diff --git a/docker-bake.hcl b/docker-bake.hcl
index b22bdc7..bf61da8 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -273,6 +273,7 @@ python3-boto3
 python3-botocore
 python3-docutils
 python3-devel
+python3-dnf
 python3-iniparse
 python3-isort
 python3-jsonschema
@@ -308,7 +309,7 @@ target "virtual-osbuild-ci-base" {
         args = {
                 OSB_DNF_PACKAGES = join(",", split("\n", BASE_PACKAGES)),
                 OSB_DNF_GROUPS = join(",", [
-                        "development tools",
+                        "development-tools",
                         "rpm-development-tools",
                 ]),
         }
@@ -364,6 +365,10 @@ EOF
 target "virtual-osbuild-ci-cXs" {
         args = {
                 OSB_DNF_PACKAGES = join(",", setsubtract(split("\n", BASE_PACKAGES), split("\n", CENTOS_REMOVED_PACKAGES))),
+                OSB_DNF_GROUPS = join(",", [
+                        "development tools",
+                        "rpm-development-tools",
+                ]),
                 OSB_PIP_PACKAGES = join(",", [
                         "autopep8",
                         "boto3",
@@ -405,6 +410,8 @@ target "osbuild-ci-c10s-latest" {
         args = {
                 // DNF package list needs no changes so it is inherited
                 OSB_FROM = "quay.io/centos/centos:stream10-development",
+                // Allow DNF to downgrade some packages in the container, otherwise it will fail
+                OSB_DNF_NOBEST = 1,
         }
         tags = concat(
                 mirror("osbuild-ci-c10s", "latest", "", OSB_UNIQUEID),
diff --git a/src/config/google-cloud-sdk.repo b/src/config/google-cloud-sdk.repo
index c53061d..34d6ac8 100644
--- a/src/config/google-cloud-sdk.repo
+++ b/src/config/google-cloud-sdk.repo
@@ -1,6 +1,6 @@
 [google-cloud-sdk]
 name=Google Cloud SDK
-baseurl=https://packages.cloud.google.com/yum/repos/cloud-sdk-el8-x86_64
+baseurl=https://packages.cloud.google.com/yum/repos/cloud-sdk-el9-$basearch
 enabled=1
 gpgcheck=1
 repo_gpgcheck=0
diff --git a/src/images/osbuild-ci.Dockerfile b/src/images/osbuild-ci.Dockerfile
index f76fc66..1ee558c 100644
--- a/src/images/osbuild-ci.Dockerfile
+++ b/src/images/osbuild-ci.Dockerfile
@@ -37,8 +37,9 @@ COPY            src src
 ARG             OSB_DNF_PACKAGES=""
 ARG             OSB_DNF_GROUPS=""
 ARG             OSB_PIP_PACKAGES=""
-ARG             OSB_DNF_ALLOW_ERASING=""
-RUN             ./src/scripts/dnf.sh "${OSB_DNF_PACKAGES}" "${OSB_DNF_GROUPS}" ${OSB_DNF_ALLOW_ERASING}
+ARG             OSB_DNF_ALLOW_ERASING="0"
+ARG             OSB_DNF_NOBEST="0"
+RUN             ./src/scripts/dnf.sh "${OSB_DNF_PACKAGES}" "${OSB_DNF_GROUPS}" "${OSB_DNF_ALLOW_ERASING}" "${OSB_DNF_NOBEST}"
 RUN             ./src/scripts/pip.sh "${OSB_PIP_PACKAGES}"
 COPY            src/scripts/osbuild-ci.sh .
 
diff --git a/src/scripts/dnf.sh b/src/scripts/dnf.sh
index 3a67e44..13b6f3d 100755
--- a/src/scripts/dnf.sh
+++ b/src/scripts/dnf.sh
@@ -26,19 +26,24 @@ if (( $# > 1 )) ; then
         IFS=',' read -r -a OSB_GROUPS <<< "$2"
         IFS=$OSB_IFS
 fi
-if (( $# > 2 )) ; then
-        if [[ ! $3 =~ ^[01]$ ]] ; then
-                echo >&2 "ERROR: invalid value for the third argument '$3'"
-                echo >&2 "       only 0 or 1 are allowed"
-                exit 1
-        fi
+if (( $# > 2 )) && [[ ! $3 =~ ^[01]$ ]] ; then
+        echo >&2 "ERROR: invalid value for the third argument '$3'"
+        echo >&2 "       only 0 or 1 are allowed"
+        exit 1
+fi
+if (( $# > 3 )) && [[ ! $4 =~ ^[01]$ ]] ; then
+        echo >&2 "ERROR: invalid value for the fourth argument '$4'"
+        echo >&2 "       only 0 or 1 are allowed"
+        exit 1
 fi
-if (( $# > 3 )) ; then
+
+if (( $# > 4 )) ; then
         echo >&2 "ERROR: invalid number of arguments"
         exit 1
 fi
 
 ALLOW_ERASING=${3:-0}
+NOBEST=${4:-0}
 
 #
 # Clean all caches so we force a metadata refresh. Then make sure to update
@@ -62,6 +67,17 @@ if [[ "$ALLOW_ERASING" == 1 ]] ; then
         EXTRA_ARGS+=" --allowerasing"
 fi
 
+if [[ "$NOBEST" == 1 ]] ; then
+        EXTRA_ARGS+=" --nobest"
+fi
+
+DNF_VERSION=$(rpm -q --whatprovides dnf --qf "%{VERSION}\n")
+POSITIONAL_OPS_DELIMITER="--"
+# We can't use -- with DNF5 until https://github.com/rpm-software-management/dnf5/issues/1848 is fixed.
+if [[ "${DNF_VERSION%%.*}" -ge 5 ]] ; then
+        POSITIONAL_OPS_DELIMITER=""
+fi
+
 if (( ${#OSB_PACKAGES[@]} )) ; then
         dnf -y \
                 --nodocs \
@@ -69,8 +85,7 @@ if (( ${#OSB_PACKAGES[@]} )) ; then
                 --setopt=install_weak_deps=False \
                 $EXTRA_ARGS \
                 install \
-                -- \
-                        "${OSB_PACKAGES[@]}"
+                $POSITIONAL_OPS_DELIMITER "${OSB_PACKAGES[@]}"
 fi
 
 if (( ${#OSB_GROUPS[@]} )) ; then
@@ -80,8 +95,7 @@ if (( ${#OSB_GROUPS[@]} )) ; then
                 --setopt=install_weak_deps=False \
                 $EXTRA_ARGS \
                 group install \
-                -- \
-                        "${OSB_GROUPS[@]}"
+                $POSITIONAL_OPS_DELIMITER "${OSB_GROUPS[@]}"
 fi
 
 #