diff --git a/Dockerfile b/Dockerfile
index 1626cc56d59..be667a436a1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -73,10 +73,7 @@ WORKDIR /go/src/github.com/containerd/containerd
 RUN git checkout ${CONTAINERD_VERSION} && \
   mkdir -p /out /out/$TARGETARCH && \
   cp -a containerd.service /out
-ENV CGO_ENABLED=1
-ENV GO111MODULE=off
-# TODO: how to build containerd as static binaries? https://github.com/containerd/containerd/issues/6158
-RUN GO=xx-go make && \
+RUN GO=xx-go make STATIC=1 && \
   cp -a bin/containerd bin/containerd-shim-runc-v2 bin/ctr /out/$TARGETARCH
 
 FROM build-base-debian AS build-runc
@@ -101,6 +98,18 @@ ENV CGO_ENABLED=1
 RUN GO=xx-go make static && \
   xx-verify --static bypass4netns && cp -a bypass4netns bypass4netnsd /out/${TARGETARCH}
 
+FROM build-base-debian AS build-kubo
+ARG KUBO_VERSION
+ARG TARGETARCH
+RUN git clone https://github.com/ipfs/kubo.git /go/src/github.com/ipfs/kubo
+WORKDIR /go/src/github.com/ipfs/kubo
+RUN git checkout ${KUBO_VERSION} && \
+  mkdir -p /out/${TARGETARCH}
+ENV CGO_ENABLED=0
+RUN xx-go --wrap && \
+  make build && \
+  xx-verify --static cmd/ipfs/ipfs && cp -a cmd/ipfs/ipfs /out/${TARGETARCH}
+
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build-base
 RUN apk add --no-cache make git curl
 COPY . /go/src/github.com/containerd/nerdctl
@@ -197,13 +206,8 @@ RUN fname="containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION/v}-${TA
   rm -f "${fname}" && \
   echo "- containerd-fuse-overlayfs: ${CONTAINERD_FUSE_OVERLAYFS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG KUBO_VERSION
-RUN fname="kubo_${KUBO_VERSION}_${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
-  curl -o "${fname}" -fSL "https://github.com/ipfs/kubo/releases/download/${KUBO_VERSION}/${fname}" && \
-  grep "${fname}" "/SHA256SUMS.d/kubo-${KUBO_VERSION}" | sha256sum -c && \
-  tmpout=$(mktemp -d) && \
-  tar -C ${tmpout} -xzf "${fname}" kubo/ipfs && \
-  mv ${tmpout}/kubo/ipfs /out/bin/ && \
-  echo "- Kubo (IPFS): ${KUBO_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+COPY --from=build-kubo /out/${TARGETARCH:-amd64}/* /out/bin/
+RUN echo "- Kubo (IPFS): ${KUBO_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG TINI_VERSION
 RUN fname="tini-static-${TARGETARCH:-amd64}" && \
   curl -o "${fname}" -fSL "https://github.com/krallin/tini/releases/download/${TINI_VERSION}/${fname}" && \
diff --git a/Dockerfile.d/SHA256SUMS.d/kubo-v0.23.0 b/Dockerfile.d/SHA256SUMS.d/kubo-v0.23.0
deleted file mode 100644
index f43a829064d..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/kubo-v0.23.0
+++ /dev/null
@@ -1,3 +0,0 @@
-# From https://github.com/ipfs/kubo/releases
-b78d209ce9b5797534348c6939d305b8758b0e4bc3abae532b63d15d9cddb9c6  kubo_v0.23.0_linux-amd64.tar.gz
-0de1bf8564f563b77e7bef620f357c0787b2fad37378c8cdb789a55959e5b543  kubo_v0.23.0_linux-arm64.tar.gz