diff --git a/mockbuild-all.pl b/mockbuild-all.pl
index b074877..fd6a09c 100755
--- a/mockbuild-all.pl
+++ b/mockbuild-all.pl
@@ -594,8 +594,8 @@ if (!$dry_run && !$skip_build) {
         my $want = $req{$pkg};
         next if !defined($want) || $want eq '*';
         my $got = rpm_version($repo_dir, $pkg);
-        if    (!defined $got) { push @vmiss, "$pkg: not built"; }
-        elsif ($got ne $want) { push @vmiss, "$pkg: built $got, manifest pins $want"; }
+        if    (!defined $got)                 { push @vmiss, "$pkg: not built"; }
+        elsif (!version_matches($got, $want)) { push @vmiss, "$pkg: built $got, manifest pins $want"; }
     }
     die "FATAL: manifest version mismatch for $target:\n  " . join("\n  ", @vmiss) . "\n"
         if @vmiss;
@@ -1129,6 +1129,20 @@ sub have_rpm {
 # rpm_version: %{version} of the built binary rpm named <name> under $dir (undef if absent).
 # Skips src/debug rpms and confirms the rpm's real %{name} matches (glob can over-match).
 # 'xCAT-genesis-base' matches the arch-suffixed rpm name (xCAT-genesis-base-x86_64 / -ppc64).
+# version_matches: does the built version $got satisfy the manifest pin $want? $want may be an
+# exact version (2.19.0), a shell-style glob (2.*  or  2.19.*), or '*' (any). Globs support * and
+# ? and are anchored. Used so xCAT-genesis-base can pin 2.* (its Version walks with xcat-core)
+# while the real xcat-dep packages stay exactly pinned.
+sub version_matches {
+    my ($got, $want) = @_;
+    return 1 if !defined($want) || $want eq '*';
+    return ($got eq $want) unless $want =~ /[*?]/;
+    my $re = quotemeta($want);
+    $re =~ s/\\\*/.*/g;
+    $re =~ s/\\\?/./g;
+    return $got =~ /\A$re\z/ ? 1 : 0;
+}
+
 sub rpm_version {
     my ($dir, $name) = @_;
     my $glob = ($name eq 'xCAT-genesis-base')
diff --git a/packages-manifest.conf b/packages-manifest.conf
index 56fbee8..1669a87 100644
--- a/packages-manifest.conf
+++ b/packages-manifest.conf
@@ -1,14 +1,22 @@
 # Per-target required xcat-dep package manifest.
 #
 # One [section] per mockbuild-all target (matches --target). Each entry is
-#   <package>=<version|*>
+#   <package>=<version-pin>
 # where <package> is the builder/package name (the dep builder name, the perl
-# package name, or xCAT-genesis-base) and the value is the required package
-# Version. The build must produce exactly that Version or the run fails (a value
-# of `*` accepts any version). Only the Version is pinned -- not the Release,
-# which carries the per-EL dist tag (elN) and the genesis snap<timestamp>. Bump a
-# pin here when the corresponding source Version is bumped; xCAT-genesis-base's
-# Version tracks xcat-core's marketing Version.
+# package name, or xCAT-genesis-base) and <version-pin> is one of:
+#   - an exact Version    (e.g. 1.8.18) -- the build must produce exactly it;
+#   - a shell-style glob  (e.g. 2.*)    -- the built Version must match it (* and ?);
+#   - '*'                               -- any version is accepted.
+# Only the Version is matched, never the Release (which carries the per-EL dist
+# tag elN and the genesis snap<timestamp>). Bump an exact pin here when the
+# corresponding in-tree source Version is bumped.
+#
+# xCAT-genesis-base is pinned as 2.* (not an exact version) on purpose: its
+# Version is NOT owned by xcat-dep -- it is whatever xcat-core the genesis build
+# compiles against (XCAT_CORE_REF), so it walks with the paired core (2.18.x,
+# 2.19.x, ...). 2.* asserts "a 2.x genesis" without coupling the manifest to one
+# core release. (xCAT-genesis-scripts Requires xCAT-genesis-base >= 2:2.18.0 -- a
+# minimum with Epoch 2 -- so any 2.x genesis-base installs against a 2.18+ core.)
 #
 # mockbuild-all.pl reads this file and, per target, builds ONLY the listed
 # packages -- a package not listed for a target is not built for it. Any listed
@@ -39,7 +47,7 @@ perl-HTML-Form=6.07
 perl-HTTP-Async=0.30
 perl-IO-Stty=0.04
 perl-Net-HTTPS-NB=0.14
-xCAT-genesis-base=2.19.0
+xCAT-genesis-base=2.*
 
 [alma+epel-8-ppc64le]
 conserver-xcat=8.2.1
@@ -53,7 +61,7 @@ perl-HTML-Form=6.07
 perl-HTTP-Async=0.30
 perl-IO-Stty=0.04
 perl-Net-HTTPS-NB=0.14
-xCAT-genesis-base=2.19.0
+xCAT-genesis-base=2.*
 
 [alma+epel-9-x86_64]
 conserver-xcat=8.2.1
@@ -67,7 +75,7 @@ perl-HTTP-Async=0.30
 perl-IO-Stty=0.04
 perl-Net-HTTPS-NB=0.14
 perl-Sys-Virt=11.10.0
-xCAT-genesis-base=2.19.0
+xCAT-genesis-base=2.*
 
 [alma+epel-9-ppc64le]
 conserver-xcat=8.2.1
@@ -81,7 +89,7 @@ perl-HTTP-Async=0.30
 perl-IO-Stty=0.04
 perl-Net-HTTPS-NB=0.14
 perl-Sys-Virt=11.10.0
-xCAT-genesis-base=2.19.0
+xCAT-genesis-base=2.*
 
 [alma+epel-10-x86_64]
 conserver-xcat=8.2.1
@@ -97,7 +105,7 @@ perl-IO-Stty=0.04
 perl-Net-HTTPS-NB=0.14
 perl-Net-Telnet=3.04
 perl-Sys-Virt=11.10.0
-xCAT-genesis-base=2.19.0
+xCAT-genesis-base=2.*
 
 [alma+epel-10-ppc64le]
 conserver-xcat=8.2.1
@@ -113,4 +121,4 @@ perl-IO-Stty=0.04
 perl-Net-HTTPS-NB=0.14
 perl-Net-Telnet=3.04
 perl-Sys-Virt=11.10.0
-xCAT-genesis-base=2.19.0
+xCAT-genesis-base=2.*