diff --git a/buildrpms.pl b/buildrpms.pl
index cad4c670d..590b81ae0 100755
--- a/buildrpms.pl
+++ b/buildrpms.pl
@@ -238,130 +238,23 @@ sub buildsources_genesis_base($) {
 
     die "Assertion failed! No directory xCAT-genesis-builder in the current directory"
         unless -d "./xCAT-genesis-builder";
+    my $staging_parent = "/tmp/xcat-genesis-base-build-support.$$";
+    my $staging_root = "$staging_parent/xCAT-genesis-base-build-support";
+    my $support_tarball = "$SOURCES/xCAT-genesis-base-build-support.tar.bz2";
 
-    my @deps = qw(
-        bind-utils
-        dosfstools
-        ethtool
-        ipmitool
-        kexec-tools
-        lldpad
-        mdadm
-        mstflint
-        nmap-ncat
-        net-tools
-        pciutils
-        psmisc
-        rpm-build
-        rpmdevtools
-        screen
-        usbutils
+    remove_tree($staging_parent) if -e $staging_parent;
+    make_path("$staging_root/dracut_105");
 
-        nfs-utils rpcbind
-        dhclient
-    );
-    sh("dnf install -y " . join " ", @deps)
-        and die "Error installing packages $?";
+    sh(qq(cp -a "xCAT-genesis-builder/dracut_105" "$staging_root/"))
+        and die "Error copying dracut_105 sources";
+    cp "xCAT-genesis-builder/80-net-name-slot.rules",
+       "$staging_root/80-net-name-slot.rules";
 
+    unlink $support_tarball if -f $support_tarball;
+    sh(qq(tar -cjf "$support_tarball" -C "$staging_parent" xCAT-genesis-base-build-support))
+        and die "Error creating $support_tarball";
 
-    my $dracutmoddir = "/usr/lib/dracut/modules.d/97xcat/";
-
-    my $targetarch = targetarch_from_target($target);
-    my $buildarch = genesis_tarch_from_targetarch($targetarch);
-    my $kernelversion = `uname -r`;
-    chomp $kernelversion;
-
-    my $genesispath = "/tmp/xcatgenesis.$$";
-    my $buildpath = "$genesispath/opt/xcat/share/xcat/netboot/genesis/$buildarch";
-
-    make_path $dracutmoddir;
-    make_path "$buildpath/fs/etc/ssh/";
-
-    my @files = map { "$Bin/xCAT-genesis-builder/dracut_105/el/$_" }
-        qw(
-            module-setup.sh
-            xcat-cmdline.sh
-            xcatroot
-            dhclient.conf
-            dhclient-script
-            rsyslog.conf
-        );
-    # copy @files to $dracutmoddir
-    cp $_, $dracutmoddir for @files;
-
-    # The dependents of these must be updated
-    # * netstat
-    # * /sbin/route
-    # * /sbin/ifconfig -> net-tool
-    # * nslookup
-
-
-
-    my $opts = $opts{verbose} ? "set -x" : "";
-    sh(<<"EOF");
-$opts
-dracut --compress gzip -m "xcat base" --no-early-microcode -N -f $genesispath.rfs;
-rm -rf $buildpath/fs || :
-mkdir -p $buildpath/fs || :
-cd $buildpath/fs
-zcat $genesispath.rfs | cpio -dumi
-EOF
-
-    # Ensure helper scripts remain executable in genesis rootfs.
-    # EL10 discovery needs dhclient-script to be executable.
-    for my $script (
-        "$buildpath/fs/sbin/dhclient-script",
-        "$buildpath/fs/usr/sbin/dhclient-script",
-        "$buildpath/fs/sbin/xcatroot",
-    ) {
-        chmod 0755, $script if -f $script;
-    }
-
-    my @perl_lib_dir = qw(
-        /usr/share/perl5
-        /usr/lib64/perl5
-        /usr/local/lib64/perl5
-        /usr/local/share/perl5
-        /usr/share/ntp/lib
-    );
-
-    for my $d (@perl_lib_dir) {
-        next unless -d $d;
-        my $temp_dir = "$buildpath/fs/$d";
-        make_path $temp_dir;
-        # cp function does not copy directories recursively
-        `cp -a -t $temp_dir $d/.`;
-    }
-
-    make_path "$buildpath/fs/lib/udev/rules.d/";
-    my $oldcwd = Cwd::cwd();
-    my $lib_udev_rules="/lib/udev/rules.d/";
-    cp "$lib_udev_rules/80-net-name-slot.rules", "$buildpath/fs/lib/udev/rules.d/"
-        if -e "$lib_udev_rules/80-net-name-slot.rules";
-
-    # Keep historical layout: kernel is a file, not a directory.
-    # mknb expects genesis/<arch>/kernel to be copied as a kernel file.
-    unlink "$buildpath/kernel" if -l "$buildpath/kernel" || -f "$buildpath/kernel";
-    remove_tree "$buildpath/kernel" if -d "$buildpath/kernel";
-    cp "/boot/vmlinuz-$kernelversion", "$buildpath/kernel";
-
-    # Create the targz
-    #
-    # Note:
-    #
-    #   Deletes character devices from the genesis-base
-    #   image filesystem prior to tarball creation. The installation
-    #   of the package fails in vanilla containers with "Operation not
-    #   permited" during the creation of
-    #
-    #       /opt/xcat/../genesis/../fs/dev/{console,random,...}
-    #
-    #   otherwise.
-    sh(<<"EOF")
-cd $genesispath
-find . -type c -delete
-tar jcf $SOURCES/xCAT-genesis-base-$buildarch.tar.bz2 opt
-EOF
+    remove_tree($staging_parent);
 }
 
 sub buildsources {
diff --git a/xCAT-genesis-builder/dracut_105/el/module-setup.sh b/xCAT-genesis-builder/dracut_105/el/module-setup.sh
index 805d70fe2..81f2c052e 100755
--- a/xCAT-genesis-builder/dracut_105/el/module-setup.sh
+++ b/xCAT-genesis-builder/dracut_105/el/module-setup.sh
@@ -630,7 +630,7 @@ install() {
     dracut_install /etc/chrony.conf
     _dracut_install_opt /etc/chrony.keys
     dracut_install /run/rpcbind
-    _dracut_install_opt /etc/systemd/system.conf /usr/lib/systemd/system.conf
+    _dracut_install_opt /etc/systemd/system.conf
     dracut_install /sbin/rpc.statd /usr/sbin/sm-notify /etc/netconfig rpcbind /etc/host.conf /usr/sbin/rpc.idmapd
     dracut_install ps free find #debug
     inst_dir /var/lib/nfs
diff --git a/xCAT-genesis-builder/xCAT-genesis-base.spec b/xCAT-genesis-builder/xCAT-genesis-base.spec
index f08d38b05..27eac8751 100644
--- a/xCAT-genesis-builder/xCAT-genesis-base.spec
+++ b/xCAT-genesis-builder/xCAT-genesis-base.spec
@@ -30,8 +30,51 @@ License: Various (see individual packages for details)
 Vendor: IBM Corp.
 Summary: xCAT Genesis netboot image
 URL:	 https://xcat.org/
-Source1: xCAT-genesis-base-%{tarch}.tar.bz2
+Source0: xCAT-genesis-base-build-support.tar.bz2
 Conflicts: xCAT-genesis-scripts-%{tarch} < 1:2.13.10
+BuildRequires: bc
+BuildRequires: bind-utils
+BuildRequires: chrony
+BuildRequires: cpio
+BuildRequires: dhcp-client
+BuildRequires: e2fsprogs
+BuildRequires: hostname
+%if "%{_target_cpu}" == "x86_64"
+BuildRequires: dmidecode
+BuildRequires: efibootmgr
+%endif
+BuildRequires: dosfstools
+BuildRequires: dracut
+BuildRequires: dracut-network
+BuildRequires: ethtool
+BuildRequires: gawk
+BuildRequires: ipmitool
+BuildRequires: iproute
+BuildRequires: kexec-tools
+BuildRequires: kernel-core
+BuildRequires: lldpad
+BuildRequires: lvm2
+BuildRequires: mdadm
+BuildRequires: mstflint
+BuildRequires: net-tools
+BuildRequires: nfs-utils
+BuildRequires: nmap-ncat
+BuildRequires: openssh-clients
+BuildRequires: openssh-server
+BuildRequires: parted
+BuildRequires: pciutils
+BuildRequires: perl
+BuildRequires: perl-interpreter
+BuildRequires: procps-ng
+BuildRequires: psmisc
+BuildRequires: rsync
+BuildRequires: rsyslog
+BuildRequires: screen
+BuildRequires: usbutils
+BuildRequires: util-linux
+BuildRequires: vim-minimal
+BuildRequires: wget
+BuildRequires: xfsprogs
 
 Buildroot: %{_localstatedir}/tmp/xCAT-genesis
 Packager: IBM Corp.
@@ -40,17 +83,115 @@ Packager: IBM Corp.
 xCAT genesis (Genesis Enhanced Netboot Environment for System Information and Servicing) is a small, embedded-like environment for xCAT's use in discovery and management actions when interaction with an OS is infeasible.
 This package comprises the base platform with most of the xCAT specific behavior left to xCAT-genesis-scripts package.
 Built in environment "%dist" on %{_arch}.
-%Prep
+%prep
+%setup -q -n xCAT-genesis-base-build-support
 
 
-%Build
+%build
 
 %Install
+set -euxo pipefail
+
 rm -rf $RPM_BUILD_ROOT
-mkdir -p $RPM_BUILD_ROOT
-cd $RPM_BUILD_ROOT
-tar jxf %{SOURCE1}
-cd -
+mkdir -p $RPM_BUILD_ROOT/%{prefix}/share/xcat/netboot/genesis/%{tarch}
+
+GENESIS_TMPDIR=$(mktemp -d %{_tmppath}/xcat-genesis.%{tarch}.XXXXXX)
+GENESIS_ROOT=$GENESIS_TMPDIR/%{prefix}/share/xcat/netboot/genesis/%{tarch}
+GENESIS_FS=$GENESIS_ROOT/fs
+DRACUT_IMAGE=$GENESIS_TMPDIR/genesis.rfs
+
+cleanup() {
+    rm -rf "$GENESIS_TMPDIR"
+    rm -rf "$DRACUTMODDIR"
+}
+trap cleanup EXIT
+
+if [ -d /usr/share/dracut/modules.d ]; then
+    DRACUT_PARENT=/usr/share/dracut/modules.d
+else
+    DRACUT_PARENT=/usr/lib/dracut/modules.d
+fi
+DRACUTMODDIR=$DRACUT_PARENT/97xcat
+rm -rf "$DRACUTMODDIR"
+mkdir -p "$DRACUTMODDIR"
+cp -a "%{_builddir}/xCAT-genesis-base-build-support/dracut_105/el/." "$DRACUTMODDIR/"
+chmod 0755 "$DRACUTMODDIR/module-setup.sh" "$DRACUTMODDIR/xcatroot" "$DRACUTMODDIR/dhclient-script"
+if [ "%{_target_cpu}" != "x86_64" ]; then
+    sed -i '/efibootmgr dmidecode/d' "$DRACUTMODDIR/module-setup.sh"
+fi
+
+KERNELVERSION=$(ls -1 /lib/modules | sort -V | tail -n 1)
+test -n "$KERNELVERSION"
+
+mkdir -p "$GENESIS_FS/etc/ssh"
+mkdir -p /run/rpcbind
+dracut --compress gzip -m "xcat base" --no-early-microcode -N -f "$DRACUT_IMAGE" "$KERNELVERSION"
+
+(
+    cd "$GENESIS_FS"
+    zcat "$DRACUT_IMAGE" | cpio -dumi
+)
+
+%if 0%{?rhel} > 0 && 0%{?rhel} <= 9
+# EL9 upgrade safety depends on this remaining a real directory.
+if [ ! -d "$GENESIS_FS/usr/lib/dracut/hooks" ] || [ -L "$GENESIS_FS/usr/lib/dracut/hooks" ]; then
+    echo "EL%{?rhel} genesis payload has invalid usr/lib/dracut/hooks layout" >&2
+    exit 1
+fi
+%endif
+
+for script in \
+    "$GENESIS_FS/sbin/dhclient-script" \
+    "$GENESIS_FS/usr/sbin/dhclient-script" \
+    "$GENESIS_FS/sbin/xcatroot"
+do
+    if [ -f "$script" ]; then
+        chmod 0755 "$script"
+    fi
+done
+
+for perl_dir in \
+    /usr/share/perl5 \
+    /usr/lib64/perl5 \
+    /usr/local/lib64/perl5 \
+    /usr/local/share/perl5 \
+    /usr/share/ntp/lib
+do
+    if [ -d "$perl_dir" ]; then
+        mkdir -p "$GENESIS_FS$perl_dir"
+        cp -a "$perl_dir/." "$GENESIS_FS$perl_dir/"
+    fi
+done
+
+mkdir -p "$GENESIS_FS/lib/udev/rules.d"
+if [ -e /lib/udev/rules.d/80-net-name-slot.rules ]; then
+    cp /lib/udev/rules.d/80-net-name-slot.rules "$GENESIS_FS/lib/udev/rules.d/"
+else
+    cp "%{_builddir}/xCAT-genesis-base-build-support/80-net-name-slot.rules" \
+       "$GENESIS_FS/lib/udev/rules.d/"
+fi
+
+KERNEL_IMAGE=/boot/vmlinuz-$KERNELVERSION
+if [ ! -e "$KERNEL_IMAGE" ]; then
+    for candidate in \
+        "/usr/lib/modules/$KERNELVERSION/vmlinuz" \
+        "/lib/modules/$KERNELVERSION/vmlinuz" \
+        "$(find /usr/lib/modules/$KERNELVERSION -maxdepth 2 -name 'vmlinuz*' 2>/dev/null | head -n 1)" \
+        "$(find /lib/modules/$KERNELVERSION -maxdepth 2 -name 'vmlinuz*' 2>/dev/null | head -n 1)" \
+        "$(ls -1 /boot/vmlinuz-* 2>/dev/null | sort -V | tail -n 1)"
+    do
+        if [ -n "$candidate" ] && [ -e "$candidate" ]; then
+            KERNEL_IMAGE="$candidate"
+            break
+        fi
+    done
+fi
+test -n "$KERNEL_IMAGE"
+test -e "$KERNEL_IMAGE"
+cp "$KERNEL_IMAGE" "$GENESIS_ROOT/kernel"
+
+find "$GENESIS_TMPDIR" -type c -delete
+cp -a "$GENESIS_TMPDIR/%{prefix}/." "$RPM_BUILD_ROOT/%{prefix}/"
 
 
 %pretrans -p <lua>
diff --git a/xCAT-genesis-scripts/xCAT-genesis-scripts.spec b/xCAT-genesis-scripts/xCAT-genesis-scripts.spec
index ce89077a5..5202c1ed0 100644
--- a/xCAT-genesis-scripts/xCAT-genesis-scripts.spec
+++ b/xCAT-genesis-scripts/xCAT-genesis-scripts.spec
@@ -32,7 +32,7 @@ Vendor: IBM Corp.
 Summary: xCAT Genesis netboot image - Core content
 URL:	 https://xcat.org/
 Source1: xCAT-genesis-scripts.tar.bz2
-Requires: xCAT-genesis-base-%{tarch} >= 2:2.13.10
+Requires: xCAT-genesis-base-%{tarch} = 2:%{version}-%{release}
 
 Buildroot: %{_localstatedir}/tmp/xCAT-genesis
 Packager: IBM Corp.
diff --git a/xCAT-server/xCAT-server.spec b/xCAT-server/xCAT-server.spec
index c021649f4..8c188efe1 100644
--- a/xCAT-server/xCAT-server.spec
+++ b/xCAT-server/xCAT-server.spec
@@ -52,7 +52,9 @@ Obsoletes: atftp-xcat
 #
 # PCM does not use or ship grub2-xcat
 %if %nots390x
-Requires: grub2-xcat >= 2.02-0.76.el7.1.snap201905160255 perl-Net-HTTPS-NB perl-HTTP-Async
+Requires: grub2-xcat >= 2.02-0.76.el7.1.snap201905160255
+Requires: perl-Net-HTTPS-NB >= 0.14-3
+Requires: perl-HTTP-Async >= 0.30-3
 %endif
 %endif
 %endif
@@ -127,6 +129,23 @@ mkdir -p $RPM_BUILD_ROOT/%{prefix}/lib/perl/xCAT
 %ifos linux
 cp -a share/xcat/install/* $RPM_BUILD_ROOT/%{prefix}/share/xcat/install/
 cp -a share/xcat/netboot/* $RPM_BUILD_ROOT/%{prefix}/share/xcat/netboot/
+
+# Preserve netboot dracut aliases as symlinks so rpm upgrades do not fail when
+# replacing older xCAT-server packages that already own these paths as symlinks.
+for _required_symlink in \
+    SL/dracut_033 \
+    alma/dracut alma/dracut_033 alma/dracut_047 \
+    centos/dracut centos/dracut_033 centos/dracut_047 \
+    fedora/dracut_047 \
+    ol/dracut ol/dracut_033 ol/dracut_047 \
+    rocky/dracut rocky/dracut_033 rocky/dracut_047 rocky/dracut_105
+do
+    _target="$RPM_BUILD_ROOT/%{prefix}/share/xcat/netboot/${_required_symlink}"
+    if [ ! -L "$_target" ]; then
+        echo "ERROR: expected symlink missing or dereferenced: $_target" >&2
+        exit 1
+    fi
+done
 %else
 cp -hpR share/xcat/install/* $RPM_BUILD_ROOT/%{prefix}/share/xcat/install/
 cp -hpR share/xcat/netboot/* $RPM_BUILD_ROOT/%{prefix}/share/xcat/netboot/
@@ -441,6 +460,16 @@ if [ -d $RPM_INSTALL_PREFIX0/share/xcat/devicetype/EthSwitch/Juniper ]; then
     rm -rf $RPM_INSTALL_PREFIX0/share/xcat/devicetype/EthSwitch/Juniper
 fi
 
+# Newer xCAT-server payloads replace legacy dracut symlinks with real
+# directories/files in several distro trees. Remove the old symlinks up front
+# so RPM can upgrade the package cleanly.
+for distro in SL alma centos fedora ol rocky; do
+    if [ -d "$RPM_INSTALL_PREFIX0/share/xcat/netboot/$distro" ]; then
+        find "$RPM_INSTALL_PREFIX0/share/xcat/netboot/$distro" \
+            -maxdepth 2 -type l -name 'dracut*' -exec rm -f {} +
+    fi
+done
+
 %post
 %ifos linux
 ln -sf $RPM_INSTALL_PREFIX0/sbin/xcatd /usr/sbin/xcatd
@@ -537,4 +566,3 @@ if [ $1 == 0 ]; then  #This means only on -e
 
 fi
 %endif
-
diff --git a/xCAT/xCAT.spec b/xCAT/xCAT.spec
index bb9af4f35..62beb6637 100644
--- a/xCAT/xCAT.spec
+++ b/xCAT/xCAT.spec
@@ -56,10 +56,10 @@ Requires: xCAT-server = 4:%{version}-%{release}
 Requires: xCAT-probe  = 4:%{version}-%{release}
 Requires: xCAT-genesis-scripts-%{genesistarch} = 1:%{version}-%{release}
 %ifarch x86_64
-Recommends: xCAT-genesis-scripts-ppc64 = 1:%{version}-%{release}
+Requires: xCAT-genesis-scripts-ppc64 = 1:%{version}-%{release}
 %endif
 %ifarch ppc ppc64 ppc64le
-Recommends: xCAT-genesis-scripts-x86_64 = 1:%{version}-%{release}
+Requires: xCAT-genesis-scripts-x86_64 = 1:%{version}-%{release}
 %endif
 %endif
 
@@ -76,30 +76,33 @@ Requires: /usr/sbin/dhcpd
 Requires: /usr/bin/ssh
 %if %nots390x
 Requires: /usr/sbin/in.tftpd
-Requires: xCAT-buildkit
+Requires: xCAT-buildkit = 4:%{version}-%{release}
 # Stty is only needed for rcons on ppc64 nodes, but for mixed clusters require it on both x and p
-Requires: perl-IO-Stty
+Requires: perl-IO-Stty >= 0.04-5
 %endif
 %endif
 
 %ifos linux
-Requires: goconserver >= 0.3.3
+Requires: goconserver >= 0.3.3-snap202011021058
 %endif
 
 #support mixed cluster
 %if %nots390x
-Requires: elilo-xcat
+Requires: elilo-xcat >= 3.14-6
 %endif
 
 %ifarch i386 i586 i686 x86 x86_64
-Requires: xnba-undi
-Requires: syslinux-xcat
-Requires: ipmitool-xcat >= 1.8.17-1
+Requires: xnba-undi >= 1.21.1-1
+Requires: syslinux-xcat >= 6.03-1
+Requires: ipmitool-xcat >= 1.8.18-4
 %endif
 
 %ifos linux
 %ifarch ppc ppc64 ppc64le
-Requires: ipmitool-xcat >= 1.8.17-1
+# Mixed-arch management nodes also need the x86 PXE stack kept current.
+Requires: xnba-undi >= 1.21.1-1
+Requires: syslinux-xcat >= 6.03-1
+Requires: ipmitool-xcat >= 1.8.18-4
 %endif
 %endif