diff --git a/hack/allow-insecure.tar b/hack/allow-insecure.tar
new file mode 100644
index 00000000..50cae25f
Binary files /dev/null and b/hack/allow-insecure.tar differ
diff --git a/hack/setup-testing-images.sh b/hack/setup-testing-images.sh
index 28aef0dc..d67c8f1a 100755
--- a/hack/setup-testing-images.sh
+++ b/hack/setup-testing-images.sh
@@ -11,8 +11,9 @@ ko build --tags "latest" -B ./cmd/func
 
 # Build custom buildah image for tests.
 # This image will accept registries ending with .cluster.local as insecure (non-TLS).
-docker build . -f - -t localhost:50000/buildah/stable:v1.31.0 <<EOF
-FROM quay.io/buildah/stable:v1.31.0
-RUN echo -e '\n[[registry]]\nprefix = "*.cluster.local"\ninsecure = true' >> '/etc/containers/registries.conf'
-EOF
-docker push localhost:50000/buildah/stable:v1.31.0
+go install github.com/google/go-containerregistry/cmd/crane@latest
+crane append --base=quay.io/buildah/stable:v1.31.0 \
+             --new_layer="$(dirname "$0")/allow-insecure.tar" \
+             --new_tag=quay.io/buildah/stable:v1.31.0 \
+             --output=/dev/stdout | \
+  docker exec -i func-control-plane ctr -n=k8s.io images import -