diff --git a/Jenkinsfile b/Jenkinsfile
index f316b4a93e..6d70ca9321 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -42,10 +42,10 @@ def genBuildStep(LinkedHashMap pkg, String arch) {
             stage("build") {
                 checkout scm
                 sh "make clean"
-                sh "make REF=$branch ${pkg.target}"
+                sh "make REF=$branch ARCH=${arch} ${pkg.target}"
             }
             stage("verify") {
-                sh "make IMAGE=${pkg.image} verify"
+                sh "make IMAGE=${pkg.image} ARCH=${arch} verify"
             }
         }
     }
diff --git a/deb/Makefile b/deb/Makefile
index d2a08ae64d..d65bd11e08 100644
--- a/deb/Makefile
+++ b/deb/Makefile
@@ -22,6 +22,7 @@ BUILD?=DOCKER_BUILDKIT=1 \
 	--build-arg GO_IMAGE=$(GO_IMAGE) \
 	--build-arg COMMON_FILES=$(COMMON_FILES) \
 	-t debbuild-$@/$(ARCH) \
+	--platform linux/$(ARCH) \
 	-f $@/Dockerfile \
 	.
 
@@ -33,6 +34,7 @@ RUN_FLAGS=
 # see https://github.com/docker/docker-ce-packaging/pull/1006#issuecomment-2006878743
 RUN?=docker run --rm \
 	--security-opt seccomp=unconfined \
+	--platform linux/$(ARCH) \
 	-e PLATFORM \
 	-e EPOCH='$(EPOCH)' \
 	-e DEB_VERSION=$(word 1, $(GEN_DEB_VER)) \
diff --git a/rpm/Makefile b/rpm/Makefile
index 81b8fe2db6..da37c205c8 100644
--- a/rpm/Makefile
+++ b/rpm/Makefile
@@ -10,14 +10,19 @@ CLI_GITCOMMIT?=$(shell cd $(realpath $(CURDIR)/../src/github.com/docker/cli) &&
 ENGINE_GITCOMMIT?=$(shell cd $(realpath $(CURDIR)/../src/github.com/docker/docker) && git rev-parse --short HEAD)
 BUILDX_GITCOMMIT?=$(shell cd $(realpath $(CURDIR)/../src/github.com/docker/buildx) && git rev-parse --short HEAD)
 
+ifdef RH_USER
+	RH_FLAGS=--secret id=rh-user,env=RH_USER --secret id=rh-pass,env=RH_PASS
+endif
 ifdef BUILD_IMAGE
 	BUILD_IMAGE_FLAG=--build-arg $(BUILD_IMAGE)
 endif
 BUILD?=DOCKER_BUILDKIT=1 \
 	docker build \
+	$(RH_FLAGS) \
 	$(BUILD_IMAGE_FLAG) \
 	--build-arg GO_IMAGE=$(GO_IMAGE) \
 	-t rpmbuild-$@/$(ARCH) \
+	--platform linux/$(ARCH) \
 	-f $@/Dockerfile \
 	.
 
@@ -48,6 +53,7 @@ RUN_FLAGS=
 # https://github.com/docker/docker-ce-packaging/pull/1006#issuecomment-2006878743
 RUN?=docker run --rm \
 	--security-opt seccomp=unconfined \
+	--platform linux/$(ARCH) \
 	-e PLATFORM \
 	-v $(CURDIR)/rpmbuild/SOURCES:/root/rpmbuild/SOURCES:ro \
 	-v $(CURDIR)/rpmbuild/$@/RPMS:/root/rpmbuild/RPMS \
@@ -57,7 +63,7 @@ RUN?=docker run --rm \
 
 FEDORA_RELEASES ?= fedora-40 fedora-39
 CENTOS_RELEASES ?= centos-9
-RHEL_RELEASES ?=
+RHEL_RELEASES ?= rhel-8 rhel-9
 
 DISTROS := $(FEDORA_RELEASES) $(CENTOS_RELEASES) $(RHEL_RELEASES)
 BUNDLES := $(patsubst %,rpmbuild/bundles-ce-%-$(DPKG_ARCH).tar.gz,$(DISTROS))
diff --git a/rpm/rhel-8/Dockerfile b/rpm/rhel-8/Dockerfile
new file mode 100644
index 0000000000..d1fb559de7
--- /dev/null
+++ b/rpm/rhel-8/Dockerfile
@@ -0,0 +1,44 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_IMAGE
+ARG DISTRO=rhel
+ARG SUITE=8
+ARG BUILD_IMAGE=registry.access.redhat.com/ubi8/ubi
+
+FROM ${GO_IMAGE} AS golang
+
+FROM ${BUILD_IMAGE} AS subscribed-image
+RUN --mount=type=secret,id=rh-user --mount=type=secret,id=rh-pass <<-EOT
+	rm -f /etc/rhsm-host
+
+	if [ ! -f /run/secrets/rh-user ] || [ ! -f /run/secrets/rh-pass ]; then
+		echo "Either RH_USER or RH_PASS is not set. Running build without subscription."
+	else
+		subscription-manager register \
+			--username="$(cat /run/secrets/rh-user)" \
+			--password="$(cat /run/secrets/rh-pass)"
+
+		subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
+		# dnf config-manager --set-enabled codeready-builder-for-rhel-8-$(arch)-rpms
+	fi
+EOT
+
+FROM subscribed-image
+
+ENV GOPROXY=https://proxy.golang.org|direct
+ENV GO111MODULE=off
+ENV GOPATH=/go
+ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
+ENV AUTO_GOPATH 1
+ENV DOCKER_BUILDTAGS exclude_graphdriver_btrfs
+ARG DISTRO
+ARG SUITE
+ENV DISTRO=${DISTRO}
+ENV SUITE=${SUITE}
+
+RUN dnf install -y rpm-build rpmlint
+COPY --link SPECS /root/rpmbuild/SPECS
+RUN dnf builddep -y /root/rpmbuild/SPECS/*.spec
+COPY --link --from=golang /usr/local/go /usr/local/go
+WORKDIR /root/rpmbuild
+ENTRYPOINT ["/bin/rpmbuild"]
diff --git a/rpm/rhel-9/Dockerfile b/rpm/rhel-9/Dockerfile
new file mode 100644
index 0000000000..af1b2d663e
--- /dev/null
+++ b/rpm/rhel-9/Dockerfile
@@ -0,0 +1,44 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_IMAGE
+ARG DISTRO=rhel
+ARG SUITE=9
+ARG BUILD_IMAGE=registry.access.redhat.com/ubi9/ubi
+
+FROM ${GO_IMAGE} AS golang
+
+FROM ${BUILD_IMAGE} AS subscribed-image
+RUN --mount=type=secret,id=rh-user --mount=type=secret,id=rh-pass <<-EOT
+	rm -f /etc/rhsm-host
+
+	if [ ! -f /run/secrets/rh-user ] || [ ! -f /run/secrets/rh-pass ]; then
+		echo "Either RH_USER or RH_PASS is not set. Running build without subscription."
+	else
+		subscription-manager register \
+			--username="$(cat /run/secrets/rh-user)" \
+			--password="$(cat /run/secrets/rh-pass)"
+
+		subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms
+		# dnf config-manager --set-enabled codeready-builder-for-rhel-9-$(arch)-rpms
+	fi
+EOT
+
+FROM subscribed-image
+
+ENV GOPROXY=https://proxy.golang.org|direct
+ENV GO111MODULE=off
+ENV GOPATH=/go
+ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
+ENV AUTO_GOPATH 1
+ENV DOCKER_BUILDTAGS exclude_graphdriver_btrfs
+ARG DISTRO
+ARG SUITE
+ENV DISTRO=${DISTRO}
+ENV SUITE=${SUITE}
+
+RUN dnf install -y rpm-build rpmlint
+COPY --link SPECS /root/rpmbuild/SPECS
+RUN dnf builddep -y /root/rpmbuild/SPECS/*.spec
+COPY --link --from=golang /usr/local/go /usr/local/go
+WORKDIR /root/rpmbuild
+ENTRYPOINT ["/bin/rpmbuild"]