diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad3d607..aa7e5c9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,6 @@ jobs:
         run: |
           strategy="$(GENERATE_STACKBREW_LIBRARY='.github/workflows/fake-gsl.sh' "$BASHBREW_SCRIPTS/github-actions/generate.sh")"
           strategy="$(.github/workflows/munge-build.sh -c <<<"$strategy")"
-          strategy="$(.github/workflows/munge-unstable.sh -c <<<"$strategy")"
 
           EOF="EOF-$RANDOM-$RANDOM-$RANDOM"
           echo "strategy<<$EOF" >> "$GITHUB_OUTPUT"
@@ -65,10 +64,4 @@ jobs:
       - name: '"docker images"'
         run: ${{ matrix.runs.images }}
       - name: Git Diff # see "munge-build.sh"
-        run: |
-          if git diff --exit-code */*/Dockerfile.builder; then # see "hack-unstable.sh" (and "munge-unstable.sh")
-            git diff --exit-code
-          else
-            # for unstable builds, let's leave this in but purely informational (instead of causing CI to fail)
-            git diff
-          fi
+        run: git diff --exit-code
diff --git a/.github/workflows/munge-unstable.sh b/.github/workflows/munge-unstable.sh
deleted file mode 100755
index d70ade1..0000000
--- a/.github/workflows/munge-unstable.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-# see also "hack-unstable.sh"
-jq '
-	.matrix.include += [
-		.matrix.include[]
-		| select(.name | test(" [(].+[)]") | not) # ignore any existing munged builds
-		| select(.os | startswith("windows-") | not)
-		| select(.meta.froms | any(startswith("debian:")))
-		| .name += " (unstable)"
-		| .runs.prepare += ([
-			"./hack-unstable.sh " + (.meta.entries[].directory | @sh),
-			"if git diff --exit-code; then exit 1; fi", # trust, but verify (if hack-unstable did not modify anything, we want to bail quickly)
-			empty
-		] | map("\n" + .) | add)
-		| .runs.pull = "" # pulling images does not make sense here (we just changed them)
-	]
-' "$@"
diff --git a/Dockerfile-builder.template b/Dockerfile-builder.template
index 86c10dc..f78cda5 100644
--- a/Dockerfile-builder.template
+++ b/Dockerfile-builder.template
@@ -17,11 +17,10 @@ RUN set -eux; \
 		tar \
 	;
 {{ ) else ( -}}
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bzip2 \
 		curl \
 		gcc \
@@ -29,15 +28,14 @@ RUN set -eux; \
 		make \
 		patch \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 {{ ) end -}}
 {{ if env.variant == "uclibc" then ( -}}
 
 # grab/use buildroot for its uClibc toolchain
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bc \
 		cpio \
 		dpkg-dev \
@@ -49,7 +47,7 @@ RUN set -eux; \
 		unzip \
 		wget \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # pub   dsa1024 2009-01-15 [SC]
 #       AB07 D806 D2CE 741F B886  EE50 B025 BA8B 59C3 6319
diff --git a/hack-unstable.sh b/hack-unstable.sh
deleted file mode 100755
index 635ecc5..0000000
--- a/hack-unstable.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-if [ "$#" -eq 0 ]; then
-	set -- */*/
-fi
-
-set -x
-
-# This is used to modify "Dockerfile.builder" for architectures that are not (yet) supported by stable releases (notably, riscv64).
-sed -ri \
-	-e 's/^(FROM debian:)[^ -]+/\1unstable/g' \
-	"${@/%//Dockerfile.builder}"
diff --git a/latest-1/glibc/Dockerfile.builder b/latest-1/glibc/Dockerfile.builder
index 69bb06d..46a96e5 100644
--- a/latest-1/glibc/Dockerfile.builder
+++ b/latest-1/glibc/Dockerfile.builder
@@ -4,11 +4,10 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bzip2 \
 		curl \
 		gcc \
@@ -16,7 +15,7 @@ RUN set -eux; \
 		make \
 		patch \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # pub   1024D/ACC9965B 2006-12-12
 #       Key fingerprint = C9E9 416F 76E6 10DB D09D  040F 47B7 0C55 ACC9 965B
diff --git a/latest-1/uclibc/Dockerfile.builder b/latest-1/uclibc/Dockerfile.builder
index 957bfb5..204fd40 100644
--- a/latest-1/uclibc/Dockerfile.builder
+++ b/latest-1/uclibc/Dockerfile.builder
@@ -4,11 +4,10 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bzip2 \
 		curl \
 		gcc \
@@ -16,13 +15,12 @@ RUN set -eux; \
 		make \
 		patch \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # grab/use buildroot for its uClibc toolchain
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bc \
 		cpio \
 		dpkg-dev \
@@ -34,7 +32,7 @@ RUN set -eux; \
 		unzip \
 		wget \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # pub   dsa1024 2009-01-15 [SC]
 #       AB07 D806 D2CE 741F B886  EE50 B025 BA8B 59C3 6319
diff --git a/latest/glibc/Dockerfile.builder b/latest/glibc/Dockerfile.builder
index 5eb92f9..70b1342 100644
--- a/latest/glibc/Dockerfile.builder
+++ b/latest/glibc/Dockerfile.builder
@@ -4,11 +4,10 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bzip2 \
 		curl \
 		gcc \
@@ -16,7 +15,7 @@ RUN set -eux; \
 		make \
 		patch \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # pub   1024D/ACC9965B 2006-12-12
 #       Key fingerprint = C9E9 416F 76E6 10DB D09D  040F 47B7 0C55 ACC9 965B
diff --git a/latest/uclibc/Dockerfile.builder b/latest/uclibc/Dockerfile.builder
index dcd6b16..efb6b66 100644
--- a/latest/uclibc/Dockerfile.builder
+++ b/latest/uclibc/Dockerfile.builder
@@ -4,11 +4,10 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bzip2 \
 		curl \
 		gcc \
@@ -16,13 +15,12 @@ RUN set -eux; \
 		make \
 		patch \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # grab/use buildroot for its uClibc toolchain
 
 RUN set -eux; \
-	apt-get update; \
-	apt-get install -y \
+	apt-get install --update -y \
 		bc \
 		cpio \
 		dpkg-dev \
@@ -34,7 +32,7 @@ RUN set -eux; \
 		unzip \
 		wget \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	apt-get dist-clean
 
 # pub   dsa1024 2009-01-15 [SC]
 #       AB07 D806 D2CE 741F B886  EE50 B025 BA8B 59C3 6319