diff --git a/integration-tests/cascade-test-image/Dockerfile b/integration-tests/cascade-test-image/Dockerfile
index efd188728..b9615e709 100644
--- a/integration-tests/cascade-test-image/Dockerfile
+++ b/integration-tests/cascade-test-image/Dockerfile
@@ -13,8 +13,19 @@ RUN <<EOF
   export DEBIAN_FRONTEND=noninteractive
   apt-get update
 
-  # For rustup (for common Actions scripts)
-  apt-get install -y build-essential curl
+  # For rustup and dnst
+  apt-get install -y build-essential curl ca-certificates curl gnupg lsb-release
+
+  # Fetch NLnet Labs package key
+  curl -fsSL https://packages.nlnetlabs.nl/aptkey.asc | \
+    gpg --dearmor -o /usr/share/keyrings/nlnetlabs-archive-keyring.gpg
+
+  # Setup the nlnetlabs proposed package repo
+  printf "deb [arch=%s signed-by=%s] %s\n" \
+    "$(dpkg --print-architecture)" \
+    "/usr/share/keyrings/nlnetlabs-archive-keyring.gpg" \
+    "https://packages.nlnetlabs.nl/linux/ubuntu $(lsb_release -cs)-proposed main" \
+      > /etc/apt/sources.list.d/nlnetlabs-proposed.list
 
   # Node.js (for common Actions scripts)
   apt-get install -y nodejs
@@ -28,6 +39,27 @@ RUN <<EOF
   apt-get install -y file
 EOF
 
+# Provide the dnst version as a variable to make it easy to update the docker
+# image used by the act-wrapper to a new version of dnst. Otherwise, users will
+# have to manually invalidate the cached version of the RUN step below as the
+# RUN step content wouldn't change. When a new version of dnst is published,
+# we need to update these variables.
+ARG DNST_VERSION=0.2.0~alpha1-1noble
+ARG DNST_VERSION_CARGO=v0.2.0-alpha1
+
+RUN <<EOF
+  # Install dnst
+  export DEBIAN_FRONTEND=noninteractive
+
+  apt-get update
+  apt-get install -y dnst=$DNST_VERSION
+
+  # Link the installed dnst installed by apt to the cargo-release directory so
+  # that we don't have to modify the build profile selection action.
+  mkdir -p /root/cargo-release/bin
+  ln -sf -T /usr/bin/dnst /root/cargo-release/bin/dnst
+EOF
+
 RUN <<EOF
   # Install Rust
   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
@@ -47,11 +79,8 @@ RUN <<EOF
 EOF
 
 RUN <<EOF
-  # Install dnst.
-  # TODO: Switch installing release builds via apt-get install once a dnst
-  # release with keyset functionality has been released.
-  cargo install --debug --git https://github.com/nlnetlabs/dnst --rev 01e7fab --root /root/cargo-debug --locked --bin=dnst dnst
-  cargo install --git https://github.com/nlnetlabs/dnst --rev 01e7fab --root /root/cargo-release --locked --bin=dnst dnst
+  # Install the debug build of dnst.
+  cargo install --debug --git https://github.com/nlnetlabs/dnst --tag $DNST_VERSION_CARGO --root /root/cargo-debug --locked --bin=dnst dnst
 EOF
 
 # Copy source files into container in case we need to build from source
diff --git a/integration-tests/system-tests.yml b/integration-tests/system-tests.yml
index a171a5661..cfe4f4bbf 100644
--- a/integration-tests/system-tests.yml
+++ b/integration-tests/system-tests.yml
@@ -56,6 +56,7 @@ defaults:
     shell: bash --noprofile --norc -eo pipefail -x {0}
 
 jobs:
+  # These test jobs can be used to verify which binaries have been used
   test-release-version:
     name: Example test with prepare environment and cascade --version (release)
     runs-on: ubuntu-latest
@@ -68,9 +69,14 @@ jobs:
     - uses: ./.github/actions/set-build-profile
       with:
         build-profile: release
-    - run: cascade --version
-    - run: file $(which cascade)
+    - name: Print cascaden and dnst versions and used binaries
+      run: |
+        cascade --version
+        realpath $(which cascade)
+        dnst --version
+        realpath $(which dnst)
 
+  # These test jobs can be used to verify which binaries have been used
   test-version:
     name: Example test with prepare environment and cascade --version (debug)
     runs-on: ubuntu-latest
@@ -80,8 +86,12 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - uses: ./.github/actions/prepare-systest-env
-    - run: cascade --version
-    - run: file $(which cascade)
+    - name: Print cascade and dnst versions and used binaries
+      run: |
+        cascade --version
+        realpath $(which cascade)
+        dnst --version
+        realpath $(which dnst)
 
   add-zone-query:
     name: Add a zone, query the published zone