diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 42755c22..4ad4b522 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -62,8 +62,9 @@ jobs:
           load: true
           build-args: |
             TOOLS_DEB=${{ env.TOOLS_DEB }}
-            LINUX_SOURCES_VERSION=${{ env.LINUX_SOURCES_VERSION }}
-            LINUX_SOURCES_URLPATH=${{ env.LINUX_SOURCES_URLPATH }}
+            IMAGE_KERNEL_VERSION=${{ env.IMAGE_KERNEL_VERSION }}
+            LINUX_VERSION=${{ env.LINUX_VERSION }}
+            LINUX_HEADERS_URLPATH=${{ env.LINUX_HEADERS_URLPATH }}
           cache-from: type=gha,scope=regular,mode=max
           cache-to: type=gha,scope=regular
 
@@ -84,6 +85,7 @@ jobs:
           path: ${{ env.TOOLS_ROOTFS }}
 
       - name: Checksum artifacts
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
           sha512sum ${{ env.TOOLS_DEB }} > ${{ env.TOOLS_DEB }}.sha512
           sha512sum ${{ env.TOOLS_ROOTFS }} > ${{ env.TOOLS_ROOTFS }}.sha512
diff --git a/Dockerfile b/Dockerfile
index 1cfcd5aa..1048a5e9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,12 +15,15 @@
 #
 
 FROM --platform=linux/riscv64 riscv64/ubuntu:22.04 as tools-env
-ARG LINUX_SOURCES_VERSION=6.5.9-ctsi-1
-ARG LINUX_SOURCES_URLPATH=https://github.com/cartesi/linux/archive/refs/tags/v${LINUX_SOURCES_VERSION}.tar.gz
+ARG IMAGE_KERNEL_VERSION=v0.19.0
+ARG LINUX_VERSION=6.5.9-ctsi-1
+ARG LINUX_HEADERS_URLPATH=https://github.com/cartesi/image-kernel/releases/download/${IMAGE_KERNEL_VERSION}/linux-libc-dev-${LINUX_VERSION}-${IMAGE_KERNEL_VERSION}.deb
 ARG BUILD_BASE=/opt/cartesi
 
-# apt
+# Install dependencies
 # ------------------------------------------------------------------------------
+ENV LINUX_HEADERS_FILEPATH=/tmp/linux-libc-dev-${LINUX_VERSION}-${IMAGE_KERNEL_VERSION}.deb
+
 RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
     apt-get upgrade -y && \
     apt-get install -y --no-install-recommends \
@@ -32,18 +35,11 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
       wget \
       rust-all=1.58.1+dfsg1~ubuntu1-0ubuntu2 \
       && \
+    wget -O ${LINUX_HEADERS_FILEPATH} ${LINUX_HEADERS_URLPATH} && \
+    echo "aace918b830ee2d682c329b3361a3458ebc42ba5193ccb821fd0b2071ac821b3  ${LINUX_HEADERS_FILEPATH}" | sha256sum --check && \
+    apt-get install -y --no-install-recommends ${LINUX_HEADERS_FILEPATH} && \
     mkdir -p ${BUILD_BASE} && \
-    rm -rf /var/lib/apt/lists/*
-
-# copy & extract kernel headers
-# TODO: Fix apt database entry for linux-headers (it is satisfied here)
-# ------------------------------------------------------------------------------
-ENV LINUX_SOURCES_FILEPATH=/tmp/linux-${LINUX_SOURCES_VERSION}.tar.gz
-RUN wget -O ${LINUX_SOURCES_FILEPATH} ${LINUX_SOURCES_URLPATH} && \
-  echo "bfc4d196b90592a2a6bef83ead9e196da6ab6d5978b48ee5e8ccf02913355bc2  ${LINUX_SOURCES_FILEPATH}" | sha256sum --check && \
-  tar xzf ${LINUX_SOURCES_FILEPATH} -C ${BUILD_BASE}/ && \
-  make -C ${BUILD_BASE}/linux-${LINUX_SOURCES_VERSION} headers_install INSTALL_HDR_PATH=/usr && \
-  rm -f {LINUX_SOURCES_FILEPATH}
+    rm -rf /var/lib/apt/lists/* ${LINUX_HEADERS_FILEPATH}
 
 FROM tools-env as builder
 COPY linux/ ${BUILD_BASE}/tools/linux/
diff --git a/Makefile b/Makefile
index cac516f4..9809488b 100644
--- a/Makefile
+++ b/Makefile
@@ -24,8 +24,9 @@ TOOLS_DEB     := machine-emulator-tools-v$(VERSION).deb
 TOOLS_IMAGE   := cartesi/machine-emulator-tools:$(VERSION)
 TOOLS_ROOTFS  := rootfs-tools-v$(VERSION).ext2
 
-LINUX_SOURCES_VERSION  ?= 6.5.9-ctsi-1
-LINUX_SOURCES_URLPATH  := https://github.com/cartesi/linux/archive/refs/tags/v$(LINUX_SOURCES_VERSION).tar.gz
+IMAGE_KERNEL_VERSION ?= v0.19.0
+LINUX_VERSION ?= 6.5.9-ctsi-1
+LINUX_HEADERS_URLPATH := https://github.com/cartesi/image-kernel/releases/download/${IMAGE_KERNEL_VERSION}/linux-libc-dev-${LINUX_VERSION}-${IMAGE_KERNEL_VERSION}.deb
 
 all: $(TOOLS_DEB)
 
@@ -33,10 +34,11 @@ build: control
 	@if ! (docker image inspect "$(TOOLS_IMAGE)" >/dev/null 2>&1) || [[ "$(force)" == "true" ]]; then \
 		docker buildx build --platform=linux/riscv64 --load \
 			--build-arg TOOLS_DEB=$(TOOLS_DEB) \
-			--build-arg LINUX_SOURCES_VERSION=$(LINUX_SOURCES_VERSION) \
-			--build-arg LINUX_SOURCES_URLPATH=$(LINUX_SOURCES_URLPATH) \
+			--build-arg IMAGE_KERNEL_VERSION=$(IMAGE_KERNEL_VERSION) \
+			--build-arg LINUX_VERSION=$(LINUX_VERSION) \
+			--build-arg LINUX_HEADERS_URLPATH=$(LINUX_HEADERS_URLPATH) \
 			-t $(TOOLS_IMAGE) \
-			-f $< \
+			-f Dockerfile \
 			. ; \
 	fi
 	@$(MAKE) copy
@@ -66,8 +68,9 @@ env:
 	@echo TOOLS_DEB=$(TOOLS_DEB)
 	@echo TOOLS_ROOTFS=$(TOOLS_ROOTFS)
 	@echo TOOLS_IMAGE=$(TOOLS_IMAGE)
-	@echo LINUX_SOURCES_VERSION=$(LINUX_SOURCES_VERSION)
-	@echo LINUX_SOURCES_URLPATH=$(LINUX_SOURCES_URLPATH)
+	@echo IMAGE_KERNEL_VERSION=$(IMAGE_KERNEL_VERSION)
+	@echo LINUX_VERSION=$(LINUX_VERSION)
+	@echo LINUX_HEADERS_URLPATH=$(LINUX_HEADERS_URLPATH)
 
 setup:
 	@docker run --privileged --rm  linuxkit/binfmt:bebbae0c1100ebf7bf2ad4dfb9dfd719cf0ef132