diff --git a/Dockerfile-linux.template b/Dockerfile-linux.template
index bcb85f59d..d3fb1624f 100644
--- a/Dockerfile-linux.template
+++ b/Dockerfile-linux.template
@@ -80,10 +80,10 @@ ENV MONGO_PACKAGE=${MONGO_PACKAGE} MONGO_REPO=${MONGO_REPO}
 
 ENV MONGO_MAJOR {{ if env.version != env.rcVersion then "testing" else env.version end }}
 RUN echo "deb [ signed-by=/etc/apt/keyrings/mongodb.asc ] http://$MONGO_REPO/apt/{{ target.image | gsub(":.*$"; "") }} {{ target.suite }}/${MONGO_PACKAGE%-unstable}/$MONGO_MAJOR {{ if target.image | test("^debian") then "main" else "multiverse" end }}" | tee "/etc/apt/sources.list.d/${MONGO_PACKAGE%-unstable}.list"
-{{ if env.version != env.rcVersion and (env.rcVersion | tonumber >= 5) then ( -}}
-{{ if .version | ltrimstr(env.rcVersion) | startswith(".0-") then ( -}}
+{{ if env.version != env.rcVersion then ( -}}
+{{ if .dockerNeedsVersion then ( -}}
 # {{ env.rcVersion }} is not GA, so we need the previous release for mongodb-mongosh and mongodb-database-tools
-RUN echo "deb [ signed-by=/etc/apt/keyrings/mongodb.asc ] http://$MONGO_REPO/apt/{{ target.image | gsub(":.*$"; "") }} {{ target.suite }}/${MONGO_PACKAGE%-unstable}/{{ env.rcVersion | split(".") | .[0] |= (tonumber - 1 | tostring) | join(".") }} {{ if target.image | test("^debian") then "main" else "multiverse" end }}" | tee "/etc/apt/sources.list.d/mongodb-previous.list"
+RUN echo "deb [ signed-by=/etc/apt/keyrings/mongodb.asc ] http://$MONGO_REPO/apt/{{ target.image | gsub(":.*$"; "") }} {{ target.suite }}/${MONGO_PACKAGE%-unstable}/{{ .dockerNeedsVersion }} {{ if target.image | test("^debian") then "main" else "multiverse" end }}" | tee "/etc/apt/sources.list.d/mongodb-previous.list"
 {{ ) else ( -}}
 # add GA repo for mongodb-mongosh and mongodb-database-tools
 RUN echo "deb [ signed-by=/etc/apt/keyrings/mongodb.asc ] http://$MONGO_REPO/apt/{{ target.image | gsub(":.*$"; "") }} {{ target.suite }}/${MONGO_PACKAGE%-unstable}/{{ env.rcVersion }} {{ if target.image | test("^debian") then "main" else "multiverse" end }}" | tee "/etc/apt/sources.list.d/mongodb-{{ env.rcVersion }}.list"
diff --git a/versions.json b/versions.json
index 54a2798e3..341ca9156 100644
--- a/versions.json
+++ b/versions.json
@@ -197,6 +197,7 @@
   "8.0-rc": {
     "changes": "https://jira.mongodb.org/issues/?jql=project%20%3D%20SERVER%20AND%20fixVersion%20%3D%20%228.0.0-rc13%22%20ORDER%20BY%20status%20DESC%2C%20priority%20DESC",
     "date": "07/11/2024",
+    "dockerNeedsVersion": "7.0",
     "githash": "b5271455825d4af9af540e3dd05ae19963355efb",
     "linux": "ubuntu2204",
     "notes": "https://docs.mongodb.org/master/release-notes/8.0/",
diff --git a/versions.sh b/versions.sh
index 73c278eac..7969944b4 100755
--- a/versions.sh
+++ b/versions.sh
@@ -52,7 +52,7 @@ shell="$(
 				"3.6", # April 2021
 				"4.0", # April 2022
 				"4.2", # April 2023
-				null # ... so we can have a trailing comma above, making diffs nicer :trollface:
+				empty
 			] | index($v) | not)
 
 			# filter out so-called "rapid releases": https://docs.mongodb.com/upcoming/reference/versioning/
@@ -62,8 +62,21 @@ shell="$(
 				| ($splitVersion[0] | tonumber) >= 5 and ($splitVersion[1] | tonumber) > 0
 				| not
 			)
+
+			# if a given pre-release version has not had a GA release yet, we need the previous release for mongodb-mongosh and mongodb-database-tools
+			| (.version | rtrimstr("-rc")) as $rcVersion
+			| if .version != $rcVersion and (.meta.version | ltrimstr($rcVersion) | startswith(".0-")) then
+				.meta.dockerNeedsVersion = ($rcVersion | split(".") | .[0] |= (tonumber -1 | tostring) | join("."))
+			else . end
 		]
 
+		# filter the list of "downloads" (targets) down to the set of targets of (M-1).0 if we need that previous version (see "dockerNeedsVersion" above)
+		| (map({ key: .version, value: [ .meta.downloads[].target ] }) | from_entries) as $targets
+		| map(if .meta | has("dockerNeedsVersion") then
+			.meta.dockerNeedsVersion as $needsVersion
+			| .meta.downloads |= map(select(.target as $target | $targets[$needsVersion] | index($target)))
+		else . end)
+
 		# now convert all that data to a basic shell list + map so we can loop over/use it appropriately
 		| "allVersions=( " + (
 			map(.version | ., if endswith("-rc") then empty else . + "-rc" end)
@@ -112,44 +125,38 @@ for version in "${versions[@]}"; do
 	msiSha256="${msiSha256%% *}"
 	export msiUrl msiSha256
 
-	export pgpKeyVersion="${version%-rc}"
-	pgp='[]'
-	if [ "$pgpKeyVersion" != "$version" ]; then
-		# the "testing" repository (used for RCs) has a dedicated PGP key (but still needs the "release" key for the release line)
-		pgp="$(jq -c --argjson pgp "$pgp" '$pgp + [ .dev // error("missing PGP key for dev") ]' pgp-keys.json)"
-
-		# if {{ env.rcVersion }} is not GA, so we need the previous release for mongodb-mongosh and mongodb-database-tools
-		isDotZeroPrerelease="$(_jq -r '.version | ltrimstr(env.pgpKeyVersion) | startswith(".0-")')"
-		if [ "$isDotZeroPrerelease" = 'true' ]; then
-			pgp="$(
-				jq -c --argjson pgp "$pgp" '
-					(env.pgpKeyVersion | split(".") | .[0] |= (tonumber - 1 | tostring) | join(".")) as $previousVersion
-					| $pgp + [ .[$previousVersion] // error("missing PGP key for \($previousVersion)") ]
-				' pgp-keys.json
-			)"
-		fi
-	fi
-	minor="${pgpKeyVersion#*.}" # "4.3" -> "3"
-	if [ "$(( minor % 2 ))" = 1 ]; then
-		pgpKeyVersion="${version%.*}.$(( minor + 1 ))"
-	fi
-	pgp="$(jq -c --argjson pgp "$pgp" '$pgp + [ .[env.pgpKeyVersion] // error("missing PGP key for \(env.pgpKeyVersion)") ]' pgp-keys.json)"
-
 	json="$(
 		{
 			jq <<<"$json" -c .
-			_jq --argjson pgp "$pgp" '{ (env.version): (
-				with_entries(select(.key as $key | [
+			_jq --slurpfile pgpKeys pgp-keys.json '{ (env.version): (
+				$pgpKeys[0] as $pgp
+				| (env.version | rtrimstr("-rc")) as $rcVersion
+				| with_entries(select(.key as $key | [
 					# interesting bits of raw upstream metadata
 					"changes",
 					"date",
 					"githash",
 					"notes",
 					"version",
-					null # ... trailing comma hack
+					"dockerNeedsVersion",
+					empty
 				] | index($key)))
 				+ {
-					pgp: $pgp,
+					pgp: [
+						if env.version != $rcVersion then
+							# the "testing" repository (used for RCs) has a dedicated PGP key (but still needs the "release" key for the release line)
+							$pgp.dev
+						else empty end,
+
+						if .dockerNeedsVersion then
+							# see "dockerNeedsVersion" notes above
+							$pgp[.dockerNeedsVersion]
+						else empty end,
+
+						$pgp[$rcVersion],
+
+						empty
+					],
 					targets: (
 						reduce (
 							.downloads[]