diff --git a/.github/scripts/compute-image-tag.sh b/.github/scripts/compute-image-tag.sh
index d0c9c389..7dbc8b32 100755
--- a/.github/scripts/compute-image-tag.sh
+++ b/.github/scripts/compute-image-tag.sh
@@ -9,7 +9,7 @@
 #
 # Arguments:
 #   version - The version for the tag (e.g., "1877.10.1", "pr-123")
-#   flavor  - The image flavor (e.g., "metal-sci-usi-amd64"). Defaults to "metal-sci-usi-amd64".
+#   flavor  - The image flavor (e.g., "baremetal-sci-usi-amd64"). Defaults to "baremetal-sci-usi-amd64".
 #
 # Environment:
 #   GITHUB_SHA - Git commit SHA (required, set automatically by GitHub Actions)
@@ -22,15 +22,15 @@
 #
 # Examples:
 #   ./compute-image-tag.sh "1877.10.1"
-#   # Output: 1877.10.1-metal-sci-usi-amd64-1877-10-1-abcd1234
+#   # Output: 1877.10.1-baremetal-sci-usi-amd64-1877-10-1-abcd1234
 #
-#   ./compute-image-tag.sh "pr-123" "metal-capi-amd64"
-#   # Output: pr-123-metal-capi-amd64-pr-123-abcd1234
+#   ./compute-image-tag.sh "pr-123" "baremetal-capi-amd64"
+#   # Output: pr-123-baremetal-capi-amd64-pr-123-abcd1234
 
 set -euo pipefail
 
 VERSION="${1:?Error: VERSION argument required}"
-FLAVOR="${2:-metal-sci-usi-amd64}"
+FLAVOR="${2:-baremetal-sci-usi-amd64}"
 
 if [ -z "${GITHUB_SHA:-}" ]; then
     echo "Error: GITHUB_SHA environment variable is required" >&2
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 557291bd..af0d4416 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -42,7 +42,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -82,7 +82,7 @@ jobs:
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       upload_version: ${{ needs.meta.outputs.UPLOAD_VERSION }}
-      flavor_filter: '--include-only "metal-sci_usi-amd64"'
+      flavor_filter: '--include-only "baremetal-sci_usi-amd64"'
     secrets: inherit
 
   test:
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 16815139..3157546e 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@36078a576d0767433423289f2fa217b96cd951c9
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 7e30d2b1..645fa6ba 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@36078a576d0767433423289f2fa217b96cd951c9
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/features/_scicommon/exec.config b/features/_scicommon/exec.config
index c67667e1..5efda446 100755
--- a/features/_scicommon/exec.config
+++ b/features/_scicommon/exec.config
@@ -17,14 +17,14 @@ K8S_VERSION_REPO="${CAPI_VERSION%.*}"
 
 # key can be downloaded liek e.g.
 # curl -fsSL https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/Release.key > pkgs-k8s-io_${K8S_VERSION_REPO}_release.key
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" <"/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key"
+cp "/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
 
 cat <<EOF | tee /etc/apt/sources.list.d/kubernetes-"${K8S_VERSION_REPO}".sources
 Types: deb
 Architectures: amd64
 URIs: https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/
 Suites: /
-Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg
+Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc
 EOF
 
 DEBIAN_FRONTEND=noninteractive apt update -y
diff --git a/features/baremetal b/features/baremetal
new file mode 120000
index 00000000..4add6a30
--- /dev/null
+++ b/features/baremetal
@@ -0,0 +1 @@
+../gardenlinux/features/baremetal
\ No newline at end of file
diff --git a/features/metal3/exec.config b/features/metal3/exec.config
index b15043a1..4fdb8e0f 100755
--- a/features/metal3/exec.config
+++ b/features/metal3/exec.config
@@ -26,7 +26,7 @@ apt-mark hold ${package_name}
 K8S_VERSION=v1.30.7
 K8S_VERSION_REPO="${K8S_VERSION%.*}"
 
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" </builder/features/metal3/pkgs-k8s-io_1.30_release.key
-echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
+cp "/builder/features/metal3/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
 apt update -y
 apt install -y --no-install-recommends "cri-tools=${K8S_VERSION_REPO#v}*"
diff --git a/features/openstackCloud b/features/openstackCloud
new file mode 120000
index 00000000..e0c442e0
--- /dev/null
+++ b/features/openstackCloud
@@ -0,0 +1 @@
+../gardenlinux/features/openstackCloud
\ No newline at end of file
diff --git a/features/openstackMetal b/features/openstackMetal
new file mode 120000
index 00000000..886e5c10
--- /dev/null
+++ b/features/openstackMetal
@@ -0,0 +1 @@
+../gardenlinux/features/openstackMetal
\ No newline at end of file
diff --git a/flavors.yaml b/flavors.yaml
index 5dd93a8a..6edc213d 100644
--- a/flavors.yaml
+++ b/flavors.yaml
@@ -1,5 +1,5 @@
 targets:
-  - name: metal 
+  - name: baremetal
     category: baremetal
     flavors:
       - features:
diff --git a/gardenlinux b/gardenlinux
index 19d89d57..36078a57 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 19d89d573a9c05266f3db9233f4d68aaa131ce12
+Subproject commit 36078a576d0767433423289f2fa217b96cd951c9