diff --git a/ci/base-devel/Dockerfile b/ci/base-devel/Dockerfile
index 44879eb..46298a3 100644
--- a/ci/base-devel/Dockerfile
+++ b/ci/base-devel/Dockerfile
@@ -1,2 +1,22 @@
-# Don't delete.
-# This is a placeholder so that our `ci/release.py` will work properly.
+FROM archlinux:latest AS verify
+SHELL ["/bin/bash", "-c"]
+RUN ROOTFS="$(curl --continue-at - --remote-name --write-out "%{filename_effective}" https://gitlab.archlinux.org/archlinux/archlinux-docker/uploads/77ce9d3fc8a189f8d55946db6b45ab2d/base-devel-20201019.6288.tar.xz)" && \
+    sha256sum -c <<< "Path('output/base-devel.tar.xz.SHA256').read_text()[0:64]  base-devel-20201019.6288.tar.xz" && \
+    mkdir /rootfs && \
+    tar -C /rootfs --extract --auto-compress --file "${ROOTFS}"
+
+FROM scratch AS root
+COPY --from=verify /rootfs/ /
+
+# manually run all alpm hooks that can't be run inside the fakechroot
+RUN ldconfig && update-ca-trust && locale-gen
+RUN sh -c 'ls usr/lib/sysusers.d/*.conf | /usr/share/libalpm/scripts/systemd-hook sysusers '
+
+# update /etc/os-release
+RUN ln -s /usr/lib/os-release /etc/os-release
+
+# initialize the archlinux keyring, but discard any private key that may be shipped.
+RUN pacman-key --init && pacman-key --populate archlinux && bash -c "rm -rf etc/pacman.d/gnupg/{openpgp-revocs.d/,private-keys-v1.d/,pubring.gpg~,gnupg.S.}*"
+
+ENV LANG=en_US.UTF-8
+CMD ["/usr/bin/bash"]
diff --git a/ci/base/Dockerfile b/ci/base/Dockerfile
index 44879eb..43344cb 100644
--- a/ci/base/Dockerfile
+++ b/ci/base/Dockerfile
@@ -1,2 +1,22 @@
-# Don't delete.
-# This is a placeholder so that our `ci/release.py` will work properly.
+FROM archlinux:latest AS verify
+SHELL ["/bin/bash", "-c"]
+RUN ROOTFS="$(curl --continue-at - --remote-name --write-out "%{filename_effective}" https://gitlab.archlinux.org/archlinux/archlinux-docker/uploads/c2404963a8e1847c3e01cde076cc6a9b/base-20201019.6288.tar.xz)" && \
+    sha256sum -c <<< "Path('output/base.tar.xz.SHA256').read_text()[0:64]  base-20201019.6288.tar.xz" && \
+    mkdir /rootfs && \
+    tar -C /rootfs --extract --auto-compress --file "${ROOTFS}"
+
+FROM scratch AS root
+COPY --from=verify /rootfs/ /
+
+# manually run all alpm hooks that can't be run inside the fakechroot
+RUN ldconfig && update-ca-trust && locale-gen
+RUN sh -c 'ls usr/lib/sysusers.d/*.conf | /usr/share/libalpm/scripts/systemd-hook sysusers '
+
+# update /etc/os-release
+RUN ln -s /usr/lib/os-release /etc/os-release
+
+# initialize the archlinux keyring, but discard any private key that may be shipped.
+RUN pacman-key --init && pacman-key --populate archlinux && bash -c "rm -rf etc/pacman.d/gnupg/{openpgp-revocs.d/,private-keys-v1.d/,pubring.gpg~,gnupg.S.}*"
+
+ENV LANG=en_US.UTF-8
+CMD ["/usr/bin/bash"]