diff --git a/go.mod b/go.mod
index cdd95d4a2..e4b4296d2 100644
--- a/go.mod
+++ b/go.mod
@@ -30,7 +30,7 @@ require (
 	github.com/getsentry/sentry-go v0.28.1
 	github.com/gobwas/glob v0.2.3
 	github.com/golang-jwt/jwt/v4 v4.5.2
-	github.com/google/go-cmp v0.6.0
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gophercloud/gophercloud v1.14.0
 	github.com/hashicorp/go-retryablehttp v0.7.7
@@ -45,7 +45,7 @@ require (
 	github.com/openshift-online/ocm-sdk-go v0.1.438
 	github.com/oracle/oci-go-sdk/v54 v54.0.0
 	github.com/osbuild/blueprint v1.6.0
-	github.com/osbuild/images v0.137.0
+	github.com/osbuild/images v0.139.0
 	github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20240814102216-0239db53236d
 	github.com/osbuild/pulp-client v0.1.0
 	github.com/prometheus/client_golang v1.20.5
@@ -201,7 +201,7 @@ require (
 	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.2.0 // indirect
 	github.com/opencontainers/selinux v1.11.1 // indirect
 	github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
diff --git a/go.sum b/go.sum
index 39e4a496c..1fa30dd1c 100644
--- a/go.sum
+++ b/go.sum
@@ -337,8 +337,9 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l/DSArMxlbwseo=
 github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
 github.com/google/go-intervals v0.0.2 h1:FGrVEiUnTRKR8yE04qzXYaJMtnIYqobR5QbblK3ixcM=
@@ -565,8 +566,8 @@ github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
 github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
 github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
@@ -577,8 +578,8 @@ github.com/oracle/oci-go-sdk/v54 v54.0.0 h1:CDLjeSejv2aDpElAJrhKpi6zvT/zhZCZuXch
 github.com/oracle/oci-go-sdk/v54 v54.0.0/go.mod h1:+t+yvcFGVp+3ZnztnyxqXfQDsMlq8U25faBLa+mqCMc=
 github.com/osbuild/blueprint v1.6.0 h1:HUV1w/dMxpgqOgVtHhfTZE3zRmWQkuW/qTfx9smKImI=
 github.com/osbuild/blueprint v1.6.0/go.mod h1:0d3dlY8aSJ6jM6NHwBmJFF1VIySsp/GsDpcJQ0yrOqM=
-github.com/osbuild/images v0.137.0 h1:ypC/0BIkyoPbX8tSfobwoVcc4ExlEZVowgu7HbPCNfk=
-github.com/osbuild/images v0.137.0/go.mod h1:Ag87vmyxooiPQBJEDILbypG8/SRIear75YA78NwLix0=
+github.com/osbuild/images v0.139.0 h1:GAbWHI3F+z862d/4yvG+HPV3YesTghaqObhWikROjyU=
+github.com/osbuild/images v0.139.0/go.mod h1:CLuNhj3sO++pzzVzd2hkJ7L3rHzm6XY9zpm+0ERiY6A=
 github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20240814102216-0239db53236d h1:r9BFPDv0uuA9k1947Jybcxs36c/pTywWS1gjeizvtcQ=
 github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20240814102216-0239db53236d/go.mod h1:zR1iu/hOuf+OQNJlk70tju9IqzzM4ycq0ectkFBm94U=
 github.com/osbuild/pulp-client v0.1.0 h1:L0C4ezBJGTamN3BKdv+rKLuq/WxXJbsFwz/Hj7aEmJ8=
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/function/func.go b/vendor/github.com/google/go-cmp/cmp/internal/function/func.go
index d127d4362..def01a6be 100644
--- a/vendor/github.com/google/go-cmp/cmp/internal/function/func.go
+++ b/vendor/github.com/google/go-cmp/cmp/internal/function/func.go
@@ -19,6 +19,7 @@ const (
 
 	tbFunc  // func(T) bool
 	ttbFunc // func(T, T) bool
+	ttiFunc // func(T, T) int
 	trbFunc // func(T, R) bool
 	tibFunc // func(T, I) bool
 	trFunc  // func(T) R
@@ -28,11 +29,13 @@ const (
 	Transformer       = trFunc  // func(T) R
 	ValueFilter       = ttbFunc // func(T, T) bool
 	Less              = ttbFunc // func(T, T) bool
+	Compare           = ttiFunc // func(T, T) int
 	ValuePredicate    = tbFunc  // func(T) bool
 	KeyValuePredicate = trbFunc // func(T, R) bool
 )
 
 var boolType = reflect.TypeOf(true)
+var intType = reflect.TypeOf(0)
 
 // IsType reports whether the reflect.Type is of the specified function type.
 func IsType(t reflect.Type, ft funcType) bool {
@@ -49,6 +52,10 @@ func IsType(t reflect.Type, ft funcType) bool {
 		if ni == 2 && no == 1 && t.In(0) == t.In(1) && t.Out(0) == boolType {
 			return true
 		}
+	case ttiFunc: // func(T, T) int
+		if ni == 2 && no == 1 && t.In(0) == t.In(1) && t.Out(0) == intType {
+			return true
+		}
 	case trbFunc: // func(T, R) bool
 		if ni == 2 && no == 1 && t.Out(0) == boolType {
 			return true
diff --git a/vendor/github.com/google/go-cmp/cmp/options.go b/vendor/github.com/google/go-cmp/cmp/options.go
index 754496f3b..ba3fce81f 100644
--- a/vendor/github.com/google/go-cmp/cmp/options.go
+++ b/vendor/github.com/google/go-cmp/cmp/options.go
@@ -232,7 +232,15 @@ func (validator) apply(s *state, vx, vy reflect.Value) {
 		if t := s.curPath.Index(-2).Type(); t.Name() != "" {
 			// Named type with unexported fields.
 			name = fmt.Sprintf("%q.%v", t.PkgPath(), t.Name()) // e.g., "path/to/package".MyType
-			if _, ok := reflect.New(t).Interface().(error); ok {
+			isProtoMessage := func(t reflect.Type) bool {
+				m, ok := reflect.PointerTo(t).MethodByName("ProtoReflect")
+				return ok && m.Type.NumIn() == 1 && m.Type.NumOut() == 1 &&
+					m.Type.Out(0).PkgPath() == "google.golang.org/protobuf/reflect/protoreflect" &&
+					m.Type.Out(0).Name() == "Message"
+			}
+			if isProtoMessage(t) {
+				help = `consider using "google.golang.org/protobuf/testing/protocmp".Transform to compare proto.Message types`
+			} else if _, ok := reflect.New(t).Interface().(error); ok {
 				help = "consider using cmpopts.EquateErrors to compare error values"
 			} else if t.Comparable() {
 				help = "consider using cmpopts.EquateComparable to compare comparable Go types"
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/version.go b/vendor/github.com/opencontainers/image-spec/specs-go/version.go
index 7069ae44d..c3897c7ca 100644
--- a/vendor/github.com/opencontainers/image-spec/specs-go/version.go
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/version.go
@@ -22,7 +22,7 @@ const (
 	// VersionMinor is for functionality in a backwards-compatible manner
 	VersionMinor = 1
 	// VersionPatch is for backwards-compatible bug fixes
-	VersionPatch = 0
+	VersionPatch = 1
 
 	// VersionDev indicates development branch. Releases will be empty string.
 	VersionDev = ""
diff --git a/vendor/github.com/osbuild/images/internal/workload/custom.go b/vendor/github.com/osbuild/images/internal/workload/custom.go
index ffda0e683..5449a0d9f 100644
--- a/vendor/github.com/osbuild/images/internal/workload/custom.go
+++ b/vendor/github.com/osbuild/images/internal/workload/custom.go
@@ -6,6 +6,7 @@ type Custom struct {
 	EnabledModules   []string
 	Services         []string
 	DisabledServices []string
+	MaskedServices   []string
 }
 
 func (p *Custom) GetPackages() []string {
@@ -20,8 +21,12 @@ func (p *Custom) GetServices() []string {
 	return p.Services
 }
 
-// TODO: Does this belong here? What kind of workload requires
-// services to be disabled?
+// TODO: Do these belong here? What kind of workload requires
+// services to be disabled or masked?
 func (p *Custom) GetDisabledServices() []string {
 	return p.DisabledServices
 }
+
+func (p *Custom) GetMaskedServices() []string {
+	return p.MaskedServices
+}
diff --git a/vendor/github.com/osbuild/images/internal/workload/workload.go b/vendor/github.com/osbuild/images/internal/workload/workload.go
index 64c307186..f6b9216a9 100644
--- a/vendor/github.com/osbuild/images/internal/workload/workload.go
+++ b/vendor/github.com/osbuild/images/internal/workload/workload.go
@@ -8,6 +8,7 @@ type Workload interface {
 	GetRepos() []rpmmd.RepoConfig
 	GetServices() []string
 	GetDisabledServices() []string
+	GetMaskedServices() []string
 }
 
 type BaseWorkload struct {
@@ -33,3 +34,7 @@ func (p BaseWorkload) GetServices() []string {
 func (p BaseWorkload) GetDisabledServices() []string {
 	return []string{}
 }
+
+func (p BaseWorkload) GetMaskedServices() []string {
+	return []string{}
+}
diff --git a/vendor/github.com/osbuild/images/pkg/distro/defs/fedora/distro.yaml b/vendor/github.com/osbuild/images/pkg/distro/defs/fedora/distro.yaml
index 066de3a9a..2ba27a1f9 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/defs/fedora/distro.yaml
+++ b/vendor/github.com/osbuild/images/pkg/distro/defs/fedora/distro.yaml
@@ -272,18 +272,19 @@ image_config:
     timezone: "UTC"
 
 image_types:
-  qcow2: &qcow2
+  server_qcow2: &server_qcow2
     partition_table:
       <<: *default_partition_tables
     package_sets:
-      - *cloud_base_pkgset
-      - include:
-          - "qemu-guest-agent"
-  ami: *qcow2
-  oci: *qcow2
-  openstack: *qcow2
+     - *cloud_base_pkgset
+     - include:
+         - "qemu-guest-agent"
 
-  vhd:
+  server_ami: *server_qcow2
+  server_oci: *server_qcow2
+  server_openstack: *server_qcow2
+
+  server_vhd:
     partition_table:
       <<: *default_partition_tables
     package_sets:
@@ -291,7 +292,7 @@ image_types:
       - include:
           - "WALinuxAgent"
 
-  vmdk: &vmdk
+  server_vmdk: &server_vmdk
     partition_table:
       <<: *default_partition_tables
     package_sets:
@@ -313,7 +314,7 @@ image_types:
           - "grubby-deprecated"
           - "extlinux-bootloader"
 
-  ova: *vmdk
+  server_ova: *server_vmdk
 
   # NOTE: keep in sync with official fedora-iot definitions:
   # https://pagure.io/fedora-iot/ostree/blob/main/f/fedora-iot-base.yaml
@@ -437,7 +438,7 @@ image_types:
 
   iot_container: *iot_commit
 
-  iot_raw_image:
+  iot_raw_xz:
     partition_table:
       <<: *iot_base_partition_tables
     partition_table_override:
@@ -447,7 +448,7 @@ image_types:
             - partition_index: 2
               fstab_options: "defaults,ro"
 
-  iot_qcow2_image:
+  iot_qcow2:
     partition_table:
       <<: *iot_base_partition_tables
 
@@ -722,7 +723,7 @@ image_types:
       - include:
           - "fedora-release-iot"
 
-  live_installer:
+  workstation_live_installer:
     package_sets:
       - include:
           - "@workstation-product-environment"
@@ -754,7 +755,7 @@ image_types:
               include:
                 - "anaconda-webui"
 
-  image_installer: *anaconda
+  minimal_installer: *anaconda
 
   container: &container
     package_sets:
@@ -878,6 +879,7 @@ image_types:
               exclude:
                 - "firewalld"
   minimal_raw_zst: *minimal_raw
+  minimal_raw_xz: *minimal_raw
 
   iot_simplified_installer:
     partition_table:
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
index cda91aebd..e8413bb65 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
@@ -70,14 +70,14 @@ func ostreeDeploymentKernelOptions() []string {
 // Image Definitions
 func mkImageInstallerImgType(d distribution) imageType {
 	return imageType{
-		name:        "image-installer",
-		nameAliases: []string{"fedora-image-installer"},
+		name:        "minimal-installer",
+		nameAliases: []string{"image-installer", "fedora-image-installer"},
 		filename:    "installer.iso",
 		mimeType:    "application/x-iso9660-image",
 		packageSets: map[string]packageSetFunc{
 			osPkgsKey: func(t *imageType) (rpmmd.PackageSet, error) {
 				// use the minimal raw image type for the OS package set
-				return defs.PackageSet(t, "minimal-raw", VersionReplacements())
+				return defs.PackageSet(t, "minimal-raw-xz", VersionReplacements())
 			},
 			installerPkgsKey: packageSetLoader,
 		},
@@ -99,8 +99,8 @@ func mkImageInstallerImgType(d distribution) imageType {
 
 func mkLiveInstallerImgType(d distribution) imageType {
 	return imageType{
-		name:        "live-installer",
-		nameAliases: []string{},
+		name:        "workstation-live-installer",
+		nameAliases: []string{"live-installer"},
 		filename:    "live-installer.iso",
 		mimeType:    "application/x-iso9660-image",
 		packageSets: map[string]packageSetFunc{
@@ -249,8 +249,8 @@ func mkIotSimplifiedInstallerImgType(d distribution) imageType {
 
 func mkIotRawImgType(d distribution) imageType {
 	return imageType{
-		name:        "iot-raw-image",
-		nameAliases: []string{"fedora-iot-raw-image"},
+		name:        "iot-raw-xz",
+		nameAliases: []string{"iot-raw-image", "fedora-iot-raw-image"},
 		filename:    "image.raw.xz",
 		compression: "xz",
 		mimeType:    "application/xz",
@@ -282,7 +282,8 @@ func mkIotRawImgType(d distribution) imageType {
 
 func mkIotQcow2ImgType(d distribution) imageType {
 	return imageType{
-		name:        "iot-qcow2-image",
+		name:        "iot-qcow2",
+		nameAliases: []string{"iot-qcow2-image"}, // kept for backwards compatibility
 		filename:    "image.qcow2",
 		mimeType:    "application/x-qemu-disk",
 		packageSets: map[string]packageSetFunc{},
@@ -309,7 +310,8 @@ func mkIotQcow2ImgType(d distribution) imageType {
 
 func mkQcow2ImgType(d distribution) imageType {
 	return imageType{
-		name:        "qcow2",
+		name:        "server-qcow2",
+		nameAliases: []string{"qcow2"}, // kept for backwards compatibility
 		filename:    "disk.qcow2",
 		mimeType:    "application/x-qemu-disk",
 		environment: &environment.KVM{},
@@ -344,9 +346,10 @@ var (
 
 func mkVmdkImgType(d distribution) imageType {
 	return imageType{
-		name:     "vmdk",
-		filename: "disk.vmdk",
-		mimeType: "application/x-vmdk",
+		name:        "server-vmdk",
+		nameAliases: []string{"vmdk"}, // kept for backwards compatibility
+		filename:    "disk.vmdk",
+		mimeType:    "application/x-vmdk",
 		packageSets: map[string]packageSetFunc{
 			osPkgsKey: packageSetLoader,
 		},
@@ -364,9 +367,10 @@ func mkVmdkImgType(d distribution) imageType {
 
 func mkOvaImgType(d distribution) imageType {
 	return imageType{
-		name:     "ova",
-		filename: "image.ova",
-		mimeType: "application/ovf",
+		name:        "server-ova",
+		nameAliases: []string{"ova"}, // kept for backwards compatibility
+		filename:    "image.ova",
+		mimeType:    "application/ovf",
 		packageSets: map[string]packageSetFunc{
 			osPkgsKey: packageSetLoader,
 		},
@@ -407,9 +411,10 @@ func mkContainerImgType(d distribution) imageType {
 
 func mkWslImgType(d distribution) imageType {
 	return imageType{
-		name:     "wsl",
-		filename: "wsl.tar",
-		mimeType: "application/x-tar",
+		name:        "wsl",
+		nameAliases: []string{"server-wsl"}, // this is the eventual name, and `wsl` the alias but we've been having issues with CI renaming it
+		filename:    "wsl.tar",
+		mimeType:    "application/x-tar",
 		packageSets: map[string]packageSetFunc{
 			osPkgsKey: packageSetLoader,
 		},
@@ -447,7 +452,8 @@ func mkWslImgType(d distribution) imageType {
 
 func mkMinimalRawImgType(d distribution) imageType {
 	it := imageType{
-		name:        "minimal-raw",
+		name:        "minimal-raw-xz",
+		nameAliases: []string{"minimal-raw"}, // kept for backwards compatibility
 		filename:    "disk.raw.xz",
 		compression: "xz",
 		mimeType:    "application/xz",
@@ -691,10 +697,12 @@ func newDistro(version int) distro.Distro {
 	qcow2ImgType := mkQcow2ImgType(rd)
 
 	ociImgType := qcow2ImgType
-	ociImgType.name = "oci"
+	ociImgType.name = "server-oci"
+	ociImgType.nameAliases = []string{"oci"} // kept for backwards compatibility
 
 	amiImgType := qcow2ImgType
-	amiImgType.name = "ami"
+	amiImgType.name = "server-ami"
+	amiImgType.nameAliases = []string{"ami"} // kept for backwards compatibility
 	amiImgType.filename = "image.raw"
 	amiImgType.mimeType = "application/octet-stream"
 	amiImgType.payloadPipelines = []string{"os", "image"}
@@ -702,10 +710,12 @@ func newDistro(version int) distro.Distro {
 	amiImgType.environment = &environment.EC2{}
 
 	openstackImgType := qcow2ImgType
-	openstackImgType.name = "openstack"
+	openstackImgType.name = "server-openstack"
+	openstackImgType.nameAliases = []string{"openstack"} // kept for backwards compatibility
 
 	vhdImgType := qcow2ImgType
-	vhdImgType.name = "vhd"
+	vhdImgType.name = "server-vhd"
+	vhdImgType.nameAliases = []string{"vhd"} // kept for backwards compatibility
 	vhdImgType.filename = "disk.vhd"
 	vhdImgType.mimeType = "application/x-vhd"
 	vhdImgType.payloadPipelines = []string{"os", "image", "vpc"}
@@ -725,6 +735,7 @@ func newDistro(version int) distro.Distro {
 
 	minimalrawZstdImgType := mkMinimalRawImgType(rd)
 	minimalrawZstdImgType.name = "minimal-raw-zst"
+	minimalrawZstdImgType.nameAliases = []string{}
 	minimalrawZstdImgType.filename = "disk.raw.zst"
 	minimalrawZstdImgType.mimeType = "application/zstd"
 	minimalrawZstdImgType.compression = "zstd"
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
index 1159e8b3e..91e07cb79 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
@@ -286,6 +286,7 @@ func (t *imageType) Manifest(bp *blueprint.Blueprint,
 		if services := bp.Customizations.GetServices(); services != nil {
 			cw.Services = services.Enabled
 			cw.DisabledServices = services.Disabled
+			cw.MaskedServices = services.Masked
 		}
 		w = cw
 	}
@@ -361,7 +362,7 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 		}
 	}
 
-	if t.name == "iot-raw-image" || t.name == "iot-qcow2-image" {
+	if t.name == "iot-raw-xz" || t.name == "iot-qcow2" {
 		allowed := []string{"User", "Group", "Directories", "Files", "Services", "FIPS"}
 		if err := customizations.CheckAllowed(allowed...); err != nil {
 			return warnings, fmt.Errorf(distro.UnsupportedCustomizationError, t.name, strings.Join(allowed, ", "))
@@ -410,13 +411,13 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 					return warnings, fmt.Errorf("ignition.firstboot requires a provisioning url")
 				}
 			}
-		} else if t.name == "iot-installer" || t.name == "image-installer" {
+		} else if t.name == "iot-installer" || t.name == "minimal-installer" {
 			// "Installer" is actually not allowed for image-installer right now, but this is checked at the end
 			allowed := []string{"User", "Group", "FIPS", "Installer", "Timezone", "Locale"}
 			if err := customizations.CheckAllowed(allowed...); err != nil {
 				return warnings, fmt.Errorf(distro.UnsupportedCustomizationError, t.name, strings.Join(allowed, ", "))
 			}
-		} else if t.name == "live-installer" {
+		} else if t.name == "workstation-live-installer" {
 			allowed := []string{"Installer"}
 			if err := customizations.CheckAllowed(allowed...); err != nil {
 				return warnings, fmt.Errorf(distro.NoCustomizationsAllowedError, t.name)
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/rhel/imagetype.go
index 42b739ae4..9b6271e72 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel/imagetype.go
@@ -353,6 +353,7 @@ func (t *ImageType) Manifest(bp *blueprint.Blueprint,
 		if services := bp.Customizations.GetServices(); services != nil {
 			cw.Services = services.Enabled
 			cw.DisabledServices = services.Disabled
+			cw.MaskedServices = services.Masked
 		}
 		w = cw
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/azure.go b/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/azure.go
index 08e5bfede..dfab61fb1 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/azure.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/azure.go
@@ -16,7 +16,7 @@ import (
 )
 
 // Azure image type
-func mkAzureImgType(rd *rhel.Distribution) *rhel.ImageType {
+func mkAzureImgType(rd *rhel.Distribution, a arch.Arch) *rhel.ImageType {
 	it := rhel.NewImageType(
 		"vhd",
 		"disk.vhd",
@@ -30,7 +30,7 @@ func mkAzureImgType(rd *rhel.Distribution) *rhel.ImageType {
 		[]string{"vpc"},
 	)
 
-	it.KernelOptions = defaultAzureKernelOptions(rd)
+	it.KernelOptions = defaultAzureKernelOptions(rd, a)
 	it.Bootable = true
 	it.DefaultSize = 4 * datasizes.GibiByte
 	it.DefaultImageConfig = defaultAzureImageConfig(rd)
@@ -40,7 +40,7 @@ func mkAzureImgType(rd *rhel.Distribution) *rhel.ImageType {
 }
 
 // Azure RHEL-internal image type
-func mkAzureInternalImgType(rd *rhel.Distribution) *rhel.ImageType {
+func mkAzureInternalImgType(rd *rhel.Distribution, a arch.Arch) *rhel.ImageType {
 	it := rhel.NewImageType(
 		"azure-rhui",
 		"disk.vhd.xz",
@@ -55,7 +55,7 @@ func mkAzureInternalImgType(rd *rhel.Distribution) *rhel.ImageType {
 	)
 
 	it.Compression = "xz"
-	it.KernelOptions = defaultAzureKernelOptions(rd)
+	it.KernelOptions = defaultAzureKernelOptions(rd, a)
 	it.Bootable = true
 	it.DefaultSize = 64 * datasizes.GibiByte
 	it.DefaultImageConfig = defaultAzureImageConfig(rd)
@@ -64,7 +64,7 @@ func mkAzureInternalImgType(rd *rhel.Distribution) *rhel.ImageType {
 	return it
 }
 
-func mkAzureSapInternalImgType(rd *rhel.Distribution) *rhel.ImageType {
+func mkAzureSapInternalImgType(rd *rhel.Distribution, a arch.Arch) *rhel.ImageType {
 	it := rhel.NewImageType(
 		"azure-sap-rhui",
 		"disk.vhd.xz",
@@ -79,7 +79,7 @@ func mkAzureSapInternalImgType(rd *rhel.Distribution) *rhel.ImageType {
 	)
 
 	it.Compression = "xz"
-	it.KernelOptions = defaultAzureKernelOptions(rd)
+	it.KernelOptions = defaultAzureKernelOptions(rd, a)
 	it.Bootable = true
 	it.DefaultSize = 64 * datasizes.GibiByte
 	it.DefaultImageConfig = sapAzureImageConfig(rd)
@@ -324,10 +324,16 @@ func azureInternalBasePartitionTables(t *rhel.ImageType) (disk.PartitionTable, b
 // IMAGE CONFIG
 
 // use loglevel=3 as described in the RHEL documentation and used in existing RHEL images built by MSFT
-func defaultAzureKernelOptions(rd *rhel.Distribution) []string {
-	kargs := []string{"ro", "loglevel=3", "console=tty1", "console=ttyS0", "earlyprintk=ttyS0", "rootdelay=300"}
+func defaultAzureKernelOptions(rd *rhel.Distribution, a arch.Arch) []string {
+	kargs := []string{"ro", "loglevel=3"}
+	switch a {
+	case arch.ARCH_AARCH64:
+		kargs = append(kargs, "console=ttyAMA0")
+	case arch.ARCH_X86_64:
+		kargs = append(kargs, "console=tty1", "console=ttyS0", "earlyprintk=ttyS0", "rootdelay=300")
+	}
 	if rd.IsRHEL() && common.VersionGreaterThanOrEqual(rd.OsVersion(), "9.6") {
-		kargs = append(kargs, "nvme_core.io_timeout=240")
+		kargs = append(kargs, "nvme_core.io_timeout=240", "net.ifnames=0")
 	}
 	return kargs
 }
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/distro.go b/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/distro.go
index d60356f54..749994f58 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel/rhel9/distro.go
@@ -229,8 +229,8 @@ func newDistro(name string, major, minor int) *rhel.Distribution {
 		},
 	}
 
-	x86_64.AddImageTypes(azureX64Platform, mkAzureImgType(rd))
-	aarch64.AddImageTypes(azureAarch64Platform, mkAzureImgType(rd))
+	x86_64.AddImageTypes(azureX64Platform, mkAzureImgType(rd, azureX64Platform.GetArch()))
+	aarch64.AddImageTypes(azureAarch64Platform, mkAzureImgType(rd, azureAarch64Platform.GetArch()))
 
 	gceX86Platform := &platform.X86{
 		UEFIVendor: rd.Vendor(),
@@ -329,10 +329,10 @@ func newDistro(name string, major, minor int) *rhel.Distribution {
 	)
 
 	if rd.IsRHEL() { // RHEL-only (non-CentOS) image types
-		x86_64.AddImageTypes(azureX64Platform, mkAzureInternalImgType(rd))
-		aarch64.AddImageTypes(azureAarch64Platform, mkAzureInternalImgType(rd))
+		x86_64.AddImageTypes(azureX64Platform, mkAzureInternalImgType(rd, azureX64Platform.GetArch()))
+		aarch64.AddImageTypes(azureAarch64Platform, mkAzureInternalImgType(rd, azureAarch64Platform.GetArch()))
 
-		x86_64.AddImageTypes(azureX64Platform, mkAzureSapInternalImgType(rd))
+		x86_64.AddImageTypes(azureX64Platform, mkAzureSapInternalImgType(rd, azureX64Platform.GetArch()))
 
 		// add ec2 image types to RHEL distro only
 		x86_64.AddImageTypes(ec2X86Platform, mkEc2ImgTypeX86_64(), mkEc2HaImgTypeX86_64(), mkEC2SapImgTypeX86_64(rd.OsVersion()))
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/os.go b/vendor/github.com/osbuild/images/pkg/manifest/os.go
index ad2c4522e..52c4b2038 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/os.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/os.go
@@ -848,6 +848,7 @@ func (p *OS) serialize() osbuild.Pipeline {
 	if p.Workload != nil {
 		enabledServices = append(enabledServices, p.Workload.GetServices()...)
 		disabledServices = append(disabledServices, p.Workload.GetDisabledServices()...)
+		maskedServices = append(maskedServices, p.Workload.GetMaskedServices()...)
 	}
 	if len(enabledServices) != 0 ||
 		len(disabledServices) != 0 ||
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 67f12d704..d5499c3b2 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -762,8 +762,8 @@ github.com/golang/groupcache/lru
 # github.com/golang/protobuf v1.5.4
 ## explicit; go 1.17
 github.com/golang/protobuf/proto
-# github.com/google/go-cmp v0.6.0
-## explicit; go 1.13
+# github.com/google/go-cmp v0.7.0
+## explicit; go 1.21
 github.com/google/go-cmp/cmp
 github.com/google/go-cmp/cmp/internal/diff
 github.com/google/go-cmp/cmp/internal/flags
@@ -1017,7 +1017,7 @@ github.com/oklog/ulid
 # github.com/opencontainers/go-digest v1.0.0
 ## explicit; go 1.13
 github.com/opencontainers/go-digest
-# github.com/opencontainers/image-spec v1.1.0
+# github.com/opencontainers/image-spec v1.1.1
 ## explicit; go 1.18
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
@@ -1049,7 +1049,7 @@ github.com/oracle/oci-go-sdk/v54/workrequests
 ## explicit; go 1.22.8
 github.com/osbuild/blueprint/internal/common
 github.com/osbuild/blueprint/pkg/blueprint
-# github.com/osbuild/images v0.137.0
+# github.com/osbuild/images v0.139.0
 ## explicit; go 1.22.8
 github.com/osbuild/images/data/dependencies
 github.com/osbuild/images/data/repositories