diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..ea848ea
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: Apache-2.0
+
+#     Copyright (c) 2024 SUSE LLC
+
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon.
+
+# The content of THIS FILE IS AUTOGENERATED and should not be manually modified.
+# It is maintained by the BCI team and generated by
+# https://github.com/SUSE/BCI-dockerfile-generator
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+# You can contact the BCI team via https://github.com/SUSE/bci/discussions
+
+#!UseOBSRepositories
+
+#!BuildTag: opensuse/helm:%%helm_version%%-%RELEASE%
+#!BuildTag: opensuse/helm:%%helm_version%%
+#!BuildTag: opensuse/helm:3.16
+#!BuildTag: opensuse/helm:3
+#!BuildTag: opensuse/helm:latest
+
+FROM opensuse/bci/bci-micro:latest AS target
+FROM opensuse/tumbleweed:latest AS builder
+COPY --from=target / /target
+
+RUN set -euo pipefail; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends ca-certificates-mozilla helm; \
+    zypper -n clean; \
+    rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
+# sanity check that the version from the tag is equal to the version of helm that we expect
+RUN set -euo pipefail; \
+    [ "$(rpm --root /target -q --qf '%{version}' helm | \
+    cut -d '.' -f -2)" = "3.16" ]
+FROM opensuse/bci/bci-micro:latest
+COPY --from=builder /target /
+# Define labels according to https://en.opensuse.org/Building_derived_containers
+# labelprefix=org.opensuse.application.helm
+LABEL org.opencontainers.image.title="openSUSE Tumbleweed Kubernetes Package Manager"
+LABEL org.opencontainers.image.description="Kubernetes Package Manager container based on the openSUSE Tumbleweed Base Container Image."
+LABEL org.opencontainers.image.version="%%helm_version%%"
+LABEL org.opencontainers.image.url="https://www.opensuse.org"
+LABEL org.opencontainers.image.created="%BUILDTIME%"
+LABEL org.opencontainers.image.vendor="openSUSE Project"
+LABEL org.opencontainers.image.source="%SOURCEURL%"
+LABEL org.opencontainers.image.ref.name="%%helm_version%%-%RELEASE%"
+LABEL org.opensuse.reference="registry.opensuse.org/opensuse/helm:%%helm_version%%-%RELEASE%"
+LABEL org.openbuildservice.disturl="%DISTURL%"
+LABEL org.opensuse.lifecycle-url="https://en.opensuse.org/Lifetime#openSUSE_BCI"
+LABEL org.opensuse.release-stage="released"
+# endlabelprefix
+LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/SUSE/BCI-dockerfile-generator/Tumbleweed/helm-image/README.md"
+ENTRYPOINT ["/usr/bin/helm"]
+CMD ["help"]
diff --git a/_service b/_service
index 695a3f0..978525b 100644
--- a/_service
+++ b/_service
@@ -1,4 +1,10 @@
 <services>
-  <service mode="buildtime" name="kiwi_label_helper"/>
+  <service mode="buildtime" name="docker_label_helper"/>
   <service mode="buildtime" name="kiwi_metainfo_helper"/>
+  <service mode="buildtime" name="replace_using_package_version">
+    <param name="file">Dockerfile</param>
+    <param name="regex">%%helm_version%%</param>
+    <param name="package">helm</param>
+    <param name="parse-version">patch</param>
+  </service>
 </services>
\ No newline at end of file
diff --git a/config.sh b/config.sh
deleted file mode 100644
index aacf7bb..0000000
--- a/config.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: MIT
-# SPDX-FileCopyrightText: (c) 2022-2024 SUSE LLC
-
-set -euo pipefail
-
-test -f /.kconfig && . /.kconfig
-test -f /.profile && . /.profile
-
-echo "Configure image: [$kiwi_iname]..."
-
-#============================================
-# Import repositories' keys if rpm is present
-#--------------------------------------------
-if command -v rpm > /dev/null; then
-    suseImportBuildKey
-fi
-
-
-
-#=======================================
-# Clean up after zypper if it is present
-#---------------------------------------
-if command -v zypper > /dev/null; then
-    zypper -n clean
-fi
-
-rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
-
-exit 0
diff --git a/helm-image.changes b/helm-image.changes
index 3763013..98b8216 100644
--- a/helm-image.changes
+++ b/helm-image.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Dec  9 20:58:52 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
+
+- switch to multibuild and add a version check at build time to avoid releasing incorrectly tagged containers
+
 -------------------------------------------------------------------
 Wed Oct 30 15:34:45 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
 
diff --git a/helm-image.kiwi b/helm-image.kiwi
deleted file mode 100644
index 153d974..0000000
--- a/helm-image.kiwi
+++ /dev/null
@@ -1,66 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- SPDX-License-Identifier: Apache-2.0 -->
-<!--
-    Copyright (c) 2024 SUSE LLC
-
-All modifications and additions to the file contributed by third parties
-remain the property of their copyright owners, unless otherwise agreed
-upon.
-
-The content of THIS FILE IS AUTOGENERATED and should not be manually modified.
-It is maintained by the BCI team and generated by
-https://github.com/SUSE/BCI-dockerfile-generator
-
-Please submit bugfixes or comments via https://bugs.opensuse.org/
-You can contact the BCI team via https://github.com/SUSE/bci/discussions
--->
-<!-- OBS-AddTag: opensuse/helm:3.16-%RELEASE% opensuse/helm:3.16 opensuse/helm:latest -->
-<!-- OBS-Imagerepo: obsrepositories:/ -->
-
-<image schemaversion="7.4" name="helm-image" xmlns:suse_label_helper="com.suse.label_helper">
-  <description type="system">
-    <author>openSUSE Project</author>
-    <contact>https://www.suse.com/</contact>
-    <specification>openSUSE Tumbleweed Kubernetes Package Manager Container Image</specification>
-  </description>
-  <preferences>
-    <type image="docker" derived_from="obsrepositories:/opensuse/bci/bci-micro#latest">
-      <containerconfig
-          name="opensuse/helm"
-          tag="3.16-%RELEASE%"
-          additionaltags="3.16,latest">
-        <labels>
-          <suse_label_helper:add_prefix prefix="org.opensuse.application.helm">
-            <label name="org.opencontainers.image.title" value="openSUSE Tumbleweed Kubernetes Package Manager"/>
-            <label name="org.opencontainers.image.description" value="Kubernetes Package Manager container based on the openSUSE Tumbleweed Base Container Image."/>
-            <label name="org.opencontainers.image.version" value="3.16"/>
-            <label name="org.opencontainers.image.created" value="%BUILDTIME%"/>
-            <label name="org.opencontainers.image.vendor" value="openSUSE Project"/>
-            <label name="org.opencontainers.image.source" value="%SOURCEURL%"/>
-            <label name="org.opencontainers.image.url" value="https://www.opensuse.org"/>
-            <label name="org.opencontainers.image.ref.name" value="3.16-%RELEASE%"/>
-            <label name="org.opensuse.reference" value="registry.opensuse.org/opensuse/helm:3.16-%RELEASE%"/>
-            <label name="org.openbuildservice.disturl" value="%DISTURL%"/>
-            <label name="org.opensuse.release-stage" value="released"/>
-            <label name="org.opensuse.lifecycle-url" value="https://en.opensuse.org/Lifetime#openSUSE_BCI"/>
-          </suse_label_helper:add_prefix>
-          <label name="io.artifacthub.package.readme-url" value="https://raw.githubusercontent.com/SUSE/BCI-dockerfile-generator/Tumbleweed/helm-image/README.md"/>
-        </labels>
-        <subcommand execute="help"/>
-        <entrypoint execute="/usr/bin/helm"/>
-      </containerconfig>
-    </type>
-    <version>2024</version>
-    <packagemanager>zypper</packagemanager>
-    <rpm-check-signatures>false</rpm-check-signatures>
-    <rpm-excludedocs>true</rpm-excludedocs>
-  </preferences>
-  <repository type="rpm-md">
-    <source path="obsrepositories:/"/>
-  </repository>
-  <packages type="bootstrap">
-    <package name="ca-certificates-mozilla"/>
-    <package name="helm"/>
-  </packages>
-
-</image>
\ No newline at end of file