diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml
index b328a56c..5826df28 100644
--- a/.github/workflows/build-daily.yml
+++ b/.github/workflows/build-daily.yml
@@ -28,3 +28,5 @@ jobs:
     secrets: inherit
     with:
       url: ${{ needs.build-daily.outputs.artifacts_url }}
+      distro: debian
+      suite: trixie
diff --git a/.github/workflows/build-on-pr.yml b/.github/workflows/build-on-pr.yml
index 8321482f..b00c6e6f 100644
--- a/.github/workflows/build-on-pr.yml
+++ b/.github/workflows/build-on-pr.yml
@@ -21,7 +21,30 @@ jobs:
         name: Event File
         path: ${{ github.event_path }}
 
-  build-pr:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: debian
+            suite: trixie
+            # the package name will be passed to APT which interprets the
+            # trailing plus sign in the package name as a request to install
+            # the package, so use two plus signs
+            kernelpackage: linux-image-6.16.7-qcom1++
+          - distro: debian
+            suite: forky
+            kernelpackage: linux-image-arm64
+          - distro: ubuntu
+            suite: noble
+            kernelpackage: linux-image-qcom
+          - distro: ubuntu
+            suite: resolute
+            kernelpackage: linux-image-generic
     uses: ./.github/workflows/debos.yml
+    with:
+      suite: ${{ matrix.suite }}
+      distro: ${{ matrix.distro }}
+      kernelpackage: ${{ matrix.kernelpackage }}
   schema-check:
     uses: ./.github/workflows/lava-schema-check.yml
diff --git a/.github/workflows/build-on-push.yml b/.github/workflows/build-on-push.yml
index 576bbd9f..30c53f48 100644
--- a/.github/workflows/build-on-push.yml
+++ b/.github/workflows/build-on-push.yml
@@ -12,13 +12,36 @@ permissions:
   pull-requests: write # lava-test.yml
 
 jobs:
-  build-daily:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: debian
+            suite: trixie
+            # the package name will be passed to APT which interprets the
+            # trailing plus sign in the package name as a request to install
+            # the package, so use two plus signs
+            kernelpackage: linux-image-6.16.7-qcom1++
+          - distro: debian
+            suite: forky
+            kernelpackage: linux-image-arm64
+          - distro: ubuntu
+            suite: noble
+            kernelpackage: linux-image-qcom
+          - distro: ubuntu
+            suite: resolute
+            kernelpackage: linux-image-generic
+    with:
+      suite: ${{ matrix.suite }}
+      distro: ${{ matrix.distro }}
+      kernelpackage: ${{ matrix.kernelpackage }}
     uses: ./.github/workflows/debos.yml
   schema-check:
     uses: ./.github/workflows/lava-schema-check.yml
   test:
     uses: ./.github/workflows/lava-test.yml
-    needs: [build-daily, schema-check]
+    needs: [build, schema-check]
     secrets: inherit
     with:
-      url: ${{ needs.build-daily.outputs.artifacts_url }}
+      url: ${{ needs.build.outputs.artifacts_url }}
diff --git a/.github/workflows/debos.yml b/.github/workflows/debos.yml
index 283fc14a..a9a6a01d 100644
--- a/.github/workflows/debos.yml
+++ b/.github/workflows/debos.yml
@@ -3,6 +3,14 @@ name: Build debos recipe
 on:
   workflow_call:
     inputs:
+      suite:
+        description: Distribution suite (e.g. trixie, forky, noble)
+        type: string
+        default: trixie
+      distro:
+        description: Distribution (debian or ubuntu)
+        type: string
+        default: debian
       overlays:
         description: List of overlays to use
         type: string
@@ -13,10 +21,7 @@ on:
           linux-image-arm64) or name of a fileserver kernel package directory
           (e.g. fileserver/mainline)
         type: string
-        # the package name will be passed to APT which interprets the trailing
-        # plus sign in the package name as a request to install the package, so
-        # use two plus signs
-        default: linux-image-6.16.7-qcom1++
+        default: linux-image-arm64
       debos_extra_args:
         description: Extra arguments to pass to debos (e.g. -t dtb:qcom/some.dtb)
         type: string
@@ -41,10 +46,11 @@ env:
   BUILD_ID: ${{ github.run_id }}-${{ github.run_attempt }}
   KERNEL_PACKAGE: ${{ inputs.kernelpackage }}
   DEBOS_EXTRA_ARGS: ${{ inputs.debos_extra_args }}
+  DEBOS_DISTRO_ARGS: -t suite:${{ inputs.suite }} -t distro:${{ inputs.distro }}
 
 jobs:
   build-debos:
-    name: Build and upload debos recipes
+    name: Build and upload debos recipes (${{ inputs.distro }} ${{ inputs.suite }})
     outputs:
       url: ${{ steps.upload_artifacts_s3.outputs.url }}
     runs-on: [self-hosted, qcom-u2404, arm64]
@@ -71,8 +77,11 @@ jobs:
         run: cp -av "/fileserver-downloads/qcom-deb-images/u-boot-rb1-latest/rb1-boot.img" .
 
       # mtools is needed for the flash recipe
+      # mmdebstrap bootstraps rootfs for the target distro/suite from a
+      # Debian trixie build environment; debos is not installable on Ubuntu
+      # noble and doesn't work on forky or resolute
       - name: Install debos and dependencies of the recipes and local tests
-        run: apt -y install debian-archive-keyring debos make mmdebstrap mtools python3-pexpect python3-pytest qemu-efi-aarch64 qemu-system-arm
+        run: apt -y install debian-archive-keyring debos make mmdebstrap mtools python3-pexpect python3-pytest qemu-efi-aarch64 qemu-system-arm ubuntu-keyring
 
       - name: Setup local APT repo
         run: |
@@ -116,6 +125,7 @@ jobs:
               -t aptlocalrepo:${PWD}/local-apt-repo \
               -t kernelpackage:"$kernel_package" \
               -t "buildid:${BUILD_ID}" \
+              ${DEBOS_DISTRO_ARGS} \
               ${DEBOS_EXTRA_ARGS} \
               --print-recipe \
               debos-recipes/qualcomm-linux-debian-rootfs.yaml
@@ -130,10 +140,12 @@ jobs:
           # whole build is done from memory and the out of memory killer
           # gets triggered
           debos -b qemu --scratchsize 6GiB -t imagetype:ufs \
+              ${DEBOS_DISTRO_ARGS} \
               ${DEBOS_EXTRA_ARGS} \
               --print-recipe \
               debos-recipes/qualcomm-linux-debian-image.yaml
           debos -b qemu --scratchsize 6GiB -t imagetype:sdcard \
+              ${DEBOS_DISTRO_ARGS} \
               ${DEBOS_EXTRA_ARGS} \
               --print-recipe \
               debos-recipes/qualcomm-linux-debian-image.yaml
@@ -144,6 +156,7 @@ jobs:
           debos \
               -t u_boot_rb1:rb1-boot.img \
               -t "buildid:${BUILD_ID}" \
+              ${DEBOS_DISTRO_ARGS} \
               ${DEBOS_EXTRA_ARGS} \
               --print-recipe \
               debos-recipes/qualcomm-linux-debian-flash.yaml
@@ -151,24 +164,21 @@ jobs:
       - name: Stage debos artifacts for publishing
         run: |
           set -ux
+          prefix="${{ inputs.distro }}-${{ inputs.suite }}"
           # create a directory for the current run
           dir="debos-artifacts"
           mkdir -v "${dir}"
-          # compress output files before staging them
-          gzip --keep rootfs.tar
-          gzip --keep disk-ufs.img
-          gzip --keep disk-sdcard.img
-          # copy output files
-          cp -av rootfs.tar.gz "${dir}"
-          cp -av dtbs.tar.gz "${dir}"
-          cp -av disk-ufs.img.gz "${dir}"
-          cp -av disk-sdcard.img.gz "${dir}"
+          # compress output files directly into the staging directory
+          gzip -c rootfs.tar >"${dir}/${prefix}-rootfs.tar.gz"
+          gzip -c disk-ufs.img >"${dir}/${prefix}-disk-ufs.img.gz"
+          gzip -c disk-sdcard.img >"${dir}/${prefix}-disk-sdcard.img.gz"
+          cp -av dtbs.tar.gz "${dir}/${prefix}-dtbs.tar.gz"
           # create tarballs with support for all UFS and all eMMC boards
-          tar -cvzf "${dir}"/flash-ufs.tar.gz \
+          tar -cvzf "${dir}/${prefix}-flash-ufs.tar.gz" \
               disk-ufs.img1 \
               disk-ufs.img2 \
               flash_*_ufs
-          tar -cvzf "${dir}"/flash-emmc.tar.gz \
+          tar -cvzf "${dir}/${prefix}-flash-emmc.tar.gz" \
               disk-sdcard.img1 \
               disk-sdcard.img2 \
               flash_*_emmc
@@ -221,10 +231,12 @@ jobs:
       - name: Stage SBOMs for publishing
         run: |
           set -ux
-          gzip rootfs-sbom.*
+          prefix="${{ inputs.distro }}-${{ inputs.suite }}"
           dir="sboms"
           mkdir -v sboms
-          cp -av rootfs-sbom.*.gz sboms
+          for f in rootfs-sbom.*; do
+              gzip -c "$f" >"${dir}/${prefix}-${f}.gz"
+          done
 
       - name: Upload SBOMs as private artifacts
         uses: qualcomm-linux/upload-private-artifact-action@aws-v4
diff --git a/.github/workflows/lava-test.yml b/.github/workflows/lava-test.yml
index e1809dab..da1d58ff 100644
--- a/.github/workflows/lava-test.yml
+++ b/.github/workflows/lava-test.yml
@@ -6,6 +6,14 @@ on:
       url:
         required: true
         type: string
+      distro:
+        description: Distribution (debian or ubuntu)
+        type: string
+        default: debian
+      suite:
+        description: Distribution suite (e.g. trixie, forky, noble)
+        type: string
+        default: trixie
 
 # implicitely set all other permissions to none
 permissions:
@@ -17,6 +25,8 @@ permissions:
 env:
   BUILD_URL: ${{ inputs.url }}
   LAVA_CI: ci/lava/
+  DISTRO: ${{ inputs.distro }}
+  SUITE: ${{ inputs.suite }}
 
 jobs:
   prepare-job-list:
@@ -83,6 +93,8 @@ jobs:
               -e "s|{{BUILD_DOWNLOAD_URL}}|${BUILD_DOWNLOAD_URL}|g" \
               -e "s|{{BUILD_FILE_NAME}}|${BUILD_FILE_NAME}|g" \
               -e "s|{{DEVICE_TYPE}}|${DEVICE_TYPE}|g" \
+              -e "s|{{DISTRO}}|${DISTRO}|g" \
+              -e "s|{{SUITE}}|${SUITE}|g" \
               -e "s|{{GITHUB_REPOSITORY}}|${GITHUB_REPOSITORY}|g" \
               -e "s|{{GITHUB_RUN_ATTEMPT}}|${GITHUB_RUN_ATTEMPT}|g" \
               -e "s|{{GITHUB_RUN_ID}}|${GITHUB_RUN_ID}|g" \
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index b2c18cd4..c84cbe85 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -152,3 +152,5 @@ jobs:
     secrets: inherit
     with:
       url: ${{ needs.debos-linux-deb.outputs.artifacts_url }}
+      distro: debian
+      suite: trixie
diff --git a/Makefile b/Makefile
index e85388f4..880a234e 100644
--- a/Makefile
+++ b/Makefile
@@ -46,17 +46,22 @@ endif
 http_proxy ?= $(shell apt-config dump --format '%v%n' Acquire::http::Proxy)
 export http_proxy
 
+# Distribution and suite selection
+SUITE ?= trixie
+DISTRO ?= debian
+DEBOS_VARS := -t suite:$(SUITE) -t distro:$(DISTRO)
+
 .PHONY: all
 all: disk-ufs.img disk-sdcard.img
 
 rootfs.tar: debos-recipes/qualcomm-linux-debian-rootfs.yaml
-	$(DEBOS_CMD) $<
+	$(DEBOS_CMD) $(DEBOS_VARS) $<
 
 disk-ufs.img: debos-recipes/qualcomm-linux-debian-image.yaml rootfs.tar
-	$(DEBOS_CMD) $<
+	$(DEBOS_CMD) $(DEBOS_VARS) $<
 
 disk-sdcard.img: debos-recipes/qualcomm-linux-debian-image.yaml rootfs.tar
-	$(DEBOS_CMD) -t imagetype:sdcard $<
+	$(DEBOS_CMD) $(DEBOS_VARS) -t imagetype:sdcard $<
 
 .PHONY: test
 test: disk-ufs.img
diff --git a/ci/lava/qcs6490-rb3gen2-vision-kit/boot.yaml b/ci/lava/qcs6490-rb3gen2-vision-kit/boot.yaml
index 485b80da..fd09bbd5 100644
--- a/ci/lava/qcs6490-rb3gen2-vision-kit/boot.yaml
+++ b/ci/lava/qcs6490-rb3gen2-vision-kit/boot.yaml
@@ -4,7 +4,7 @@ actions:
       image:
         headers:
           Authorization: Q_S3_TOKEN
-        url: "{{BUILD_DOWNLOAD_URL}}/flash-ufs.tar.gz"
+        url: "{{BUILD_DOWNLOAD_URL}}/{{DISTRO}}-{{SUITE}}-flash-ufs.tar.gz"
     postprocess:
       docker:
         image: ghcr.io/foundriesio/lava-lmp-sign:main
@@ -33,18 +33,18 @@ actions:
 - boot:
     auto_login:
       login_prompt: 'login:'
-      username: debian
+      username: qcom
       password_prompt: 'Password'
-      password: debian
+      password: qcom
       login_commands:
-      - "debian"
+      - "qcom"
       - "new password"
       - "new password"
       - sudo su
     method: minimal
     prompts:
-    - root@debian
-    - debian@debian
+    - root@qcom
+    - qcom@qcom
     - "Current password"
     - "New password"
     - "Retype new password"
diff --git a/ci/lava/qrb2210-rb1/boot.yaml b/ci/lava/qrb2210-rb1/boot.yaml
index 6d59772a..007126b3 100644
--- a/ci/lava/qrb2210-rb1/boot.yaml
+++ b/ci/lava/qrb2210-rb1/boot.yaml
@@ -4,7 +4,7 @@ actions:
       image:
         headers:
           Authorization: Q_S3_TOKEN
-        url: "{{BUILD_DOWNLOAD_URL}}/flash-emmc.tar.gz"
+        url: "{{BUILD_DOWNLOAD_URL}}/{{DISTRO}}-{{SUITE}}-flash-emmc.tar.gz"
     postprocess:
       docker:
         image: ghcr.io/foundriesio/lava-lmp-sign:main
@@ -34,18 +34,18 @@ actions:
 - boot:
     auto_login:
       login_prompt: 'login:'
-      username: debian
+      username: qcom
       password_prompt: 'Password'
-      password: debian
+      password: qcom
       login_commands:
-      - "debian"
+      - "qcom"
       - "new password"
       - "new password"
       - sudo su
     method: minimal
     prompts:
-    - root@debian
-    - debian@debian
+    - root@qcom
+    - qcom@qcom
     - "Current password"
     - "New password"
     - "Retype new password"
diff --git a/ci/qemu_test.py b/ci/qemu_test.py
index c03fbde8..45bda315 100644
--- a/ci/qemu_test.py
+++ b/ci/qemu_test.py
@@ -71,14 +71,14 @@ def test_password_reset_required(vm):
     # This takes a minute or two on a ThinkPad T14s Gen 6 Snapdragon
     vm.expect_exact("debian login:", timeout=240)
 
-    vm.send("debian\r\n")
+    vm.send("qcom\r\n")
     vm.expect_exact("Password:")
-    vm.send("debian\r\n")
+    vm.send("qcom\r\n")
     vm.expect_exact("You are required to change your password immediately")
     vm.expect_exact("Current password:")
-    vm.send("debian\r\n")
+    vm.send("qcom\r\n")
     vm.expect_exact("New password:")
     vm.send("new password\r\n")
     vm.expect_exact("Retype new password:")
     vm.send("new password\r\n")
-    vm.expect_exact("debian@debian:~$")
+    vm.expect_exact("qcom@qcom:~$")
diff --git a/debos-recipes/overlays/apt-sources/etc/apt/sources.list.d/debian.sources b/debos-recipes/overlays/apt-sources/etc/apt/sources.list.d/debian.sources
deleted file mode 100644
index 8a013224..00000000
--- a/debos-recipes/overlays/apt-sources/etc/apt/sources.list.d/debian.sources
+++ /dev/null
@@ -1,20 +0,0 @@
-# Debian archive
-Types: deb
-URIs: http://deb.debian.org/debian/
-Suites: trixie
-Components: main contrib non-free non-free-firmware
-Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
-
-# Debian stable updates
-Types: deb
-URIs: http://deb.debian.org/debian/
-Suites: trixie-updates
-Components: main contrib non-free non-free-firmware
-Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
-
-# Debian security updates
-Types: deb
-URIs: http://deb.debian.org/debian-security/
-Suites: trixie-security
-Components: main contrib non-free non-free-firmware
-Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
diff --git a/debos-recipes/overlays/backports/etc/apt/preferences.d/debian-backports.pref b/debos-recipes/overlays/backports/etc/apt/preferences.d/debian-backports.pref
deleted file mode 100644
index 1887de6c..00000000
--- a/debos-recipes/overlays/backports/etc/apt/preferences.d/debian-backports.pref
+++ /dev/null
@@ -1,6 +0,0 @@
-# for binary packages built from these source packages, score the version from
-# Debian backports higher as to get hardware enabled or better hardware support
-
-Package: src:alsa-ucm-conf:any src:firmware-free:any src:firmware-nonfree:any src:linux:any src:linux-signed-arm64:any src:mesa:any src:u-boot-efi-dtb
-Pin: release n=trixie-backports
-Pin-Priority: 900
diff --git a/debos-recipes/overlays/backports/etc/apt/sources.list.d/debian-backports.sources b/debos-recipes/overlays/backports/etc/apt/sources.list.d/debian-backports.sources
deleted file mode 100644
index 02cbe0e1..00000000
--- a/debos-recipes/overlays/backports/etc/apt/sources.list.d/debian-backports.sources
+++ /dev/null
@@ -1,7 +0,0 @@
-# Debian backports
-Types: deb
-URIs: http://deb.debian.org/debian
-Suites: trixie-backports
-Components: main contrib non-free non-free-firmware
-Enabled: yes
-Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
diff --git a/debos-recipes/overlays/qsc-deb-releases/etc/apt/preferences.d/qsc-deb-releases.pref b/debos-recipes/overlays/qsc-deb-releases/etc/apt/preferences.d/qsc-deb-releases.pref
deleted file mode 100644
index 2f3d0312..00000000
--- a/debos-recipes/overlays/qsc-deb-releases/etc/apt/preferences.d/qsc-deb-releases.pref
+++ /dev/null
@@ -1,6 +0,0 @@
-# for binary packages built from these source packages, score the version from
-# trixie-overlay higher than versions from Debian for compliance
-Package: src:pipewire:any
-Pin: release n=trixie-overlay
-Pin-Priority: 950
-
diff --git a/debos-recipes/overlays/qsc-deb-releases/etc/apt/sources.list.d/qsc-deb-releases.sources b/debos-recipes/overlays/qsc-deb-releases/etc/apt/sources.list.d/qsc-deb-releases.sources
deleted file mode 100644
index 0e07df0d..00000000
--- a/debos-recipes/overlays/qsc-deb-releases/etc/apt/sources.list.d/qsc-deb-releases.sources
+++ /dev/null
@@ -1,9 +0,0 @@
-# QArtifactory qsc-deb-releases repository
-# NB: publishing Sources indices for deb-src isn't supported by Artifactory,
-# but sources are published with other packages files
-Types: deb
-URIs: https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases
-Suites: trixie-overlay
-Components: main
-Signed-By: /etc/apt/keyrings/qsc-deb-releases.asc
-Enabled: yes
diff --git a/debos-recipes/qualcomm-linux-debian-image.yaml b/debos-recipes/qualcomm-linux-debian-image.yaml
index f11ac020..a398ec04 100644
--- a/debos-recipes/qualcomm-linux-debian-image.yaml
+++ b/debos-recipes/qualcomm-linux-debian-image.yaml
@@ -2,6 +2,7 @@
 {{- $imagesize := or .imagesize "6GiB" }}
 {{- $imagetype := or .imagetype "ufs" }}
 {{- $image := printf "disk-%s.img" $imagetype }}
+{{- $suite := or .suite "trixie" }}
 
 architecture: arm64
 sectorsize: {{if eq $imagetype "ufs"}}4096{{else}}512{{end}}
@@ -68,6 +69,7 @@ actions:
       # Depends on grub packages
       - shim-signed-
 
+{{- if ne $suite "noble" }}
   # this is to provide an updated copy of DTBs from the OS to U-Boot, notably
   # on RB1
   - action: run
@@ -92,8 +94,15 @@ actions:
       # DTBs; do this once here
       latest_kernel="$(
           linux-version list | linux-version sort --reverse | head -1)"
-      dtb_path="/usr/lib/linux-image-${latest_kernel}"
+      # Debian: DTBs are under /usr/lib/linux-image-<version>/
+      # Ubuntu: DTBs are under /lib/firmware/<version>/device-tree/
+      if [ -d "/usr/lib/linux-image-${latest_kernel}" ]; then
+        dtb_path="/usr/lib/linux-image-${latest_kernel}"
+      else
+        dtb_path="/lib/firmware/${latest_kernel}/device-tree"
+      fi
       cp -LRT "$dtb_path" "/boot/efi/dtb"
+{{- end }}
 
   - action: run
     description: Create task to grow root filesystem on first boot
diff --git a/debos-recipes/qualcomm-linux-debian-rootfs.yaml b/debos-recipes/qualcomm-linux-debian-rootfs.yaml
index 30eaae52..952ebee6 100644
--- a/debos-recipes/qualcomm-linux-debian-rootfs.yaml
+++ b/debos-recipes/qualcomm-linux-debian-rootfs.yaml
@@ -4,6 +4,10 @@
 {{- $kernelpackage := or .kernelpackage "linux-image-arm64" }}
 {{- $overlays := or .overlays "qsc-deb-releases" }}
 {{- $buildid := or .buildid "" }}
+{{- $suite := or .suite "trixie" }}
+{{- $distro := or .distro "debian" }}
+{{- $username := or .username "qcom" }}
+{{- $hostname := or .hostname "qcom" }}
 
 {{- $variantid := "console" }}
 {{- if eq $xfcedesktop "true" }}
@@ -15,17 +19,29 @@ architecture: arm64
 actions:
   - action: mmdebstrap
     description: Bootstrap initial filesystem
-    # NB: not currently configurable
-    suite: trixie
+    suite: {{ $suite }}
     components:
+{{ if eq $distro "ubuntu" }}
+      - main
+      - universe
+      - restricted
+      - multiverse
+    mirrors: ['http://ports.ubuntu.com/ubuntu-ports']
+{{ else }}
       - main
       - contrib
       - non-free
       - non-free-firmware
     mirrors: ['http://deb.debian.org/debian']
+{{ end }}
     variant: minbase
     # ca-certificates required in early bootstrap for possible https apt overlays later
-    include: [ca-certificates]
+    # wget is needed to probe overlay suite availability later in the build
+{{ if eq $distro "ubuntu" }}
+    include: [ca-certificates, ubuntu-keyring, wget]
+{{ else }}
+    include: [ca-certificates, wget]
+{{ end }}
 
 {{- if ne $aptlocalrepo "none" }}
   - action: run
@@ -50,15 +66,85 @@ actions:
 {{- end }}
 
   # after debootstrap, only a basic etc/apt/sources.list is created; add more
-  # modern etc/apt/sources.list.d/debian.sources; sources.list is removed after
+  # modern etc/apt/sources.list.d/ .sources; sources.list is removed after
   # applying all overlays, and followed by an APT update and full-upgrade
-  - action: overlay
-    description: Create Debian APT sources
-    source: overlays/apt-sources
+  - action: run
+    description: Create APT sources for {{ $distro }} {{ $suite }}
+    chroot: true
+    command: |
+      set -eux
+{{ if eq $distro "debian" }}
+      cat >/etc/apt/sources.list.d/debian.sources <<EOF
+      # Debian archive
+      Types: deb
+      URIs: http://deb.debian.org/debian/
+      Suites: {{ $suite }}
+      Components: main contrib non-free non-free-firmware
+      Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 
-  - action: overlay
-    description: Add Debian backports APT configuration
-    source: overlays/backports
+      # Debian stable updates
+      Types: deb
+      URIs: http://deb.debian.org/debian/
+      Suites: {{ $suite }}-updates
+      Components: main contrib non-free non-free-firmware
+      Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+      # Debian security updates
+      Types: deb
+      URIs: http://deb.debian.org/debian-security/
+      Suites: {{ $suite }}-security
+      Components: main contrib non-free non-free-firmware
+      Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+      EOF
+{{ else if eq $distro "ubuntu" }}
+      cat >/etc/apt/sources.list.d/ubuntu.sources <<EOF
+      # Ubuntu archive
+      Types: deb
+      URIs: http://ports.ubuntu.com/ubuntu-ports/
+      Suites: {{ $suite }}
+      Components: main universe restricted multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+      # Ubuntu updates
+      Types: deb
+      URIs: http://ports.ubuntu.com/ubuntu-ports/
+      Suites: {{ $suite }}-updates
+      Components: main universe restricted multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+      # Ubuntu security updates
+      Types: deb
+      URIs: http://ports.ubuntu.com/ubuntu-ports/
+      Suites: {{ $suite }}-security
+      Components: main universe restricted multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+      EOF
+{{ end }}
+
+{{ if eq $distro "debian" }}
+  - action: run
+    description: Add Debian {{ $suite }}-backports APT configuration
+    chroot: true
+    command: |
+      set -eux
+      cat >/etc/apt/sources.list.d/debian-backports.sources <<EOF
+      # Debian backports
+      Types: deb
+      URIs: http://deb.debian.org/debian
+      Suites: {{ $suite }}-backports
+      Components: main contrib non-free non-free-firmware
+      Enabled: yes
+      Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+      EOF
+      cat >/etc/apt/preferences.d/debian-backports.pref <<EOF
+      # for binary packages built from these source packages, score the version from
+      # Debian backports higher as to get hardware enabled or better hardware support
+
+      Package: src:alsa-ucm-conf:any src:firmware-free:any src:firmware-nonfree:any src:linux:any src:linux-signed-arm64:any src:mesa:any src:u-boot-efi-dtb
+      Pin: release n={{ $suite }}-backports
+      Pin-Priority: 900
+      EOF
+{{ end }}
 
 {{- if $overlays }}
 {{- range $overlay := split "," $overlays }}
@@ -68,6 +154,44 @@ actions:
 {{- end }}
 {{- end }}
 
+  # The qsc-deb-releases overlay only ships the keyring (.asc); generate the
+  # .sources and .pref files dynamically to use the correct $suite-overlay.
+  # The .sources is initially created with Enabled: no, and only enabled after
+  # verifying the suite exists in the repository (wget probe of Release file).
+  - action: run
+    description: Create qsc-deb-releases APT sources for {{ $suite }}-overlay
+    chroot: true
+    command: |
+      set -eux
+      # only generate if the keyring was installed by the overlay
+      if [ -f /etc/apt/keyrings/qsc-deb-releases.asc ]; then
+        cat >/etc/apt/sources.list.d/qsc-deb-releases.sources <<EOF
+      # QArtifactory qsc-deb-releases repository
+      # NB: publishing Sources indices for deb-src isn't supported by Artifactory,
+      # but sources are published with other packages files
+      Types: deb
+      URIs: https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases
+      Suites: {{ $suite }}-overlay
+      Components: main
+      Signed-By: /etc/apt/keyrings/qsc-deb-releases.asc
+      Enabled: no
+      EOF
+        cat >/etc/apt/preferences.d/qsc-deb-releases.pref <<EOF
+      # for binary packages built from these source packages, score the version from
+      # {{ $suite }}-overlay higher than versions from Debian for compliance
+      Package: src:pipewire:any
+      Pin: release n={{ $suite }}-overlay
+      Pin-Priority: 950
+      EOF
+        # verify the overlay suite exists before enabling it
+        if wget -q --spider \
+            "https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases/dists/{{ $suite }}-overlay/Release"; then
+          sed -i 's/^Enabled: no$/Enabled: yes/' /etc/apt/sources.list.d/qsc-deb-releases.sources
+        else
+          echo "WARNING: {{ $suite }}-overlay not found in qsc-deb-releases, leaving disabled"
+        fi
+      fi
+
   - action: run
     description: Remove old APT sources and upgrade packages
     chroot: true
@@ -83,16 +207,20 @@ actions:
     description: Install foundational packages
     recommends: true
     packages:
-      # Android Debug Bridge (daemon)
+{{ if ne $suite "noble" }}
+      # Android Debug Bridge (daemon); not available in Ubuntu noble
       - adbd
+{{ end }}
       # bluetooth
       - bluez
       # vfat tools, notably fsck.fat for the ESP
       - dosfstools
       # ext4 tools, notably e2fsck for the root filesystem
       - e2fsprogs
-      # fastrpc support. fastrpc-tests pulls in the required stack
-      - fastrpc-tests
+{{ if eq $distro "debian" }}
+      # fastrpc support; not available in Ubuntu noble nor in resolute
+      - fastrpc-support
+{{ end }}
       # fwupd tools, enable OTA EFI firmware capsule updates
       - fwupd
       # defaults to "systemd-sysv"; perhaps not needed
@@ -120,17 +248,26 @@ actions:
       # WPA / WPA2 / WPA3 client support
       - wpasupplicant
 
+{{ if eq $suite "trixie" }}
+  # fastrpc-tests is only available in trixie-overlay
+  - action: apt
+    description: Install fastrpc-tests (trixie only)
+    recommends: true
+    packages:
+      - fastrpc-tests
+{{ end }}
+
   - action: run
-    description: Set hostname to "debian"
+    description: Set hostname to "{{ $hostname }}"
     chroot: true
     command: |
       set -eux
-      echo debian >/etc/hostname
+      echo {{ $hostname }} >/etc/hostname
       # /etc/hosts is created by netbase
-      sed -i "1s/^/127.0.1.1	debian\n/" /etc/hosts
+      sed -i "1s/^/127.0.1.1\t{{ $hostname }}\n/" /etc/hosts
 
   - action: run
-    description: Add a "debian" user, add it to sudoers and various groups
+    description: Add a "{{ $username }}" user, add it to sudoers and various groups
     chroot: true
     command: |
       set -eux
@@ -139,35 +276,52 @@ actions:
       # some useful groups for desktop scenarios, but also to run payloads
       # from the serial console, over SSH, or in containers - where the desktop
       # session has not updated ACLs to the device nodes
+      groups="adm,audio,render,sudo,users,video"
+      # fastrpc group only exists when fastrpc-support is installed (Debian)
+      if getent group fastrpc >/dev/null 2>&1; then
+        groups="${groups},fastrpc"
+      fi
       useradd --create-home --shell /bin/bash --user-group \
-          --groups adm,audio,fastrpc,render,sudo,users,video debian
-      # set password to "debian"
-      echo debian:debian | chpasswd
+          --groups "$groups" {{ $username }}
+      # set password to "{{ $username }}"
+      echo {{ $username }}:{{ $username }} | chpasswd
       # password must be changed on first login
-      chage --lastday 0 debian
+      chage --lastday 0 {{ $username }}
       # add to sudoers
       mkdir -v --mode 755 --parents /etc/sudoers.d
       # subshell to override umask
       (
         umask 226
-        echo "debian ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/90-debos
+        echo "{{ $username }} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/90-debos
       )
 
   # NB: Recommends pull in way too many packages, and we don't need to follow
-  # Recommends reaching outside of this Priority level
+  # Recommends reaching outside of each Priority level
+{{ if eq $distro "debian" }}
   - action: apt
     description: Install packages of priority "important" (only from Debian)
     recommends: false
     packages:
       - ?origin(Debian) ?priority(important)
 
-  # NB: Recommends pull in way too many packages, and we don't need to follow
-  # Recommends reaching outside of this Priority level
   - action: apt
     description: Install packages of priority "standard" (only from Debian)
     recommends: false
     packages:
       - ?origin(Debian) ?priority(standard)
+{{ else if eq $distro "ubuntu" }}
+  - action: apt
+    description: Install packages of priority "important" (from Ubuntu)
+    recommends: false
+    packages:
+      - ?origin(Ubuntu) ?priority(important)
+
+  - action: apt
+    description: Install packages of priority "standard" (from Ubuntu)
+    recommends: false
+    packages:
+      - ?origin(Ubuntu) ?priority(standard)
+{{ end }}
 
   # TODO remove Priority: standard packages from this list?
   - action: apt
@@ -176,8 +330,10 @@ actions:
     packages:
       - alsa-utils
       - clinfo
-      # used to debug clock issues
+{{ if ne $suite "noble" }}
+      # used to debug clock issues; not available in Ubuntu noble
       - debugcc
+{{ end }}
       - device-tree-compiler
       - docker.io
       # used to debug ethernet speed auto-neg issues
@@ -206,7 +362,7 @@ actions:
     chroot: true
     command: |
       set -eux
-      usermod -a -G docker debian
+      usermod -a -G docker {{ $username }}
 
 {{- if eq $xfcedesktop "true" }}
   # this should ideally be task-xfce-desktop, but this pulls too many apps;
@@ -232,8 +388,13 @@ actions:
       - light-locker
       - xfce4-terminal
       - tango-icon-theme
+{{ if eq $suite "noble" }}
+      # on Ubuntu noble, applet and connection editor are in network-manager-gnome
+      - network-manager-gnome
+{{ else }}
       - network-manager-applet
       - nm-connection-editor
+{{ end }}
       - synaptic
       # from task-desktop
       - desktop-base
@@ -270,7 +431,7 @@ actions:
       set -eux
       if which locale-gen >/dev/null 2>&1; then
           echo en_US.UTF-8 UTF-8 >>/etc/locale.gen
-          locale-gen en_US.UTF-8 UTF-8
+          locale-gen
           update-locale LANG=en_US.UTF-8
       fi
 
@@ -299,12 +460,19 @@ actions:
       - kmod
       - linux-base
 
+{{ if eq $distro "debian" }}
   - action: apt
-    description: Install kernel and firmware packages
+    description: Install firmware packages (Debian only)
     recommends: true
     packages:
       - firmware-atheros
       - firmware-qcom-soc
+{{ end }}
+
+  - action: apt
+    description: Install kernel package
+    recommends: true
+    packages:
       - {{$kernelpackage}}
 
   # this is currently needed on boards such as RB1 which are using Android
@@ -361,11 +529,17 @@ actions:
       # this image has pulled a more recent kernel, it's probably to gain
       # support for new hardware which would happen through new or updated dtbs
       # only in that new kernel, so use the latest dtbs
-      latest_kernel="$(
-          ls -d "$ROOTDIR"/usr/lib/linux-image-* | sort -V | tail -1)"
+      #
+      # Debian: DTBs are under /usr/lib/linux-image-<version>/
+      # Ubuntu: DTBs are under /lib/firmware/<version>/device-tree/
+      if ls -d "$ROOTDIR"/usr/lib/linux-image-* >/dev/null 2>&1; then
+        dtb_dir="$(ls -d "$ROOTDIR"/usr/lib/linux-image-* | sort -V | tail -1)"
+      else
+        dtb_dir="$(ls -d "$ROOTDIR"/lib/firmware/*/device-tree | sort -V | tail -1)"
+      fi
       # transform pathnames to strip the leading ./
       tar \
-          -C "${latest_kernel}" \
+          -C "${dtb_dir}" \
           --transform='s|^\./||' \
           -cvzf "$ARTIFACTDIR/dtbs.tar.gz" \
           .