy:google-vrp-v1.73.3
 >> TAG: envoyproxy/envoy-google-vrp:v1.73.3 -> envoyproxy/envoy-google-vrp:v1.73-latest
@@ -70,9 +70,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.3 .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-tools.tar -> docker://docker.io/envoyproxy/envoy-tools:v1.73.3
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools:v1.73.3
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools:v1.73.3
 >> TAG: envoyproxy/envoy-tools:v1.73.3 -> envoyproxy/envoy:tools-v1.73.3
 > docker buildx imagetools create docker.io/envoyproxy/envoy-tools:v1.73.3 --tag docker.io/envoyproxy/envoy:tools-v1.73.3
 >> TAG: envoyproxy/envoy-tools:v1.73.3 -> envoyproxy/envoy-tools:v1.73-latest
diff --git a/ci/test/docker/linux/nondev/tag b/ci/test/docker/linux/nondev/tag
index 8b3042635a03..36978a8e86a9 100644
--- a/ci/test/docker/linux/nondev/tag
+++ b/ci/test/docker/linux/nondev/tag
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp:v1.73.3
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.3 .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp:v1.73.3 .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools:v1.73.3
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.3 .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools:v1.73.3 .