diff --git a/Dockerfile-kubepkg b/Dockerfile-kubepkg
index 792167007b6..2b85e3f8f42 100644
--- a/Dockerfile-kubepkg
+++ b/Dockerfile-kubepkg
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.16.7 AS builder
+FROM golang:1.16.7-buster AS builder
 
 ENV GO111MODULE=on
 
diff --git a/Dockerfile-kubepkg-rpm b/Dockerfile-kubepkg-rpm
index cea2c647754..6b7a4849a17 100644
--- a/Dockerfile-kubepkg-rpm
+++ b/Dockerfile-kubepkg-rpm
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.16.7 AS builder
+FROM golang:1.16.7-buster AS builder
 
 ENV GO111MODULE=on
 
diff --git a/cloudbuild-kubepkg.yaml b/cloudbuild-kubepkg.yaml
index 638a7f5eec1..89e28c2be2f 100644
--- a/cloudbuild-kubepkg.yaml
+++ b/cloudbuild-kubepkg.yaml
@@ -2,6 +2,7 @@
 timeout: 1200s
 options:
   substitution_option: ALLOW_LOOSE
+
 steps:
   - name: gcr.io/cloud-builders/docker
     args:
@@ -19,14 +20,19 @@ steps:
     - --tag=$_REGISTRY/kubepkg-rpm:$_GIT_TAG
     - --tag=$_REGISTRY/kubepkg-rpm:latest
     - .
+
 substitutions:
   # _GIT_TAG will be filled with a git-based tag for the image, of the form vYYYYMMDD-hash, and
   # can be used as a substitution
   _GIT_TAG: '12345'
   _PULL_BASE_REF: 'dev'
   _REGISTRY: 'fake.repository/registry-name'
-  # TODO(images): Remove once CI failures are resolved.
-  _CI_FAILURES: 'https://prow.k8s.io/view/gs/kubernetes-jenkins/logs/post-release-push-image-kubepkg/1382830189301469184'
+
+tags:
+- 'kubepkg'
+- ${_GIT_TAG}
+- ${_PULL_BASE_REF}
+
 images:
   - 'gcr.io/$PROJECT_ID/kubepkg:$_GIT_TAG'
   - 'gcr.io/$PROJECT_ID/kubepkg:latest'
diff --git a/cmd/vulndash/Dockerfile b/cmd/vulndash/Dockerfile
index 872c5043a8a..f8e2b4a05cf 100644
--- a/cmd/vulndash/Dockerfile
+++ b/cmd/vulndash/Dockerfile
@@ -14,8 +14,10 @@
 
 # Build the manager binary
 ARG GO_VERSION
+ARG OS_CODENAME
+# TODO(codename): Consider parameterizing in Makefile based on codename
 ARG DISTROLESS_IMAGE
-FROM golang:${GO_VERSION} as builder
+FROM golang:${GO_VERSION}-${OS_CODENAME} as builder
 
 WORKDIR /go/src/k8s.io/release
 
diff --git a/cmd/vulndash/Makefile b/cmd/vulndash/Makefile
index f2dbc8a0a1c..b3eca9dcbba 100644
--- a/cmd/vulndash/Makefile
+++ b/cmd/vulndash/Makefile
@@ -21,7 +21,6 @@ SHELL=/bin/bash -o pipefail
 REGISTRY ?= gcr.io/k8s-staging-artifact-promoter
 IMGNAME = vulndash
 IMAGE_VERSION ?= v0.4.3-7
-CONFIG ?= buster
 
 IMAGE = $(REGISTRY)/$(IMGNAME)
 
@@ -29,8 +28,12 @@ TAG ?= $(shell git describe --tags --always --dirty)
 
 # Build args
 GO_VERSION ?= 1.16.7
+OS_CODENAME ?= buster
 DISTROLESS_IMAGE ?= static-debian10
 
+# Configuration
+CONFIG = $(OS_CODENAME)
+
 PLATFORMS ?= linux/amd64
 
 HOST_GOOS ?= $(shell go env GOOS)
@@ -38,6 +41,7 @@ HOST_GOARCH ?= $(shell go env GOARCH)
 GO_BUILD ?= go build
 
 BUILD_ARGS = --build-arg=GO_VERSION=$(GO_VERSION) \
+             --build-arg=OS_CODENAME=$(OS_CODENAME) \
              --build-arg=DISTROLESS_IMAGE=$(DISTROLESS_IMAGE)
 
 # Ensure support for 'docker buildx' and 'docker manifest' commands
diff --git a/cmd/vulndash/cloudbuild.yaml b/cmd/vulndash/cloudbuild.yaml
index ac597b08f2d..adea9123aec 100644
--- a/cmd/vulndash/cloudbuild.yaml
+++ b/cmd/vulndash/cloudbuild.yaml
@@ -19,6 +19,7 @@ steps:
     - PULL_BASE_REF=$_PULL_BASE_REF
     - IMAGE_VERSION=$_IMAGE_VERSION
     - GO_VERSION=$_GO_VERSION
+    - OS_CODENAME=$_OS_CODENAME
     - DISTROLESS_IMAGE=$_DISTROLESS_IMAGE
     args:
     - '-c'
@@ -33,6 +34,7 @@ substitutions:
   _PULL_BASE_REF: 'dev'
   _IMAGE_VERSION: 'v0.0.0'
   _GO_VERSION: '0.0.0'
+  _OS_CODENAME: 'codename'
   _DISTROLESS_IMAGE: 'static-debian00'
 
 tags:
@@ -41,6 +43,7 @@ tags:
 - ${_PULL_BASE_REF}
 - ${_IMAGE_VERSION}
 - ${_GO_VERSION}
+- ${_OS_CODENAME}
 - ${_DISTROLESS_IMAGE}
 
 images:
diff --git a/cmd/vulndash/variants.yaml b/cmd/vulndash/variants.yaml
index c023528f9db..5aafc6a62e2 100644
--- a/cmd/vulndash/variants.yaml
+++ b/cmd/vulndash/variants.yaml
@@ -2,4 +2,5 @@ variants:
   default:
     IMAGE_VERSION: 'v0.4.3-7'
     GO_VERSION: '1.16.7'
+    OS_CODENAME: 'buster'
     DISTROLESS_IMAGE: 'static-debian10'
diff --git a/dependencies.yaml b/dependencies.yaml
index d7db558e66a..50fa72cb21a 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -55,8 +55,6 @@ dependencies:
   - name: "etcd"
     version: 3.4.13
     refPaths:
-    - path: images/build/cross/Makefile
-      match: ETCD_VERSION\?=v\d+\.\d+.\d+
     - path: images/build/cross/variants.yaml
       match: \d+\.\d+.\d+
 
@@ -65,46 +63,52 @@ dependencies:
     version: 1.16.7
     refPaths:
     - path: Dockerfile-kubepkg
-      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+) AS builder
+      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+)-(bullseye|buster) AS builder
     - path: Dockerfile-kubepkg-rpm
-      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+) AS builder
+      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+)-(bullseye|buster) AS builder
     - path: cmd/vulndash/Makefile
       match: GO_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
     - path: cmd/vulndash/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: images/build/cross/Makefile
-      match: GO_VERSION\?=\d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: GO_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
     - path: images/build/cross/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: images/build/go-runner/Makefile
       match: GO_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
     - path: images/build/go-runner/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: images/releng/ci/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: packages/deb/Dockerfile
-      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+)
+      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+)-(bullseye|buster)
 
   # Golang pre-releases are denoted as `1.y<pre-release stage>.z`
   # Example: go1.16rc1
   #
-  # This entry is a stub of the major and minor version to allow dependency
-  # checks to pass when building Kubernetes using a pre-release of Golang.
-  - name: "golang: <major>.<minor>"
+  # This entry is a stub of the major version to allow dependency checks to
+  # pass when building Kubernetes using a pre-release of Golang.
+  - name: "golang: 1.<major>"
     version: 1.16
     refPaths:
+    - path: images/build/cross/Makefile
+      match: GO_MAJOR_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+    - path: images/build/cross/variants.yaml
+      match: "GO_MAJOR_VERSION: '\\d+.\\d+'"
     - path: images/build/go-runner/Makefile
-      match: GO_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: GO_MAJOR_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+    - path: images/build/go-runner/variants.yaml
+      match: "GO_MAJOR_VERSION: '\\d+.\\d+'"
 
   - name: "golang: after kubernetes/kubernetes update"
     version: 1.16.7
     refPaths:
+    - path: images/releng/k8s-ci-builder/Dockerfile
+      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+)-\${OS_CODENAME} AS builder
     - path: images/releng/k8s-ci-builder/Makefile
       match: GO_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
-    - path: images/releng/k8s-ci-builder/Dockerfile
-      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+) AS builder
     - path: images/releng/k8s-ci-builder/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
 
   - name: "go-runner"
     version: v2.3.1
@@ -112,6 +116,31 @@ dependencies:
     - path: images/build/go-runner/VERSION
 
   # Golang images
+
+  # Represents the targeted Kubernetes version at the time the images
+  # are to be created e.g., 'v1.22.0'
+  #
+  # Note: There is no need to increment the patch version of this variable.
+  #       The reason for the inclusion of the patch version here is to satisfy
+  #       a SemVer regex on the IMAGE_VERSION.
+  #
+  # Example:
+  # - v1.22.0-go1.16-buster.0 satisfies SemVer regex, while:
+  # - v1.22-go1.16-buster.0 does not
+  - name: "Kubernetes version (stable.0)"
+    version: v1.22.0
+    refPaths:
+    - path: images/build/cross/Makefile
+      match: KUBERNETES_VERSION\ \?=\ v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
+    - path: images/build/cross/variants.yaml
+      match: "KUBERNETES_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'"
+
+  - name: "Kubernetes version (next candidate.0)"
+    version: v1.23.0
+    refPaths:
+    - path: images/build/cross/variants.yaml
+      match: "KUBERNETES_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'"
+
   - name: "gcr.io/k8s-staging-releng/releng-ci: image revision"
     version: 0
     refPaths:
@@ -141,39 +170,44 @@ dependencies:
       match: REVISION:\ '\d+'
 
   - name: "k8s.gcr.io/build-image/kube-cross"
-    version: v1.16.7-1
+    version: v1.22.0-go1.16.7-buster.0
     refPaths:
-    - path: images/build/cross/Makefile
-      match: IMAGE_VERSION\ \?=\ v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-([0-9]+)
     - path: images/build/cross/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
+      match: "IMAGE_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'"
 
+  # TODO: Consider capturing this in "golang: 1.<major>" instead
   - name: "k8s.gcr.io/build-image/kube-cross: config variant"
-    version: go1.16
+    version: go1.16-buster
+    refPaths:
+    - path: images/build/cross/variants.yaml
+      match: "CONFIG: 'go\\d+.\\d+-(bullseye|buster)'"
+
+  - name: "k8s.gcr.io/build-image/kube-cross: image revision"
+    version: 0
     refPaths:
     - path: images/build/cross/Makefile
-      match: CONFIG \?= go\d+.\d+
+      match: REVISION \?= \d+
     - path: images/build/cross/variants.yaml
-      match: go\d+.\d+
+      match: REVISION:\ '\d+'
 
   - name: "k8s.gcr.io/build-image/kube-cross: dependents"
     version: v1.16.7-1
     refPaths:
     - path: images/k8s-cloud-builder/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
+      match: "KUBE_CROSS_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)-\\d+'"
 
   # Golang (next candidate)
   - name: "golang (next candidate)"
-    version: 1.17rc2
+    version: 1.17
     refPaths:
     - path: images/build/cross/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: images/build/go-runner/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: images/releng/ci/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
     - path: images/releng/k8s-ci-builder/variants.yaml
-      match: \d+.\d+(alpha|beta|rc)?\.?(\d+)?
+      match: "GO_VERSION: '\\d+.\\d+(alpha|beta|rc)?\\.?(\\d+)?'"
 
   # Golang images (next candidate)
   - name: "gcr.io/k8s-staging-releng/releng-ci: image revision (next candidate)"
@@ -183,10 +217,10 @@ dependencies:
       match: REVISION:\ '\d+'
 
   - name: "k8s.gcr.io/build-image/go-runner (next candidate)"
-    version: v2.3.1-go1.17rc2-buster.0
+    version: v2.3.1-go1.17-buster.0
     refPaths:
     - path: images/build/go-runner/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
+      match: "IMAGE_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'"
 
   - name: "k8s.gcr.io/build-image/go-runner: image revision (next candidate)"
     version: 0
@@ -195,22 +229,23 @@ dependencies:
       match: REVISION:\ '\d+'
 
   - name: "k8s.gcr.io/build-image/kube-cross (next candidate)"
-    version: v1.17.0-rc.2-1
+    version: v1.23.0-go1.17-buster.0
     refPaths:
     - path: images/build/cross/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
+      match: "IMAGE_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'"
 
+  # TODO: Consider capturing this in "golang: 1.<major>" instead
   - name: "k8s.gcr.io/build-image/kube-cross: config variant (next candidate)"
-    version: go1.17
+    version: go1.17-buster
     refPaths:
     - path: images/build/cross/variants.yaml
-      match: go\d+.\d+
+      match: "CONFIG: 'go\\d+.\\d+-(bullseye|buster)'"
 
   - name: "k8s.gcr.io/build-image/kube-cross: dependents (next candidate)"
     version: v1.17.0-rc.2-1
     refPaths:
     - path: images/k8s-cloud-builder/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
+      match: "KUBE_CROSS_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)-\\d+'"
 
   # Golang (for previous release branches)
   - name: "golang (for previous release branches)"
@@ -249,22 +284,23 @@ dependencies:
       match: REVISION:\ '\d+'
 
   - name: "k8s.gcr.io/build-image/kube-cross (for previous release branches)"
-    version: v1.15.15-1
+    version: v1.20.0-go1.15.15-buster.0
     refPaths:
     - path: images/build/cross/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
+      match: "IMAGE_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'"
 
+  # TODO: Consider capturing this in "golang: 1.<major>" instead
   - name: "k8s.gcr.io/build-image/kube-cross: config variant (for previous release branches)"
-    version: go1.15
+    version: go1.15-buster
     refPaths:
     - path: images/build/cross/variants.yaml
-      match: go\d+.\d+
+      match: "CONFIG: 'go\\d+.\\d+-(bullseye|buster)'"
 
   - name: "k8s.gcr.io/build-image/kube-cross: dependents (for previous release branches)"
-    version: v1.15.15-1
+    version: v1.15.15-legacy-1
     refPaths:
     - path: images/k8s-cloud-builder/variants.yaml
-      match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
+      match: "KUBE_CROSS_VERSION: 'v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)-\\d+'"
 
   # golangci-lint
   - name: "golangci-lint"
@@ -274,6 +310,51 @@ dependencies:
       match: VERSION=v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?
 
   # Base images
+  - name: "Debian: codename (default)"
+    version: buster
+    refPaths:
+    # Must match distroless Debian version as well
+    - path: cmd/vulndash/Makefile
+      match: OS_CODENAME\ \?=\ (bullseye|buster)
+    - path: cmd/vulndash/variants.yaml
+      match: "OS_CODENAME: '(bullseye|buster)'"
+    - path: images/build/cross/Makefile
+      match: OS_CODENAME\ \?=\ (bullseye|buster)
+    - path: images/build/cross/variants.yaml
+      match: "OS_CODENAME: '(bullseye|buster)'"
+    # TODO(codename): Uncomment once bullseye is default
+    #- path: images/build/debian-base/Makefile
+    #  match: CONFIG\ \?=\ (bullseye|buster)
+    - path: images/build/debian-base/variants.yaml
+      match: "CONFIG: '(bullseye|buster)'"
+    - path: images/build/debian-iptables/Makefile
+      match: CONFIG\ \?=\ (bullseye|buster)
+    - path: images/build/debian-iptables/variants.yaml
+      match: "CONFIG: '(bullseye|buster)'"
+    # Must match distroless Debian version as well
+    - path: images/build/go-runner/Makefile
+      match: OS_CODENAME\ \?=\ (bullseye|buster)
+    - path: images/build/go-runner/variants.yaml
+      match: "OS_CODENAME: '(bullseye|buster)'"
+    - path: images/build/setcap/Makefile
+      match: CONFIG\ \?=\ (bullseye|buster)
+    - path: images/build/setcap/variants.yaml
+      match: "CONFIG: '(bullseye|buster)'"
+    - path: images/releng/ci/variants.yaml
+      match: "OS_CODENAME: '(bullseye|buster)'"
+    - path: images/releng/k8s-ci-builder/Makefile
+      match: OS_CODENAME\ \?=\ (bullseye|buster)
+    - path: images/releng/k8s-ci-builder/variants.yaml
+      match: "OS_CODENAME: '(bullseye|buster)'"
+    - path: packages/deb/Dockerfile
+      match: FROM golang:\d+.\d+(alpha|beta|rc)?\.?(\d+)-(bullseye|buster)
+
+  - name: "Debian: codename (next)"
+    version: bullseye
+    refPaths:
+    - path: images/build/debian-base/variants.yaml
+      match: "CONFIG: '(bullseye|buster)'"
+
   - name: "k8s.gcr.io/build-image/debian-base"
     version: bullseye-v1.0.0
     refPaths:
diff --git a/images/build/cross/Makefile b/images/build/cross/Makefile
index 6d2b4075482..65590ee2cf0 100644
--- a/images/build/cross/Makefile
+++ b/images/build/cross/Makefile
@@ -16,19 +16,39 @@
 SHELL=/bin/bash -o pipefail
 
 IMGNAME = kube-cross
-IMAGE_VERSION ?= v1.16.7-1
-CONFIG ?= go1.16
+
+# Represents the targeted Kubernetes version at the time the images
+# are to be created e.g., 'v1.22.0'
+#
+# Note: There is no need to increment the patch version of this variable.
+#       The reason for the inclusion of the patch version here is to satisfy
+#       a SemVer regex on the IMAGE_VERSION.
+#
+# Example:
+# - v1.22.0-go1.16-buster.0 satisfies SemVer regex, while:
+# - v1.22-go1.16-buster.0 does not
+KUBERNETES_VERSION ?= v1.22.0
+GO_VERSION ?= 1.16.7
+GO_MAJOR_VERSION ?= 1.16
+OS_CODENAME ?= buster
+REVISION ?= 0
 TYPE ?= default
 
 # Build args
-GO_VERSION?=1.16.7
-BASEIMAGE?=golang:$(GO_VERSION)
-PROTOBUF_VERSION?=3.7.0
-ETCD_VERSION?=v3.4.13
+BASEIMAGE ?= golang:$(GO_VERSION)-$(OS_CODENAME)
+PROTOBUF_VERSION ?= 3.7.0
+# TODO: Remove (along with `go1.15-legacy` variant) once Kubernetes 1.20 is EOL
+ETCD_VERSION ?= v0.0.0
 
 IMAGE = $(REGISTRY)/$(IMGNAME)
 TAG ?= $(shell git describe --tags --always --dirty)
 
+# Configuration
+CONFIG = go$(GO_MAJOR_VERSION)-$(OS_CODENAME)
+BUILD_METADATA = go$(GO_VERSION)-$(OS_CODENAME).$(REVISION)
+
+IMAGE_VERSION = $(KUBERNETES_VERSION)-$(BUILD_METADATA)
+
 # Ensure support for 'docker buildx' and 'docker manifest' commands
 export DOCKER_CLI_EXPERIMENTAL=enabled
 
diff --git a/images/build/cross/canary/Dockerfile b/images/build/cross/canary/Dockerfile
deleted file mode 100644
index d09688f7abd..00000000000
--- a/images/build/cross/canary/Dockerfile
+++ /dev/null
@@ -1,116 +0,0 @@
-# Copyright 2020 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file creates a standard build environment for building cross
-# platform go binary for the architecture kubernetes cares about.
-
-ARG BASEIMAGE
-FROM ${BASEIMAGE}
-
-##------------------------------------------------------------
-# global ARGs & ENVs
-ARG TARGETPLATFORM
-ARG DEBIAN_FRONTEND=noninteractive
-
-ENV GOARM 7
-ENV KUBE_DYNAMIC_CROSSPLATFORMS \
-  arm64 \
-  armhf \
-  i386 \
-  ppc64el \
-  s390x
-
-ENV KUBE_CROSSPLATFORMS \
-  linux/386 \
-  linux/arm linux/arm64 \
-  linux/ppc64le \
-  linux/s390x \
-  darwin/amd64 darwin/386 \
-  windows/amd64 windows/386
-
-##------------------------------------------------------------
-
-# Pre-compile the standard go library when cross-compiling. This is much easier now when we have go1.5+
-RUN targetArch=$(echo $TARGETPLATFORM | cut -f2 -d '/') \
-    && if [ ${targetArch} = "amd64" ]; then \
-    for platform in ${KUBE_CROSSPLATFORMS}; do GOOS=${platform%/*} GOARCH=${platform##*/} go install std; done \
-    && go clean -cache; \
-fi
-
-# Install packages
-RUN apt-get -q update \
-    && apt-get install -qqy \
-        apt-utils \
-        file \
-        jq \
-        patch \
-        rsync \
-        unzip
-
-# Use dynamic cgo linking for architectures other than amd64 for the server platforms
-# To install crossbuild essential for other architectures add the following repository.
-RUN targetArch=$(echo $TARGETPLATFORM | cut -f2 -d '/') \
-  && if [ ${targetArch} = "amd64" ]; then \
-    echo "deb http://archive.ubuntu.com/ubuntu xenial main universe" > /etc/apt/sources.list.d/cgocrosscompiling.list \
-    && apt-key adv --no-tty --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32 \
-    && apt-get update \
-    && apt-get install -y build-essential mingw-w64 \
-    && for platform in ${KUBE_DYNAMIC_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done \
-fi
-
-RUN targetArch=$(echo $TARGETPLATFORM | cut -f2 -d '/') \
-  && if [ ${targetArch} = "arm64" ] || [ ${targetArch} = "ppc64le" ]; then \
-    echo "deb http://ports.ubuntu.com/ubuntu-ports/ xenial main" > /etc/apt/sources.list.d/ports.list \
-    && apt-key adv --no-tty --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32 \
-    && apt-get update \
-    && apt-get install -y build-essential; \
-fi
-
-ARG PROTOBUF_VERSION
-RUN targetArch=$(echo $TARGETPLATFORM | cut -f2 -d '/') \
-  && if [ ${targetArch} = "amd64" ]; then \
-  ZIPNAME="protoc-${PROTOBUF_VERSION}-linux-x86_64.zip"; \
-elif [ ${targetArch} = "arm64" ]; then \
-  ZIPNAME="protoc-${PROTOBUF_VERSION}-linux-aarch_64.zip"; \
-elif [ ${targetArch} = "ppc64le" ]; then \
-  ZIPNAME="protoc-${PROTOBUF_VERSION}-linux-ppcle_64.zip"; \
-fi \
-  && mkdir /tmp/protoc && cd /tmp/protoc \
-  && wget "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VERSION}/${ZIPNAME}" \
-  && unzip "${ZIPNAME}" \
-  && chmod -R +rX /tmp/protoc \
-  && cp -pr bin /usr/local \
-  && cp -pr include /usr/local \
-  && rm -rf /tmp/protoc \
-  && protoc --version
-
-# work around 64MB tmpfs size in Docker 1.6
-ENV TMPDIR /tmp.k8s
-RUN mkdir $TMPDIR \
-  && chmod a+rwx $TMPDIR \
-  && chmod o+t $TMPDIR
-
-# Get the code coverage tool and goimports
-RUN go get golang.org/x/tools/cmd/cover \
-           golang.org/x/tools/cmd/goimports \
-    && go clean -cache
-
-# Cleanup a bit
-RUN apt-get -qqy remove \
-      wget \
-    && apt-get clean \
-    && rm -rf -- \
-        /var/lib/apt/lists/*
-
-ENTRYPOINT []
diff --git a/images/build/cross/cloudbuild.yaml b/images/build/cross/cloudbuild.yaml
index 2457824c1e2..db69b730ffe 100644
--- a/images/build/cross/cloudbuild.yaml
+++ b/images/build/cross/cloudbuild.yaml
@@ -13,8 +13,12 @@ steps:
     - PULL_BASE_REF=$_PULL_BASE_REF
     - CONFIG=$_CONFIG
     - TYPE=$_TYPE
-    - GO_VERSION=$_GO_VERSION
     - IMAGE_VERSION=$_IMAGE_VERSION
+    - KUBERNETES_VERSION=$_KUBERNETES_VERSION
+    - GO_VERSION=$_GO_VERSION
+    - GO_MAJOR_VERSION=$_GO_MAJOR_VERSION
+    - OS_CODENAME=$_OS_CODENAME
+    - REVISION=$_REVISION
     - PROTOBUF_VERSION=$_PROTOBUF_VERSION
     - ETCD_VERSION=$_ETCD_VERSION
     - REGISTRY=$_REGISTRY
@@ -32,10 +36,14 @@ substitutions:
   # can be used as a substitution
   _GIT_TAG: '12345'
   _PULL_BASE_REF: 'dev'
-  _CONFIG: 'go0.0'
+  _CONFIG: 'k8s-go-major-codename'
   _TYPE: 'default'
+  _IMAGE_VERSION: 'v0.0.0-go0.0.0-codename.0'
+  _KUBERNETES_VERSION: 'v0.0.0'
   _GO_VERSION: '0.0.0'
-  _IMAGE_VERSION: 'v0.0.0-0'
+  _GO_MAJOR_VERSION: '0.00'
+  _OS_CODENAME: 'codename'
+  _REVISION: '0'
   _PROTOBUF_VERSION: '0.0.0'
   _ETCD_VERSION: 'v0.0.0'
   _REGISTRY: 'fake.repository/registry-name'
@@ -46,8 +54,12 @@ tags:
 - ${_PULL_BASE_REF}
 - ${_CONFIG}
 - ${_TYPE}
+- ${_KUBERNETES_VERSION}
 - ${_GO_VERSION}
+- ${_GO_MAJOR_VERSION}
+- ${_OS_CODENAME}
 - ${_IMAGE_VERSION}
+- ${_REVISION}
 - ${_PROTOBUF_VERSION}
 - ${_ETCD_VERSION}
 
diff --git a/images/build/cross/default/Dockerfile b/images/build/cross/default/Dockerfile
index 6488a729d52..d09688f7abd 100644
--- a/images/build/cross/default/Dockerfile
+++ b/images/build/cross/default/Dockerfile
@@ -106,15 +106,6 @@ RUN go get golang.org/x/tools/cmd/cover \
            golang.org/x/tools/cmd/goimports \
     && go clean -cache
 
-# Download and symlink etcd. We need this for our integration tests.
-ARG ETCD_VERSION
-RUN targetArch=$(echo $TARGETPLATFORM | cut -f2 -d '/') \
-  && mkdir -p /usr/local/src/etcd \
-  && cd /usr/local/src/etcd \
-  && curl -fsSL https://github.com/coreos/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${targetArch}.tar.gz | tar -xz \
-  && chown -R $(id -u):$(id -g) /usr/local/src/etcd \
-  && ln -s ../src/etcd/etcd-${ETCD_VERSION}-linux-${targetArch}/etcd /usr/local/bin/
-
 # Cleanup a bit
 RUN apt-get -qqy remove \
       wget \
diff --git a/images/build/cross/variants.yaml b/images/build/cross/variants.yaml
index 848b958e7f4..84e5ee07661 100644
--- a/images/build/cross/variants.yaml
+++ b/images/build/cross/variants.yaml
@@ -1,35 +1,34 @@
 variants:
-  canary:
-    TYPE: 'canary'
-    CONFIG: 'canary'
-    GO_VERSION: '1.16.7'
-    IMAGE_VERSION: 'v1.16.7-canary-1'
-    PROTOBUF_VERSION: '3.7.0'
-  go1.17:
+  go1.17-buster:
+    CONFIG: 'go1.17-buster'
     TYPE: 'default'
-    CONFIG: 'go1.17'
-    GO_VERSION: '1.17rc2'
-    IMAGE_VERSION: 'v1.17.0-rc.2-1'
+    IMAGE_VERSION: 'v1.23.0-go1.17-buster.0'
+    KUBERNETES_VERSION: 'v1.23.0'
+    GO_VERSION: '1.17'
+    GO_MAJOR_VERSION: '1.17'
+    OS_CODENAME: 'buster'
+    REVISION: '0'
     PROTOBUF_VERSION: '3.7.0'
-    ETCD_VERSION: 'v3.4.13'
-  go1.16:
+  go1.16-buster:
+    CONFIG: 'go1.16-buster'
     TYPE: 'default'
-    CONFIG: 'go1.16'
+    IMAGE_VERSION: 'v1.22.0-go1.16.7-buster.0'
+    KUBERNETES_VERSION: 'v1.22.0'
     GO_VERSION: '1.16.7'
-    IMAGE_VERSION: 'v1.16.7-1'
-    PROTOBUF_VERSION: '3.7.0'
-    ETCD_VERSION: 'v3.4.13'
-  go1.15:
-    TYPE: 'default'
-    CONFIG: 'go1.15'
-    GO_VERSION: '1.15.15'
-    IMAGE_VERSION: 'v1.15.15-1'
+    GO_MAJOR_VERSION: '1.16'
+    OS_CODENAME: 'buster'
+    REVISION: '0'
     PROTOBUF_VERSION: '3.7.0'
-    ETCD_VERSION: 'v3.4.13'
-  go1.15-legacy:
+
+  # TODO: Remove (along with `ETCD_VERSION` in Makefile) once Kubernetes 1.20 is EOL
+  go1.15-buster:
+    CONFIG: 'go1.15-buster'
     TYPE: 'legacy'
-    CONFIG: 'go1.15'
+    IMAGE_VERSION: 'v1.20.0-go1.15.15-buster.0'
+    KUBERNETES_VERSION: 'v1.20.0'
     GO_VERSION: '1.15.15'
-    IMAGE_VERSION: 'v1.15.15-legacy-1'
+    GO_MAJOR_VERSION: '1.15'
+    OS_CODENAME: 'buster'
+    REVISION: '0'
     PROTOBUF_VERSION: '3.0.2'
     ETCD_VERSION: 'v3.4.13'
diff --git a/images/build/go-runner/Dockerfile b/images/build/go-runner/Dockerfile
index 2ceeecabd0f..78d92ddc4a7 100644
--- a/images/build/go-runner/Dockerfile
+++ b/images/build/go-runner/Dockerfile
@@ -14,8 +14,10 @@
 
 # Build the manager binary
 ARG GO_VERSION
+ARG OS_CODENAME
+# TODO(codename): Consider parameterizing in Makefile based on codename
 ARG DISTROLESS_IMAGE
-FROM golang:${GO_VERSION} as builder
+FROM golang:${GO_VERSION}-${OS_CODENAME} as builder
 WORKDIR /workspace
 
 # Copy the sources
diff --git a/images/build/go-runner/Makefile b/images/build/go-runner/Makefile
index 8ad2fdeb04c..6b2e71628c2 100644
--- a/images/build/go-runner/Makefile
+++ b/images/build/go-runner/Makefile
@@ -17,16 +17,16 @@ include $(CURDIR)/../../Makefile.common-image
 
 IMGNAME = go-runner
 APP_VERSION = $(shell cat VERSION)
-GO_MINOR_VERSION ?= 1.16
-OS_CODENAME ?= buster
+GO_MAJOR_VERSION ?= 1.16
 REVISION ?= 0
 
 # Build args
 GO_VERSION ?= 1.16.7
+OS_CODENAME ?= buster
 DISTROLESS_IMAGE ?= static-debian10
 
 # Configuration
-CONFIG = go$(GO_MINOR_VERSION)-$(OS_CODENAME)
+CONFIG = go$(GO_MAJOR_VERSION)-$(OS_CODENAME)
 BUILD_METADATA = go$(GO_VERSION)-$(OS_CODENAME).$(REVISION)
 
 IMAGE_VERSION = $(APP_VERSION)-$(BUILD_METADATA)
@@ -51,4 +51,5 @@ clean:
 	rm go-runner
 
 BUILD_ARGS = --build-arg=GO_VERSION=$(GO_VERSION) \
+             --build-arg=OS_CODENAME=$(OS_CODENAME) \
              --build-arg=DISTROLESS_IMAGE=$(DISTROLESS_IMAGE)
diff --git a/images/build/go-runner/cloudbuild.yaml b/images/build/go-runner/cloudbuild.yaml
index 653976ac808..3fe9de15b44 100644
--- a/images/build/go-runner/cloudbuild.yaml
+++ b/images/build/go-runner/cloudbuild.yaml
@@ -27,7 +27,7 @@ steps:
     - PULL_BASE_REF=$_PULL_BASE_REF
     - CONFIG=$_CONFIG
     - IMAGE_VERSION=$_IMAGE_VERSION
-    - GO_MINOR_VERSION=$_GO_MINOR_VERSION
+    - GO_MAJOR_VERSION=$_GO_MAJOR_VERSION
     - OS_CODENAME=$_OS_CODENAME
     - REVISION=$_REVISION
     - GO_VERSION=$_GO_VERSION
@@ -43,9 +43,9 @@ substitutions:
   # can be used as a substitution
   _GIT_TAG: '12345'
   _PULL_BASE_REF: 'dev'
-  _CONFIG: 'go-minor-codename'
+  _CONFIG: 'go-major-codename'
   _IMAGE_VERSION: 'v0.0.0-go0.0.0-codename.0'
-  _GO_MINOR_VERSION: '1.16'
+  _GO_MAJOR_VERSION: '1.16'
   _OS_CODENAME: 'codename'
   _REVISION: '0'
   _GO_VERSION: '0.0.0'
@@ -58,7 +58,7 @@ tags:
 - ${_PULL_BASE_REF}
 - ${_CONFIG}
 - ${_IMAGE_VERSION}
-- ${_GO_MINOR_VERSION}
+- ${_GO_MAJOR_VERSION}
 - ${_OS_CODENAME}
 - ${_REVISION}
 - ${_GO_VERSION}
diff --git a/images/build/go-runner/variants.yaml b/images/build/go-runner/variants.yaml
index 12ac3520759..566d6fe7c04 100644
--- a/images/build/go-runner/variants.yaml
+++ b/images/build/go-runner/variants.yaml
@@ -1,16 +1,16 @@
 variants:
   go1.17-buster:
     CONFIG: 'go1.17-buster'
-    IMAGE_VERSION: 'v2.3.1-go1.17rc2-buster.0'
-    GO_MINOR_VERSION: '1.17'
+    IMAGE_VERSION: 'v2.3.1-go1.17-buster.0'
+    GO_MAJOR_VERSION: '1.17'
     OS_CODENAME: 'buster'
     REVISION: '0'
-    GO_VERSION: '1.17rc2'
+    GO_VERSION: '1.17'
     DISTROLESS_IMAGE: 'static-debian10'
   go1.16-buster:
     CONFIG: 'go1.16-buster'
     IMAGE_VERSION: 'v2.3.1-go1.16.7-buster.0'
-    GO_MINOR_VERSION: '1.16'
+    GO_MAJOR_VERSION: '1.16'
     OS_CODENAME: 'buster'
     REVISION: '0'
     GO_VERSION: '1.16.7'
@@ -18,7 +18,7 @@ variants:
   go1.15-buster:
     CONFIG: 'go1.15-buster'
     IMAGE_VERSION: 'v2.3.1-go1.15.15-buster.0'
-    GO_MINOR_VERSION: '1.15'
+    GO_MAJOR_VERSION: '1.15'
     OS_CODENAME: 'buster'
     REVISION: '0'
     GO_VERSION: '1.15.15'
diff --git a/images/releng/ci/Dockerfile b/images/releng/ci/Dockerfile
index 68b6db32071..60ee8da702e 100644
--- a/images/releng/ci/Dockerfile
+++ b/images/releng/ci/Dockerfile
@@ -13,7 +13,8 @@
 # limitations under the License.
 
 ARG GO_VERSION
-FROM golang:${GO_VERSION}
+ARG OS_CODENAME
+FROM golang:${GO_VERSION}-${OS_CODENAME} as builder
 
 RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | \
     tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
diff --git a/images/releng/ci/cloudbuild.yaml b/images/releng/ci/cloudbuild.yaml
index b88a4989f85..ba19a88b297 100644
--- a/images/releng/ci/cloudbuild.yaml
+++ b/images/releng/ci/cloudbuild.yaml
@@ -8,10 +8,11 @@ steps:
     dir: ./images/releng/ci
     args:
       - build
-      - --tag=$_REGISTRY/releng-ci:${_GO_VERSION}-${_REVISION}
+      - --tag=$_REGISTRY/releng-ci:${_GO_VERSION}-${_OS_CODENAME}-${_REVISION}
       - --tag=$_REGISTRY/releng-ci:${_GIT_TAG}-${_CONFIG}
       - --tag=$_REGISTRY/releng-ci:latest-${_CONFIG}
       - --build-arg=GO_VERSION=${_GO_VERSION}
+      - --build-arg=OS_CODENAME=${_OS_CODENAME}
       - .
   - name: gcr.io/gcp-runtimes/container-structure-test
     dir: ./images/releng/ci
@@ -25,8 +26,9 @@ substitutions:
   # vYYYYMMDD-hash, and can be used as a substitution
   _GIT_TAG: '12345'
   _PULL_BASE_REF: 'dev'
-  _CONFIG: 'go0.0'
+  _CONFIG: 'go-major-codename'
   _GO_VERSION: '0.0.0'
+  _OS_CODENAME: 'codename'
   _REVISION: '0'
   _REGISTRY: 'fake.repository/registry-name'
 
@@ -36,9 +38,10 @@ tags:
 - ${_PULL_BASE_REF}
 - ${_CONFIG}
 - ${_GO_VERSION}
+- ${_OS_CODENAME}
 - ${_REVISION}
 
 images:
-  - 'gcr.io/$PROJECT_ID/releng-ci:${_GO_VERSION}-${_REVISION}'
+  - 'gcr.io/$PROJECT_ID/releng-ci:${_GO_VERSION}-${_OS_CODENAME}-${_REVISION}'
   - 'gcr.io/$PROJECT_ID/releng-ci:${_GIT_TAG}-${_CONFIG}'
   - 'gcr.io/$PROJECT_ID/releng-ci:latest-${_CONFIG}'
diff --git a/images/releng/ci/variants.yaml b/images/releng/ci/variants.yaml
index 566a5e2e9e3..f82541d368a 100644
--- a/images/releng/ci/variants.yaml
+++ b/images/releng/ci/variants.yaml
@@ -1,13 +1,16 @@
 variants:
-  go1.17:
-    CONFIG: 'go1.17'
-    GO_VERSION: '1.17rc2'
+  go1.17-buster:
+    CONFIG: 'go1.17-buster'
+    GO_VERSION: '1.17'
+    OS_CODENAME: 'buster'
     REVISION: '0'
-  go1.16:
-    CONFIG: 'go1.16'
+  go1.16-buster:
+    CONFIG: 'go1.16-buster'
     GO_VERSION: '1.16.7'
+    OS_CODENAME: 'buster'
     REVISION: '0'
-  go1.15:
-    CONFIG: 'go1.15'
+  go1.15-buster:
+    CONFIG: 'go1.15-buster'
     GO_VERSION: '1.15.15'
+    OS_CODENAME: 'buster'
     REVISION: '0'
diff --git a/images/releng/k8s-ci-builder/Dockerfile b/images/releng/k8s-ci-builder/Dockerfile
index eb48fb72a5d..fadbde07624 100644
--- a/images/releng/k8s-ci-builder/Dockerfile
+++ b/images/releng/k8s-ci-builder/Dockerfile
@@ -13,11 +13,12 @@
 # limitations under the License.
 
 ARG GO_VERSION
+ARG OS_CODENAME
 ARG OLD_BAZEL_VERSION
 
 # The Golang version for the builder image should always be explicitly set to
 # the Golang version of the kubernetes/kubernetes active development branch
-FROM golang:1.16.7 AS builder
+FROM golang:1.16.7-${OS_CODENAME} AS builder
 
 WORKDIR /go/src/k8s.io/release
 
@@ -33,7 +34,7 @@ RUN ./compile-release-tools
 # supporting kubernetes builds, kind installation, etc.
 
 FROM launcher.gcr.io/google/bazel:${OLD_BAZEL_VERSION} as old-bazel
-FROM debian:buster
+FROM debian:${OS_CODENAME}
 
 # arg that specifies the image name (for debugging)
 ARG IMAGE_ARG
diff --git a/images/releng/k8s-ci-builder/Makefile b/images/releng/k8s-ci-builder/Makefile
index 1f3dbbaa6a0..00b56cd9a8b 100644
--- a/images/releng/k8s-ci-builder/Makefile
+++ b/images/releng/k8s-ci-builder/Makefile
@@ -25,14 +25,16 @@ TAG ?= $(shell git describe --tags --always --dirty)
 
 # Build args
 GO_VERSION ?= 1.16.7
+OS_CODENAME ?= buster
 BAZEL_VERSION ?= 3.4.1
 OLD_BAZEL_VERSION ?= 2.2.0
 IMAGE_ARG ?= $(IMAGE):$(TAG)-$(CONFIG)
 
 BUILD_ARGS = --build-arg=GO_VERSION=$(GO_VERSION) \
-							--build-arg=BAZEL_VERSION=$(BAZEL_VERSION) \
-							--build-arg=OLD_BAZEL_VERSION=$(OLD_BAZEL_VERSION) \
-							--build-arg=IMAGE_ARG=$(IMAGE_ARG)
+             --build-arg=OS_CODENAME=$(OS_CODENAME) \
+			 --build-arg=BAZEL_VERSION=$(BAZEL_VERSION) \
+			 --build-arg=OLD_BAZEL_VERSION=$(OLD_BAZEL_VERSION) \
+			 --build-arg=IMAGE_ARG=$(IMAGE_ARG)
 
 # Ensure support for 'docker buildx' and 'docker manifest' commands
 export DOCKER_CLI_EXPERIMENTAL=enabled
diff --git a/images/releng/k8s-ci-builder/cloudbuild.yaml b/images/releng/k8s-ci-builder/cloudbuild.yaml
index b091f889470..fe5558bd82d 100644
--- a/images/releng/k8s-ci-builder/cloudbuild.yaml
+++ b/images/releng/k8s-ci-builder/cloudbuild.yaml
@@ -23,6 +23,7 @@ steps:
     - PULL_BASE_REF=${_PULL_BASE_REF}
     - CONFIG=${_CONFIG}
     - GO_VERSION=${_GO_VERSION}
+    - OS_CODENAME=${_OS_CODENAME}
     - BAZEL_VERSION=${_BAZEL_VERSION}
     - OLD_BAZEL_VERSION=${_OLD_BAZEL_VERSION}
     args:
@@ -38,6 +39,7 @@ substitutions:
   _PULL_BASE_REF: 'dev'
   _CONFIG: 'config'
   _GO_VERSION: '0.0.0'
+  _OS_CODENAME: 'codename'
   _BAZEL_VERSION: '0.0.0'
   _OLD_BAZEL_VERSION: '0.0.0'
   _REGISTRY: 'fake.repository/registry-name'
@@ -48,6 +50,7 @@ tags:
 - ${_PULL_BASE_REF}
 - ${_CONFIG}
 - ${_GO_VERSION}
+- ${_OS_CODENAME}
 
 images:
   - 'gcr.io/$PROJECT_ID/k8s-ci-builder:${_CONFIG}'
diff --git a/images/releng/k8s-ci-builder/variants.yaml b/images/releng/k8s-ci-builder/variants.yaml
index 9815e3ce981..985077052e7 100644
--- a/images/releng/k8s-ci-builder/variants.yaml
+++ b/images/releng/k8s-ci-builder/variants.yaml
@@ -2,30 +2,36 @@ variants:
   default:
     CONFIG: default
     GO_VERSION: '1.16.7'
+    OS_CODENAME: 'buster'
     BAZEL_VERSION: '3.4.1'
     OLD_BAZEL_VERSION: '2.2.0'
   '1.23':
     CONFIG: '1.23'
-    GO_VERSION: '1.17rc2'
+    GO_VERSION: '1.17'
+    OS_CODENAME: 'buster'
     BAZEL_VERSION: '3.4.1'
     OLD_BAZEL_VERSION: '2.2.0'
   '1.22':
     CONFIG: '1.22'
     GO_VERSION: '1.16.7'
+    OS_CODENAME: 'buster'
     BAZEL_VERSION: '3.4.1'
     OLD_BAZEL_VERSION: '2.2.0'
   '1.21':
     CONFIG: '1.21'
     GO_VERSION: '1.16.7'
+    OS_CODENAME: 'buster'
     BAZEL_VERSION: '3.4.1'
     OLD_BAZEL_VERSION: '2.2.0'
   '1.20':
     CONFIG: '1.20'
     GO_VERSION: '1.15.15'
+    OS_CODENAME: 'buster'
     BAZEL_VERSION: '3.4.1'
     OLD_BAZEL_VERSION: '2.2.0'
   '1.19':
     CONFIG: '1.19'
     GO_VERSION: '1.15.15'
+    OS_CODENAME: 'buster'
     BAZEL_VERSION: '2.2.0'
     OLD_BAZEL_VERSION: '0.23.2'