diff --git a/buildrpms.pl b/buildrpms.pl
index 6054b4a68..63004ce4b 100755
--- a/buildrpms.pl
+++ b/buildrpms.pl
@@ -101,6 +101,13 @@ my $DISTRO = $OS{ID};
 # almalinux+epel-* config, so translate the os-release ID accordingly.
 $DISTRO = "alma" if $DISTRO eq "almalinux";
 
+# xCAT-genesis-base is intentionally NOT in the default build set below. Its
+# payload is a dracut-built initramfs that bundles the build chroot's kernel +
+# glibc/busybox/perl, so it is OS-dependent (an el10 build cannot boot el8/el9
+# nodes). It is built per target by the xcat-dep pipeline
+# (xcat-dep/mockbuild-all.pl, via `buildrpms.pl --package xCAT-genesis-base`)
+# and shipped in the per-EL repo xcat-dep/rh<N>, NOT in the flat xcat-core. The
+# build logic further down still supports `--package xCAT-genesis-base`.
 my @PACKAGES = qw(
     perl-xCAT
     xCAT
@@ -108,7 +115,6 @@ my @PACKAGES = qw(
     xCAT-buildkit
     xCAT-client
     xCAT-confluent
-    xCAT-genesis-base
     xCAT-genesis-scripts
     xCAT-openbmc-py
     xCAT-probe
@@ -162,10 +168,11 @@ GetOptions(
     "setup_local_repos" => \$opts{setup_local_repos},
 ) or usage();
 
-# Release is regenerated at each run so every build gets a fresh snapshot
-# release, unless pinned with --release (e.g. to rebuild a single package
-# matching the release the rest of the repo was built with).
-my $RELEASE = $opts{release} || strftime("snap%Y%m%d%H%M", localtime);
+# Release is derived from SOURCE_DATE_EPOCH (the git commit time), NOT wall-clock,
+# so identical sources -> identical Version-Release -> bit-reproducible packages
+# (a hard requirement for the content-addressed/Merkle-DAG CI). Override with
+# --release to rebuild a single package matching an existing repo's release.
+my $RELEASE = $opts{release} || strftime("snap%Y%m%d%H%M", gmtime($SOURCE_DATE_EPOCH));
 write_text("Release", "$RELEASE\n");
 
 sub usage {
diff --git a/xCAT-server/xCAT-server.spec b/xCAT-server/xCAT-server.spec
index e0b1ec8c1..bc1d82438 100644
--- a/xCAT-server/xCAT-server.spec
+++ b/xCAT-server/xCAT-server.spec
@@ -68,7 +68,10 @@ Requires: perl-HTTP-Async >= 0.30-3
 Requires: initscripts
 Requires: chkconfig
 %endif
-%if 0%{?rhel} >= 10
+# openssl is present on all EL; require it uniformly (not just el10) so a single
+# flat xcat-core build is correct everywhere. Excluded on SLES, where the package
+# name differs and it was never required before.
+%if !0%{?suse_version}
 Requires: openssl
 %endif
 
diff --git a/xCAT/xCAT.spec b/xCAT/xCAT.spec
index b5e665def..0ccc8a945 100644
--- a/xCAT/xCAT.spec
+++ b/xCAT/xCAT.spec
@@ -64,13 +64,14 @@ Requires: httpd nfs-utils nmap bind perl(CGI)
 # on RHEL7, need to specify it explicitly
 Requires: net-tools
 Requires: /usr/bin/killall
-# On RHEL this pulls in dhcp, on SLES it pulls in dhcp-server. EL10 uses Kea.
-%if 0%{?rhel} >= 10
-Requires: kea
-Requires: kea-hooks
-%else
-Requires: /usr/sbin/dhcpd
-%endif
+# DHCP backend resolved at INSTALL time (not build time) via an RPM rich
+# dependency, so a single flat xcat-core build is correct on every EL: el10+
+# dropped ISC dhcp from its distro and uses Kea; el8/el9 use ISC dhcpd. SLES
+# has no "system-release" provide, so the condition is false there and it
+# falls to dhcp-server (/usr/sbin/dhcpd), preserving prior behavior.
+# system-release is versioned per release package (el10=10.x, el9=9.x, el8=8.x).
+Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
+Requires: (kea-hooks if (system-release >= 10))
 # On RHEL this pulls in openssh-server, on SLES it pulls in openssh
 Requires: /usr/bin/ssh
 %if %nots390x
diff --git a/xCATsn/xCATsn.spec b/xCATsn/xCATsn.spec
index b184bc02e..a24b6979d 100644
--- a/xCATsn/xCATsn.spec
+++ b/xCATsn/xCATsn.spec
@@ -48,13 +48,14 @@ Requires: /usr/bin/killall
 Requires: /usr/bin/bc
 # yaboot-xcat is pulled in so any SN can manage ppc nodes
 Requires: httpd nfs-utils nmap bind
-# On RHEL this pulls in dhcp, on SLES it pulls in dhcp-server. EL10 uses Kea.
-%if 0%{?rhel} >= 10
-Requires: kea
-Requires: kea-hooks
-%else
-Requires: /usr/sbin/dhcpd
-%endif
+# DHCP backend resolved at INSTALL time (not build time) via an RPM rich
+# dependency, so a single flat xcat-core build is correct on every EL: el10+
+# dropped ISC dhcp from its distro and uses Kea; el8/el9 use ISC dhcpd. SLES
+# has no "system-release" provide, so the condition is false there and it
+# falls to dhcp-server (/usr/sbin/dhcpd), preserving prior behavior.
+# system-release is versioned per release package (el10=10.x, el9=9.x, el8=8.x).
+Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
+Requires: (kea-hooks if (system-release >= 10))
 # On RHEL this pulls in openssh-server, on SLES it pulls in openssh
 Requires: /usr/bin/ssh
 %ifnarch s390x