diff --git a/NG.mk b/NG.mk
index 8f3fd86c07308..1636ac98682fc 100644
--- a/NG.mk
+++ b/NG.mk
@@ -281,7 +281,7 @@ ${KUBECTL}:
 protokube: ${PROTOKUBE}
 
 .PHONY: protokube-container
-protokube-container: ${DIST}/${KOPS_RELEASE_VERSION}/images/protokube.tar.gz
+protokube-container: ${DIST}/${KOPS_RELEASE_VERSION}/images/protokube.tar.gz  ${DIST}/${KOPS_RELEASE_VERSION}/images/protokube.tar.gz.sha1
 
 ${DIST}/${KOPS_RELEASE_VERSION}/images/protokube.tar.gz: ${CHANNELS} ${PROTOKUBE} ${KUBECTL}
 	docker build -t protokube:${PROTOKUBE_TAG} -f images/protokube-ng/Dockerfile .
@@ -458,6 +458,10 @@ kops-server-push: kops-server-build
 # -----------------------------------------------------
 # non-phony crossbuild targets
 
+# wildcard target for container images
+${DIST}/${KOPS_RELEASE_VERSION}/images/%.sha1: $(basename $(@F))
+	${SHASUMCMD} $< | cut -d' ' -f1  > $@
+
 # wildcard target for protokube and channels
 ${PROTOKUBE_ARTIFACTS}/%: ${BINDATA_TARGETS}
 	mkdir -p $(@D)
@@ -489,14 +493,14 @@ ${DIST}/${KOPS_RELEASE_VERSION}/$(2)/$(3)/$(1): ${BINDATA_TARGETS}
 endef
 
 # first position on SHA_template is OS, second is architecture
-define SHA_template =
+define SHA_BIN_template =
 ${DIST}/${KOPS_RELEASE_VERSION}/$(1)/$(2)/%.sha1: .build/kops/${KOPS_RELEASE_VERSION}/$(1)/$(2)/%
 	${SHASUMCMD} $$< | cut -d' ' -f1  > $$@
 endef
 
 # SHA targets for Linux and Darwin, amd64 only.
-$(eval $(call SHA_template,linux,amd64))
-$(eval $(call SHA_template,darwin,amd64))
+$(eval $(call SHA_BIN_template,linux,amd64))
+$(eval $(call SHA_BIN_template,darwin,amd64))
 
 # target for every binary listed in LINUX_DIST_BINARIES
 $(foreach bin,$(LINUX_DIST_BINARIES),$(eval $(call BINARY_template,$(bin),linux,amd64)))