diff --git a/.gitea/workflows/base-build.yml b/.gitea/workflows/base-build.yml
index 6466a44..e9ae801 100644
--- a/.gitea/workflows/base-build.yml
+++ b/.gitea/workflows/base-build.yml
@@ -19,13 +19,19 @@ env:
   DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
   DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
   VERSIONS: "buster bullseye bookworm trixie"
+  VERSIONS_JSON: '["buster","bullseye","bookworm","trixie"]'
   OUTPUT_DIR: ./output
 
 jobs:
-  build-and-push-rootfs-archives:
+  build-rootfs-per-version:
     runs-on: vm-docker-build2
+    strategy:
+      matrix:
+        version: ${{ fromJson(env.VERSIONS_JSON) }}
     outputs:
-      archives_changed: ${{ steps.commit_archives.outputs.archives_changed }}
+      archive_changed: ${{ steps.check_changed.outputs.archive_changed }}
+    env:
+      VERSION: ${{ matrix.version }}
     steps:
       - name: Checkout source
         uses: actions/checkout@v3
@@ -33,91 +39,58 @@ jobs:
       - name: Create output directory
         run: mkdir -p ./output
 
-      - name: Build all Debian rootfs versions into volumes and extract
+      - name: Build Debian ${{ env.VERSION }} rootfs
         run: |
-          versions=($VERSIONS)
-          for version in "${versions[@]}"; do
-            echo "[INFO] Building $version..."
-            volume_name="build_output_$version"
-            docker volume create "$volume_name"
+          echo "[INFO] Building $VERSION..."
+          volume_name="build_output_$VERSION"
+          docker volume create "$volume_name"
 
-            docker build --build-arg VERSION=$version -t fithwum/debian-$version-base .
+          docker build --build-arg VERSION=$VERSION -t fithwum/debian-$VERSION-base .
 
-            docker run --rm --privileged \
-              -v "$volume_name:/output" \
-              -e VERSION="$version" \
-              fithwum/debian-$version-base \
-              bash -c "/scripts/bootstrap-rootfs.sh \"$version\""
+          docker run --rm --privileged \
+            -v "$volume_name:/output" \
+            -e VERSION="$VERSION" \
+            fithwum/debian-$VERSION-base \
+            bash -c "/scripts/bootstrap-rootfs.sh \"$VERSION\""
 
-            # Extract the output file from the volume
-            container_id=$(docker create -v "$volume_name:/output" debian)
-            mkdir -p ./output/$version
-            docker cp "$container_id:/output/$version/debian-$version.tar.bz2" ./output/$version/
-            docker rm "$container_id"
-          done
-
-      - name: Validate that archives exist for each version
-        run: |
-          IFS=' ' read -r -a versions <<< "$VERSIONS"
-          for version in "${versions[@]}"; do
-            path="./output/$version/debian-$version.tar.bz2"
-            if [[ ! -f "$path" ]]; then
-              echo "[ERROR] Missing archive: $path"
-              exit 1
-            else
-              echo "[OK] Found: $path"
-            fi
-          done
+          container_id=$(docker create -v "$volume_name:/output" debian)
+          mkdir -p ./output/$VERSION
+          docker cp "$container_id:/output/$VERSION/debian-$VERSION.tar.bz2" ./output/$VERSION/
+          docker rm "$container_id"
 
       - name: Clone upload repo
         run: |
           GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
           git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
 
-      - name: Clean old archives in upload-repo
-        run: rm -rfv upload-repo/*/*.tar.bz2
-
-      - name: Copy new archives to upload-repo
+      - name: Check if archive changed
+        id: check_changed
         run: |
-          for filepath in ./output/*/debian-*.tar.bz2; do
-            version_dir=$(basename "$(dirname "$filepath")")
-            mkdir -p "upload-repo/$version_dir"
-            cp "$filepath" "upload-repo/$version_dir/"
-          done
+          mkdir -p upload-repo/${VERSION}
+          new="./output/${VERSION}/debian-${VERSION}.tar.bz2"
+          old="upload-repo/${VERSION}/debian-${VERSION}.tar.bz2"
+          cp "$new" "$old"
+
+          checksum=$(sha256sum "$new" | awk '{print $1}')
+          echo "$checksum  ${VERSION}/debian-${VERSION}.tar.bz2" >> upload-repo/sha256sums.txt
 
-      - name: Calculate and store sha256sums in upload-repo
-        run: |
           cd upload-repo
-          rm -f sha256sums.txt
-          for tarball in */debian-*.tar.bz2; do
-            echo "[INFO] Processing: $tarball"
-            checksum=$(sha256sum "$tarball" | awk '{print $1}')
-            echo "$checksum  $tarball" >> sha256sums.txt
-          done
-          echo "[INFO] SHA256 contents:"
-          cat sha256sums.txt
+          git config user.name "${{ env.GIT_USERNAME }}"
+          git config user.email "${{ env.GIT_EMAIL }}"
+          git add ${VERSION}/debian-${VERSION}.tar.bz2 sha256sums.txt || true
 
-      - name: Commit and push files if changed
-        id: commit_archives
-        run: |
-          cd upload-repo
-          git config --global user.name "${{ env.GIT_USERNAME }}"
-          git config --global user.email "${{ env.GIT_EMAIL }}"
-
-          if git status --porcelain | grep .; then
-            git add **/*.tar.bz2 sha256sums.txt || true
-            git commit -m "Update base images and checksum on $(date -u +'%Y-%m-%dT%H:%M:%SZ') [skip ci]"
-            git push
-            echo "archives_changed=true" >> $GITHUB_OUTPUT
-          else
+          if git diff --cached --quiet; then
             echo "[INFO] No changes to commit."
-            echo "archives_changed=false" >> $GITHUB_OUTPUT
+            echo "archive_changed=false" >> $GITHUB_OUTPUT
+          else
+            git commit -m "Update rootfs for $VERSION"
+            git push
+            echo "archive_changed=true" >> $GITHUB_OUTPUT
           fi
 
   build-and-push-docker-images:
-    needs: build-and-push-rootfs-archives
+    needs: build-rootfs-per-version
     if: always()
-    # if: needs.build-and-push-rootfs-archives.outputs.archives_changed == 'true'
     runs-on: doc-docker-build
     steps:
       - name: Checkout source
@@ -170,34 +143,6 @@ jobs:
           fi
           done
 
-      - name: Generate Dockerfiles per version (if missing)
-        run: |
-          for version in $VERSIONS; do
-            mkdir -p "$version"
-            DOCKERFILE_PATH="$version/Dockerfile"
-
-            if [[ -f "$DOCKERFILE_PATH" ]]; then
-              echo "[INFO] Skipping $DOCKERFILE_PATH (already exists)"
-              continue
-            fi
-
-            printf '%s\n' \
-              "FROM scratch" \
-              "LABEL maintainer=\"fithwum\"" \
-              "ADD debian-$version.tar.bz2 /" \
-              "CMD [\"/bin/bash\"]" > "$DOCKERFILE_PATH"
-
-            echo "[INFO] Created $DOCKERFILE_PATH"
-          done
-
-      - name: Copy rootfs tarballs into version dirs for Docker build context
-        run: |
-          for version in $VERSIONS; do
-            mkdir -p "$version"
-            cp "temp-check/debian-base/$version/debian-$version.tar.bz2" "$version/"
-            ls -lh "$version/"
-          done
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -217,7 +162,7 @@ jobs:
           done
 
   generate-changelogs:
-    needs: build-and-push-rootfs-archives
+    needs: build-rootfs-per-version
     runs-on: doc-docker-build
     steps:
       - name: Checkout source