diff --git a/.github/workflows/docker-build-check.yml b/.github/workflows/docker-build-check.yml
index fabe7f698..dea57269c 100644
--- a/.github/workflows/docker-build-check.yml
+++ b/.github/workflows/docker-build-check.yml
@@ -88,6 +88,11 @@ jobs:
             DSTACK_REV=${{ env.DSTACK_REV }}
             DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}
 
+      - name: Verify pinned packages
+        run: |
+          dstack/build/shared/verify-pinned-packages.sh dstack-kms-check:latest \
+            dstack/kms/dstack-app/builder/shared/pinned-packages.txt
+
       - name: Build kms-builder target
         run: |
           docker buildx build \
diff --git a/REUSE.toml b/REUSE.toml
index 3be5549c2..19f85e769 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -48,6 +48,7 @@ path = [
     "sdk/go/go.sum",
     "sdk/go/ratls/go.sum",
     "dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt",
+    "dstack/kms/dstack-app/builder/shared/pinned-packages.txt",
     "dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt",
     "dstack/gateway/dstack-app/builder/shared/pinned-packages.txt",
 ]
diff --git a/dstack/kms/dstack-app/builder/Dockerfile b/dstack/kms/dstack-app/builder/Dockerfile
index 8c6cdc046..24dd7bce4 100644
--- a/dstack/kms/dstack-app/builder/Dockerfile
+++ b/dstack/kms/dstack-app/builder/Dockerfile
@@ -27,6 +27,19 @@ RUN cd repo/dstack && cargo build --release -p dstack-kms --target x86_64-unknow
 RUN echo "${DSTACK_REV}" > /build/.GIT_REV
 
 FROM debian:bookworm@sha256:0d8498a0e9e6a60011df39aab78534cfe940785e7c59d19dfae1eb53ea59babe
+COPY --from=build-shared /pin-packages.sh /build/
+COPY ./shared/pinned-packages.txt /build/
+WORKDIR /build
+# reqwest is built against rustls-platform-verifier, which reads the system
+# trust store and errors out when it finds none. The KMS builds its collateral
+# and AMD KDS clients eagerly at startup, so a base image without CA
+# certificates fails to boot before it serves anything.
+RUN ./pin-packages.sh ./pinned-packages.txt && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
+WORKDIR /
 COPY --from=kms-builder /build/repo/dstack/target/x86_64-unknown-linux-musl/release/dstack-kms /usr/local/bin/dstack-kms
 COPY --from=kms-builder /build/.GIT_REV /etc/
 CMD ["dstack-kms"]
diff --git a/dstack/kms/dstack-app/builder/build-image.sh b/dstack/kms/dstack-app/builder/build-image.sh
index 9fab2f566..f126fe0ea 100755
--- a/dstack/kms/dstack-app/builder/build-image.sh
+++ b/dstack/kms/dstack-app/builder/build-image.sh
@@ -30,8 +30,9 @@ DSTACK_SRC_URL=${DSTACK_SRC_URL:-https://github.com/Dstack-TEE/dstack.git}
 ensure_buildkit
 
 touch "$SHARED_DIR/builder-pinned-packages.txt"
+touch "$SHARED_DIR/pinned-packages.txt"
 
-docker_build "$NAME" ""
+docker_build "$NAME" "" "$SHARED_DIR/pinned-packages.txt"
 docker_build "kms-builder-temp" "kms-builder" "$SHARED_DIR/builder-pinned-packages.txt"
 
 check_clean_tree "$SHARED_DIR"
diff --git a/dstack/kms/dstack-app/builder/shared/pinned-packages.txt b/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
new file mode 100644
index 000000000..e966045f9
--- /dev/null
+++ b/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
@@ -0,0 +1,91 @@
+adduser=3.134
+apt=2.6.1
+base-files=12.4+deb12u11
+base-passwd=3.6.1
+bash=5.2.15-2+b8
+bsdutils=1:2.38.1-5+deb12u3
+ca-certificates=20230311+deb12u1
+coreutils=9.1-1
+dash=0.5.12-2
+debconf=1.5.82
+debian-archive-keyring=2023.3+deb12u2
+debianutils=5.7-0.5~deb12u1
+diffutils=1:3.8-4
+dpkg=1.21.22
+e2fsprogs=1.47.0-2
+findutils=4.9.0-4
+gcc-12-base:amd64=12.2.0-14+deb12u1
+gpgv=2.2.40-1.1
+grep=3.8-5
+gzip=1.12-1
+hostname=3.23+nmu1
+init-system-helpers=1.65.2
+libacl1:amd64=2.3.1-3
+libapt-pkg6.0:amd64=2.6.1
+libattr1:amd64=1:2.5.1-4
+libaudit-common=1:3.0.9-1
+libaudit1:amd64=1:3.0.9-1
+libblkid1:amd64=2.38.1-5+deb12u3
+libbz2-1.0:amd64=1.0.8-5+b1
+libc-bin=2.36-9+deb12u10
+libc6:amd64=2.36-9+deb12u10
+libcap-ng0:amd64=0.8.3-1+b3
+libcap2:amd64=1:2.66-4+deb12u1
+libcom-err2:amd64=1.47.0-2
+libcrypt1:amd64=1:4.4.33-2
+libdb5.3:amd64=5.3.28+dfsg2-1
+libdebconfclient0:amd64=0.270
+libext2fs2:amd64=1.47.0-2
+libffi8:amd64=3.4.4-1
+libgcc-s1:amd64=12.2.0-14+deb12u1
+libgcrypt20:amd64=1.10.1-3
+libgmp10:amd64=2:6.2.1+dfsg1-1.1
+libgnutls30:amd64=3.7.9-2+deb12u4
+libgpg-error0:amd64=1.46-1
+libhogweed6:amd64=3.8.1-2
+libidn2-0:amd64=2.3.3-1+b1
+liblz4-1:amd64=1.9.4-1
+liblzma5:amd64=5.4.1-1
+libmd0:amd64=1.0.4-2
+libmount1:amd64=2.38.1-5+deb12u3
+libnettle8:amd64=3.8.1-2
+libp11-kit0:amd64=0.24.1-2
+libpam-modules-bin=1.5.2-6+deb12u1
+libpam-modules:amd64=1.5.2-6+deb12u1
+libpam-runtime=1.5.2-6+deb12u1
+libpam0g:amd64=1.5.2-6+deb12u1
+libpcre2-8-0:amd64=10.42-1
+libseccomp2:amd64=2.5.4-1+deb12u1
+libselinux1:amd64=3.4-1+b6
+libsemanage-common=3.4-1
+libsemanage2:amd64=3.4-1+b5
+libsepol2:amd64=3.4-2.1
+libsmartcols1:amd64=2.38.1-5+deb12u3
+libss2:amd64=1.47.0-2
+libssl3:amd64=3.0.18-1~deb12u2
+libstdc++6:amd64=12.2.0-14+deb12u1
+libsystemd0:amd64=252.38-1~deb12u1
+libtasn1-6:amd64=4.19.0-2+deb12u1
+libtinfo6:amd64=6.4-4
+libudev1:amd64=252.38-1~deb12u1
+libunistring2:amd64=1.0-2
+libuuid1:amd64=2.38.1-5+deb12u3
+libxxhash0:amd64=0.8.1-1
+libzstd1:amd64=1.5.4+dfsg2-5
+login=1:4.13+dfsg1-1+deb12u1
+logsave=1.47.0-2
+mawk=1.3.4.20200120-3.1
+mount=2.38.1-5+deb12u3
+ncurses-base=6.4-4
+ncurses-bin=6.4-4
+openssl=3.0.18-1~deb12u2
+passwd=1:4.13+dfsg1-1+deb12u1
+perl-base=5.36.0-7+deb12u2
+sed=4.9-1
+sysvinit-utils=3.06-4
+tar=1.34+dfsg-1.2+deb12u1
+tzdata=2025b-0+deb12u1
+usr-is-merged=37~deb12u1
+util-linux-extra=2.38.1-5+deb12u3
+util-linux=2.38.1-5+deb12u3
+zlib1g:amd64=1:1.2.13.dfsg-1