diff --git a/.github/workflows/build-publish-containers.yml b/.github/workflows/build-publish-containers.yml
index a804d02d..5d60a873 100644
--- a/.github/workflows/build-publish-containers.yml
+++ b/.github/workflows/build-publish-containers.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Check out the repo
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
@@ -52,7 +52,7 @@ jobs:
         uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
 
       - name: Cache Docker layers
-        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # v3.0.11
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ matrix.platform }}-${{ matrix.tag }}
diff --git a/containers/Dockerfile.EESSI-build-node-debian-sid b/containers/Dockerfile.EESSI-build-node-debian-sid
index 5050e18e..9eaff027 100644
--- a/containers/Dockerfile.EESSI-build-node-debian-sid
+++ b/containers/Dockerfile.EESSI-build-node-debian-sid
@@ -1,4 +1,4 @@
-ARG cvmfsversion=2.11.5
+ARG cvmfsversion=2.13.0
 ARG archspecversion=0.2.2
 ARG awscliversion=1.32.22
 ARG fuseoverlayfsversion=1.10
diff --git a/containers/Dockerfile.EESSI-build-node-debian11 b/containers/Dockerfile.EESSI-build-node-debian11
index 26efc752..3245e6b5 100644
--- a/containers/Dockerfile.EESSI-build-node-debian11
+++ b/containers/Dockerfile.EESSI-build-node-debian11
@@ -1,4 +1,4 @@
-ARG cvmfsversion=2.11.5
+ARG cvmfsversion=2.13.0
 ARG awscliversion=1.32.22
 ARG fuseoverlayfsversion=1.10
 
diff --git a/containers/Dockerfile.EESSI-client-rocky8 b/containers/Dockerfile.EESSI-client-rocky8
index 531f9f56..e969c824 100644
--- a/containers/Dockerfile.EESSI-client-rocky8
+++ b/containers/Dockerfile.EESSI-client-rocky8
@@ -1,4 +1,4 @@
-ARG cvmfsversion=2.11.5
+ARG cvmfsversion=2.13.0
 # Stick to old version of fuse-overlayfs due to issues with newer versions
 # (cfr. https://github.com/containers/fuse-overlayfs/issues/232)
 ARG fuseoverlayfsversion=1.10
diff --git a/containers/build-or-download-cvmfs-debs.sh b/containers/build-or-download-cvmfs-debs.sh
index e06fe29d..32f28837 100644
--- a/containers/build-or-download-cvmfs-debs.sh
+++ b/containers/build-or-download-cvmfs-debs.sh
@@ -16,21 +16,23 @@ fi
 
 os="${distro}${release}"
 
-if [ "$arch" = "arm64" ] || [ "$arch" = "riscv64" ] || [ "${os}" = "debian13" ]
+if [ "$arch" = "riscv64" ] || [ "${os}" = "debian13" ]
 then
-    apt-get install -y devscripts libfuse3-dev cmake cpio libcap-dev libssl-dev libfuse-dev pkg-config libattr1-dev python3-dev python3-setuptools python3-dev python3-setuptools uuid-dev libz-dev lsb-release
+    apt-get install -y devscripts libfuse3-dev cmake cpio golang libcap-dev libssl-dev libfuse-dev pkg-config libattr1-dev python3-dev python3-setuptools python3-dev python3-setuptools uuid-dev libz-dev lsb-release
     cd /tmp
     wget https://github.com/cvmfs/cvmfs/archive/refs/tags/cvmfs-${cvmfsversion}.tar.gz
     tar xzf cvmfs-${cvmfsversion}.tar.gz
     cd cvmfs-cvmfs-${cvmfsversion}
     mkdir /root/deb
-    sed -i 's/Architecture: i386 amd64 armhf arm64/Architecture: i386 amd64 armhf arm64 riscv64/' packaging/debian/cvmfs/control.in
-    sed -i 's/python-dev/python3-dev/' packaging/debian/cvmfs/control.in
-    sed -i 's/python-setuptools/python3-setuptools/' packaging/debian/cvmfs/control.in
+    sed -i 's/amd64 armhf arm64/amd64 armhf arm64 riscv64/' packaging/debian/cvmfs/control*
+    sed -i 's/python-dev/python3-dev/' packaging/debian/cvmfs/control*
+    sed -i 's/python-setuptools/python3-setuptools/' packaging/debian/cvmfs/control*
+    # debian13 has libfuse3-4
+    [ $os = "debian13" ] && sed -i 's/libfuse3-3/libfuse3-4/' packaging/debian/cvmfs/control*
     if [ "$arch" = "riscv64" ]
     then
         # valgrind is not available (yet) for RISC-V
-        sed -i 's/, valgrind//' packaging/debian/cvmfs/control.in
+        sed -i 's/, valgrind//' packaging/debian/cvmfs/control*
         # for RISC-V we need to run autoreconf, see:
         # https://github.com/cvmfs/cvmfs/pull/3446
         wget https://github.com/cvmfs/cvmfs/pull/3446.patch