diff --git a/.github/workflows/docker-build-check.yml b/.github/workflows/docker-build-check.yml
index 189a2ae59..5dc4b0566 100644
--- a/.github/workflows/docker-build-check.yml
+++ b/.github/workflows/docker-build-check.yml
@@ -6,9 +6,9 @@ name: Docker Build Check
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
 
 env:
   DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }}
diff --git a/.github/workflows/prek-check.yml b/.github/workflows/prek-check.yml
index a1a60394c..20e67e0ea 100644
--- a/.github/workflows/prek-check.yml
+++ b/.github/workflows/prek-check.yml
@@ -6,9 +6,9 @@ name: Prek checks
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
 
 permissions:
   contents: read
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 90155c259..d8df26d12 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -6,9 +6,9 @@ name: Rust checks
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/sdk.yaml b/.github/workflows/sdk.yaml
index 2372ba89e..cb4a71c61 100644
--- a/.github/workflows/sdk.yaml
+++ b/.github/workflows/sdk.yaml
@@ -9,9 +9,9 @@ permissions:
 
 on:
   push:
-    branches: [master, next, dev-*]
+    branches: ['release/**']
   pull_request:
-    branches: [master, next, dev-*]
+    branches: ['release/**']
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/spdx-check.yml b/.github/workflows/spdx-check.yml
index 2839a74bb..9f6b5d4b2 100644
--- a/.github/workflows/spdx-check.yml
+++ b/.github/workflows/spdx-check.yml
@@ -6,19 +6,19 @@ name: SPDX License Check
 
 on:
   push:
-    branches: [ master, main ]
+    branches: [ 'release/**' ]
   pull_request:
-    branches: [ master, main ]
+    branches: [ 'release/**' ]
 
 jobs:
   reuse-lint:
     runs-on: ubuntu-latest
-    
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
-      
+
     - name: REUSE Compliance Check
       uses: fsfe/reuse-action@v5
       with:
-        args: lint
\ No newline at end of file
+        args: lint
diff --git a/.github/workflows/vmm-ui.yml b/.github/workflows/vmm-ui.yml
index 6b2c5c626..52a6eaaec 100644
--- a/.github/workflows/vmm-ui.yml
+++ b/.github/workflows/vmm-ui.yml
@@ -9,9 +9,9 @@ permissions:
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ 'release/**' ]
 
 jobs:
   build:
diff --git a/build/shared/pin-packages.sh b/build/shared/pin-packages.sh
index bb5bc6e27..dbc036ad0 100755
--- a/build/shared/pin-packages.sh
+++ b/build/shared/pin-packages.sh
@@ -22,8 +22,25 @@ if [ -z "$PKG_LIST" ]; then
     exit 1
 fi
 
-echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${SNAPSHOT_DATE} bookworm main" > /etc/apt/sources.list
-echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/${SNAPSHOT_DATE} bookworm-security main" >> /etc/apt/sources.list
+# Detect base image suite (e.g. bookworm, trixie). Different Debian releases
+# ship different sources layouts (legacy sources.list vs deb822
+# sources.list.d/*.sources), so we must wipe both and rewrite from scratch
+# pointing at the frozen snapshot for this exact suite. Otherwise the base
+# image's default live sources stay active and packages drift on every build.
+# shellcheck source=/dev/null
+SUITE=$(. /etc/os-release && echo "${VERSION_CODENAME:-}")
+if [ -z "$SUITE" ]; then
+    echo "could not detect Debian suite from /etc/os-release" >&2
+    exit 1
+fi
+
+rm -f /etc/apt/sources.list
+rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+
+cat > /etc/apt/sources.list <<EOF
+deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${SNAPSHOT_DATE} ${SUITE} main
+deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/${SNAPSHOT_DATE} ${SUITE}-security main
+EOF
 echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/10no-check-valid-until
 
 mkdir -p /etc/apt/preferences.d