diff --git a/.github/workflows/python-build.yml b/.github/workflows/python-build.yml
index d95fccf..a6be46c 100644
--- a/.github/workflows/python-build.yml
+++ b/.github/workflows/python-build.yml
@@ -18,26 +18,13 @@ jobs:
   build-wheels:
     runs-on: ubuntu-24.04
     container:
-      image: nvidia/cuda:12.9.1-devel-ubuntu24.04
+      image: quay.io/pypa/manylinux_2_28_x86_64
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install system dependencies
-        run: |
-          apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            build-essential \
-            clang \
-            cmake \
-            curl \
-            git \
-            just \
-            libprotobuf-dev \
-            libssl-dev \
-            patchelf \
-            pkg-config \
-            protobuf-compiler
+        run: ./tools/bootstrap_build_env.sh
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -45,11 +32,12 @@ jobs:
         with:
           enable-cache: true
 
-      - name: Install Python 3.12
-        run: uv python install 3.12
+      - name: Use bundled Python 3.12
+        run: echo "/opt/python/cp312-cp312/bin" >> "$GITHUB_PATH"
 
       - uses: Swatinem/rust-cache@v2
         with:
+          prefix-key: manylinux-2.28-v1
           workspaces: |
             backends/cuvs_26_02 -> target
 
diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index 78b4f7e..7b901d7 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -17,26 +17,13 @@ jobs:
   build-wheels:
     runs-on: ubuntu-24.04
     container:
-      image: nvidia/cuda:12.9.1-devel-ubuntu24.04
+      image: quay.io/pypa/manylinux_2_28_x86_64
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install system dependencies
-        run: |
-          apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            build-essential \
-            clang \
-            cmake \
-            curl \
-            git \
-            just \
-            libprotobuf-dev \
-            libssl-dev \
-            patchelf \
-            pkg-config \
-            protobuf-compiler
+        run: ./tools/bootstrap_build_env.sh
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -44,11 +31,12 @@ jobs:
         with:
           enable-cache: true
 
-      - name: Install Python 3.12
-        run: uv python install 3.12
+      - name: Use bundled Python 3.12
+        run: echo "/opt/python/cp312-cp312/bin" >> "$GITHUB_PATH"
 
       - uses: Swatinem/rust-cache@v2
         with:
+          prefix-key: manylinux-2.28-v1
           workspaces: |
             backends/cuvs_26_02 -> target
 
diff --git a/.github/workflows/rust-build.yml b/.github/workflows/rust-build.yml
index bc44310..1739002 100644
--- a/.github/workflows/rust-build.yml
+++ b/.github/workflows/rust-build.yml
@@ -17,25 +17,13 @@ jobs:
   rust-quality:
     runs-on: ubuntu-24.04
     container:
-      image: nvidia/cuda:12.9.1-devel-ubuntu24.04
+      image: quay.io/pypa/manylinux_2_28_x86_64
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install system dependencies
-        run: |
-          apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            build-essential \
-            clang \
-            cmake \
-            curl \
-            git \
-            just \
-            libprotobuf-dev \
-            libssl-dev \
-            pkg-config \
-            protobuf-compiler
+        run: ./tools/bootstrap_build_env.sh
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -45,11 +33,12 @@ jobs:
         with:
           enable-cache: true
 
-      - name: Install Python 3.12
-        run: uv python install 3.12
+      - name: Use bundled Python 3.12
+        run: echo "/opt/python/cp312-cp312/bin" >> "$GITHUB_PATH"
 
       - uses: Swatinem/rust-cache@v2
         with:
+          prefix-key: manylinux-2.28-v1
           workspaces: |
             backends/cuvs_26_02 -> target
 
diff --git a/Justfile b/Justfile
index dbfcfe4..8615d79 100644
--- a/Justfile
+++ b/Justfile
@@ -5,6 +5,7 @@ uv_project := "uv run --project '" + root + "' --no-sync"
 cmake_cmd := uv_project + " python -c 'import shutil; print(shutil.which(\"cmake\") or \"\")'"
 rapids_env := "export CMAKE=\"$(" + cmake_cmd + ")\"; eval \"$(" + uv_project + " python tools/rapids_env.py --format shell)\""
 dist_dir := root + "/dist"
+backend_wheel_compatibility := "manylinux_2_28"
 
 default:
   @just --list
@@ -21,7 +22,7 @@ loader-test: sync-dev
 backend-wheel: sync-dev
   rm -rf dist
   mkdir -p dist
-  {{rapids_env}} && cd backends/cuvs_26_02 && {{uv_project}} maturin build --release --locked --compatibility linux --auditwheel skip --out ../../dist
+  {{rapids_env}} && cd backends/cuvs_26_02 && {{uv_project}} maturin build --release --locked --compatibility {{backend_wheel_compatibility}} --auditwheel skip --out ../../dist
 
 backend-develop: sync-dev
   {{rapids_env}} && cd backends/cuvs_26_02 && {{uv_project}} maturin develop --release --locked
@@ -34,7 +35,7 @@ build-wheels: sync-dev
     python/lance_cuvs/_loader.py \
     backends/cuvs_26_02/python/lance_cuvs_backend_cu12/__init__.py
   uv build --wheel --out-dir dist
-  {{rapids_env}} && cd backends/cuvs_26_02 && {{uv_project}} maturin build --release --locked --compatibility linux --auditwheel skip --out ../../dist
+  {{rapids_env}} && cd backends/cuvs_26_02 && {{uv_project}} maturin build --release --locked --compatibility {{backend_wheel_compatibility}} --auditwheel skip --out ../../dist
 
 python-build: build-wheels test-loader-wheel
   @:
diff --git a/tools/bootstrap_build_env.sh b/tools/bootstrap_build_env.sh
new file mode 100755
index 0000000..e7c5d57
--- /dev/null
+++ b/tools/bootstrap_build_env.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+PROTOC_MIN_VERSION=3.15.0
+PROTOC_FALLBACK_VERSION=31.1
+
+version_ge() {
+  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
+}
+
+ensure_modern_protoc() {
+  local current_version=""
+
+  if command -v protoc >/dev/null 2>&1; then
+    current_version="$(protoc --version | awk '{print $2}')"
+  fi
+
+  if [ -n "$current_version" ] && version_ge "$current_version" "$PROTOC_MIN_VERSION"; then
+    return
+  fi
+
+  local archive="protoc-${PROTOC_FALLBACK_VERSION}-linux-x86_64.zip"
+  local download_url="https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_FALLBACK_VERSION}/${archive}"
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+  trap 'rm -rf "$tmpdir"' RETURN
+
+  curl -LsSf "$download_url" -o "$tmpdir/$archive"
+  unzip -q "$tmpdir/$archive" -d /usr/local
+}
+
+if command -v apt-get >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update
+  apt-get install -y --no-install-recommends \
+    bash \
+    build-essential \
+    ca-certificates \
+    clang \
+    cmake \
+    curl \
+    git \
+    libprotobuf-dev \
+    libssl-dev \
+    patchelf \
+    pkg-config \
+    protobuf-compiler \
+    unzip
+elif command -v dnf >/dev/null 2>&1; then
+  dnf install -y \
+    bash \
+    ca-certificates \
+    clang \
+    cmake \
+    curl \
+    gcc \
+    gcc-c++ \
+    git \
+    openssl-devel \
+    patchelf \
+    pkgconf-pkg-config \
+    protobuf-compiler \
+    protobuf-devel \
+    unzip
+elif command -v yum >/dev/null 2>&1; then
+  yum install -y \
+    bash \
+    ca-certificates \
+    clang \
+    cmake \
+    curl \
+    gcc \
+    gcc-c++ \
+    git \
+    openssl-devel \
+    patchelf \
+    pkgconfig \
+    protobuf-compiler \
+    protobuf-devel \
+    unzip
+else
+  echo "Unsupported package manager" >&2
+  exit 1
+fi
+
+if ! command -v cargo >/dev/null 2>&1; then
+  curl -LsSf https://sh.rustup.rs | sh -s -- -y --profile minimal
+  export PATH="${HOME}/.cargo/bin:${PATH}"
+  rustup toolchain install stable
+fi
+
+if ! command -v uv >/dev/null 2>&1; then
+  curl -LsSf https://astral.sh/uv/install.sh | sh
+  export PATH="${HOME}/.local/bin:${PATH}"
+fi
+
+if ! command -v just >/dev/null 2>&1; then
+  cargo install just --locked
+fi
+
+ensure_modern_protoc
+
+if command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1; then
+  if [[ ! -x /usr/local/cuda/bin/nvcc && ! -x /usr/local/cuda-12.9/bin/nvcc ]]; then
+    curl -fsSL -o /etc/yum.repos.d/cuda-rhel8.repo \
+      https://developer.download.nvidia.com/compute/cuda/repos/rhel8/x86_64/cuda-rhel8.repo
+    rpm --import https://developer.download.nvidia.com/compute/cuda/repos/rhel8/x86_64/D42D0685.pub
+    if command -v dnf >/dev/null 2>&1; then
+      dnf install -y cuda-toolkit-12-9
+    else
+      yum install -y cuda-toolkit-12-9
+    fi
+  fi
+fi
+
+if [[ -d /opt/python/cp312-cp312/bin ]]; then
+  export PATH="/opt/python/cp312-cp312/bin:${PATH}"
+fi
diff --git a/tools/run_in_container.sh b/tools/run_in_container.sh
index d5f56f0..c24518d 100755
--- a/tools/run_in_container.sh
+++ b/tools/run_in_container.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-IMAGE_TAG="${LANCE_CUVS_CONTAINER_IMAGE:-nvidia/cuda:12.9.1-devel-ubuntu24.04}"
+IMAGE_TAG="${LANCE_CUVS_CONTAINER_IMAGE:-quay.io/pypa/manylinux_2_28_x86_64}"
 PLATFORM="${LANCE_CUVS_CONTAINER_PLATFORM:-}"
 GPU_ARGS=()
 TTY_ARGS=()
@@ -68,30 +68,7 @@ docker "${DOCKER_ARGS[@]}" \
   "$IMAGE_TAG" \
   bash -lc '
     set -euo pipefail
-    export PATH=/root/.cargo/bin:/root/.local/bin:$PATH
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get install -y --no-install-recommends \
-      bash \
-      build-essential \
-      ca-certificates \
-      clang \
-      cmake \
-      curl \
-      git \
-      just \
-      libprotobuf-dev \
-      libssl-dev \
-      patchelf \
-      pkg-config \
-      protobuf-compiler
-    if ! command -v cargo >/dev/null 2>&1; then
-      curl -LsSf https://sh.rustup.rs | sh -s -- -y --profile minimal
-      rustup toolchain install stable
-    fi
-    if ! command -v uv >/dev/null 2>&1; then
-      curl -LsSf https://astral.sh/uv/install.sh | sh
-    fi
-    uv python install 3.12
+    export PATH=/root/.cargo/bin:/root/.local/bin:/opt/python/cp312-cp312/bin:$PATH
+    /work/tools/bootstrap_build_env.sh
     exec "$@"
   ' bash "$@"