diff --git a/ansible/inventory/offline/group_vars/postgresql/postgresql.yml b/ansible/inventory/offline/group_vars/postgresql/postgresql.yml
index 1e4d19920..170355fbb 100644
--- a/ansible/inventory/offline/group_vars/postgresql/postgresql.yml
+++ b/ansible/inventory/offline/group_vars/postgresql/postgresql.yml
@@ -53,7 +53,7 @@ postgresql_use_repository: false  # Set to true to use local packages from urls
 # When updating the packages, update the checksums too in wire-server-deploy/nix/pkgs/wire-binaries.nix
 postgresql_pkgs:
   - name: libpq5
-    url: "{{ binaries_url }}/libpq5_18.2-1.pgdg22.04+1_amd64.deb"
+    url: "{{ binaries_url }}/libpq5_18.3-1.pgdg22.04+1_amd64.deb"
     checksum: "sha256:54e4ab2606aea5525bfd1a99b6e1b143458caced07bd840ccb46a69cad61f341"
   - name: postgresql-client-common
     url: "{{ binaries_url }}/postgresql-client-common_291.pgdg22.04+1_all.deb"
@@ -62,11 +62,11 @@ postgresql_pkgs:
     url: "{{ binaries_url }}/postgresql-common_291.pgdg22.04+1_all.deb"
     checksum: "sha256:4c51fd323be440de831a55b1f06da77ba6e803fdf47a8b8e3e99b4f439256683"
   - name: postgresql-client-17
-    url: "{{ binaries_url }}/postgresql-client-17_17.8-1.pgdg22.04+1_amd64.deb"
-    checksum: "sha256:a83a985f1e406c1914212de5dffdcce277d3d82ae5d542dd9d84001a97a427e4"
+    url: "{{ binaries_url }}/postgresql-client-17_17.9-1.pgdg22.04+1_amd64.deb"
+    checksum: "sha256:941afbc8e2a3396281cc4877ceb35c767f4638bd731b66ec8edf1fd56d30a538"
   - name: postgresql-17
-    url: "{{ binaries_url }}/postgresql-17_17.8-1.pgdg22.04+1_amd64.deb"
-    checksum: "sha256:bddeaf93563ecf60df46b2000fd4d519d346d811579f89f30387de8d58f9b0dd"
+    url: "{{ binaries_url }}/postgresql-17_17.9-1.pgdg22.04+1_amd64.deb"
+    checksum: "sha256:69a65391f4ec1eac6a64b6f9c4bd31406f5ce5250cb669a5d00bd59f2d1e9e79"
   - name: python3-psycopg2
     url: "{{ binaries_url }}/python3-psycopg2_2.9.10-1.pgdg22.04+1_amd64.deb"
     checksum: "sha256:cc2f749e3af292a67e012edeb4aa5d284f57f2d66a9a09fe5b81e5ffda73cab4"
@@ -78,4 +78,4 @@ postgresql_pkgs:
     checksum: "sha256:f4efae9acf2fbfb5f5af43b8b812e2925d611fca1c48925276abc64116766128"
   - name: postgresql-17-repmgr
     url: "{{ binaries_url }}/postgresql-17-repmgr_5.5.0+debpgdg-3.pgdg22.04+1_amd64.deb"
-    checksum: "sha256:d8c2d333d7444b88a28f9f1cc8cf351a1120b8856a26940b21e256f80deefd84"
\ No newline at end of file
+    checksum: "sha256:06dbcee7e5430a50e71aee28aa83b6aad0325756b67390831f7dbfa5839c9630"
diff --git a/changelog.d/2-wire-builds/helm-oci-dependency b/changelog.d/2-wire-builds/helm-oci-dependency
new file mode 100644
index 000000000..148f092f1
--- /dev/null
+++ b/changelog.d/2-wire-builds/helm-oci-dependency
@@ -0,0 +1 @@
+Changed: Updated nix pkgs for OCI helm charts
diff --git a/default.nix b/default.nix
index fb0468cfc..f30fba2e2 100644
--- a/default.nix
+++ b/default.nix
@@ -3,12 +3,12 @@
 let
   sources = import ./nix/sources.nix;
   # for injecting old gnupg dependancy
-  oldpkgs = import sources.oldpkgs {
-    inherit system;
-    config = { };
-  };
+  #oldpkgs = import sources.oldpkgs {
+  #  inherit system;
+  #  config = { };
+  #};
   # extract the module for injecting
-  gnupg1orig = oldpkgs.gnupg1orig;
+  #gnupg1orig = oldpkgs.gnupg1orig;
 
   pkgs = import sources.nixpkgs {
     inherit system;
@@ -21,9 +21,9 @@ let
     # layering is important here, the lowest takes precedance in case of overlaps
     overlays = [
       # custom overlay for injections 
-      (self: super: {
-        gnupg1orig = gnupg1orig;
-      })
+      # (self: super: {
+      #   gnupg1orig = gnupg1orig;
+      # })
       # main overlay
       (import ./nix/overlay.nix)
     ];
@@ -49,9 +49,9 @@ rec {
       apacheHttpd
       awscli2
       gnumake
-      gnupg1
+      gnupg
       # injected dependacy gnupg1orig
-      gnupg1orig
+      # gnupg1orig
 
       kubernetes-tools
 
@@ -78,6 +78,7 @@ rec {
       gnused
       curl
       gawk
+      oras
 
       niv
       nix-prefetch-docker
@@ -127,4 +128,4 @@ rec {
       ];
     };
   };
-}
+}
\ No newline at end of file
diff --git a/nix/overlay.nix b/nix/overlay.nix
index b5d27bca9..51b54859d 100644
--- a/nix/overlay.nix
+++ b/nix/overlay.nix
@@ -1,22 +1,27 @@
 self:
 let helm-mapkubeapis = self.callPackage ./pkgs/helm-mapkubeapis.nix { };
+  sources = import ./sources.nix;
+  # for injecting old gnupg dependancy
+  oldpkgs = import sources.oldpkgs {
+    config = { };
+  };
 in
 super: {
-  customAnsible = (self.python3.withPackages (_: self.ansible.requiredPythonModules ++ [
-    # due to ansible package from nixpkgs missing some dependancies to run kubespray playbook
-    # we are making our own custom ansible package and python interpreter, current ansible-core is 2.16.5
-    super.python3Packages.ansible-core
 
-    # DEPENDENCIES
-    super.python3Packages.jmespath
-    super.python3Packages.botocore
-    super.python3Packages.boto3
-    super.python3Packages.cryptography
-    super.python3Packages.six
-    # for packet debugging and reporting.
-    super.python3Packages.pyshark
-    super.python3Packages.matplotlib
-  ]));
+  # due to ansible package from nixpkgs missing some dependancies to run kubespray playbook
+  # we are making our own custom ansible package and python interpreter, current ansible-core is 2.16.5
+  customAnsible = oldpkgs.python3.withPackages (_:
+    oldpkgs.ansible.requiredPythonModules ++ [
+      oldpkgs.python3Packages.ansible-core
+
+      oldpkgs.python3Packages.jmespath
+      oldpkgs.python3Packages.botocore
+      oldpkgs.python3Packages.boto3
+      oldpkgs.python3Packages.cryptography
+      oldpkgs.python3Packages.six
+      oldpkgs.python3Packages.pyshark
+      oldpkgs.python3Packages.matplotlib
+    ]);
 
   # kubeadm and kubectl
   kubernetes-tools = self.callPackage ./pkgs/kubernetes-tools.nix { };
@@ -43,7 +48,7 @@ super: {
 
       install -Dm755 ${./scripts/generate-gpg1-key.sh} $out/bin/generate-gpg1-key
       # we *--set* PATH here, to ensure we don't pick wrong gpgs
-      wrapProgram $out/bin/generate-gpg1-key --set PATH '${super.lib.makeBinPath (with self; [ bash coreutils gnupg1orig ])}'
+      wrapProgram $out/bin/generate-gpg1-key --set PATH '${super.lib.makeBinPath (with self; [ bash coreutils ])}'
     '';
   mirror-apt-jammy = super.runCommandNoCC "mirror-apt-jammy"
     {
@@ -52,7 +57,7 @@ super: {
     ''
       install -Dm755 ${./scripts/mirror-apt-jammy.sh} $out/bin/mirror-apt-jammy
       # we need to *--set* PATH here, otherwise aptly will pick the wrong gpg
-      wrapProgram $out/bin/mirror-apt-jammy --set PATH '${super.lib.makeBinPath (with self; [ aptly bash coreutils curl gnupg1orig gnused gnutar ])}'
+      wrapProgram $out/bin/mirror-apt-jammy --set PATH '${super.lib.makeBinPath (with self; [ aptly bash coreutils curl gnupg gnused gnutar ])}'
     '';
 
   create-container-dump = super.runCommandNoCC "create-container-dump"
@@ -82,4 +87,4 @@ super: {
       wrapProgram $out/bin/create-build-entry --prefix PATH : '${super.lib.makeBinPath (with self; [ bash jq ])}'
     '';
 
-}
\ No newline at end of file
+}
diff --git a/nix/pkgs/wire-binaries.nix b/nix/pkgs/wire-binaries.nix
index 490f9f4ef..1424a31d8 100644
--- a/nix/pkgs/wire-binaries.nix
+++ b/nix/pkgs/wire-binaries.nix
@@ -110,18 +110,18 @@ let
     # when updating the packages, update the checksums too in wire-server-deploy/ansible/inventory/offline/group_vars/all/offline.yml
     postgresql = fetchurl rec {
       passthru.url = url;
-      url = "https://apt.postgresql.org/pub/repos/apt/pool/main/p/postgresql-17/postgresql-17_17.8-1.pgdg22.04+1_amd64.deb";
-      sha256 = "sha256:bddeaf93563ecf60df46b2000fd4d519d346d811579f89f30387de8d58f9b0dd";
+      url = "https://apt.postgresql.org/pub/repos/apt/pool/main/p/postgresql-17/postgresql-17_17.9-1.pgdg22.04+1_amd64.deb";
+      sha256 = "sha256:69a65391f4ec1eac6a64b6f9c4bd31406f5ce5250cb669a5d00bd59f2d1e9e79";
     };
     postgresql-client = fetchurl rec {
       passthru.url = url;
-      url = "https://apt.postgresql.org/pub/repos/apt/pool/main/p/postgresql-17/postgresql-client-17_17.8-1.pgdg22.04+1_amd64.deb";
-      sha256 = "sha256:a83a985f1e406c1914212de5dffdcce277d3d82ae5d542dd9d84001a97a427e4";
+      url = "https://apt.postgresql.org/pub/repos/apt/pool/main/p/postgresql-17/postgresql-client-17_17.9-1.pgdg22.04+1_amd64.deb";
+      sha256 = "sha256:941afbc8e2a3396281cc4877ceb35c767f4638bd731b66ec8edf1fd56d30a538";
     };
     libpq5 = fetchurl rec {
       passthru.url = url;
-      url = "https://apt.postgresql.org/pub/repos/apt/pool/main/p/postgresql-18/libpq5_18.2-1.pgdg22.04+1_amd64.deb";
-      sha256 = "sha256:54e4ab2606aea5525bfd1a99b6e1b143458caced07bd840ccb46a69cad61f341";
+      url = "https://apt.postgresql.org/pub/repos/apt/pool/main/p/postgresql-18/libpq5_18.3-1.pgdg22.04+1_amd64.deb";
+      sha256 = "sha256:06dbcee7e5430a50e71aee28aa83b6aad0325756b67390831f7dbfa5839c9630";
     };
     postgresql-client-common = fetchurl rec {
       passthru.url = url;
@@ -166,4 +166,4 @@ runCommandNoCC "wire-binaries"
 } ''
   mkdir -p $out
   ${toString (lib.mapAttrsToList (k: v: "cp ${v} $out/${baseNameOf v.url}\n") srcs)}
-''
\ No newline at end of file
+''
diff --git a/nix/scripts/mirror-apt-jammy.sh b/nix/scripts/mirror-apt-jammy.sh
index b75d5778f..fb5057687 100755
--- a/nix/scripts/mirror-apt-jammy.sh
+++ b/nix/scripts/mirror-apt-jammy.sh
@@ -113,7 +113,7 @@ aptly_config=$(mktemp)
 trap 'rm -Rf -- "$aptly_config $GNUPGHOME"' EXIT
 
 cat > "$aptly_config" <<FOO
-{ "rootDir": "$aptly_root", "downloadConcurrency": 10, "gpgProvider": "internal" }
+{ "rootDir": "$aptly_root", "downloadConcurrency": 10, "gpgProvider": "gpg" }
 FOO
 
 aptly="aptly -config=${aptly_config} "
@@ -162,6 +162,6 @@ $aptly snapshot create docker-ce from mirror docker-ce
 
 $aptly snapshot merge wire jammy jammy-security jammy-updates docker-ce
 
-$aptly publish snapshot -gpg-key="gpg@wire.com" -secret-keyring="$GNUPGHOME/secring.gpg" -distribution jammy wire
+$aptly publish snapshot -gpg-key="gpg@wire.com" -distribution jammy wire
 
 gpg --export gpg@wire.com -a > "$aptly_root/public/gpg"
diff --git a/nix/sources.json b/nix/sources.json
index d9f443988..e0a0cc7d0 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -5,10 +5,10 @@
         "homepage": "https://github.com/nmattia/niv",
         "owner": "nmattia",
         "repo": "niv",
-        "rev": "9cb7ef336bb71fd1ca84fc7f2dff15ef4b033f2a",
-        "sha256": "1ajyqr8zka1zlb25jx1v4xys3zqmdy3prbm1vxlid6ah27a8qnzh",
+        "rev": "1ad9d90fea53b0e794cdbabf5515b39e539bc148",
+        "sha256": "1abhp43jpr8iaixyflr86zzj8ps0v8xzax301ilsvp07w3h23dwz",
         "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/9cb7ef336bb71fd1ca84fc7f2dff15ef4b033f2a.tar.gz",
+        "url": "https://github.com/nmattia/niv/archive/1ad9d90fea53b0e794cdbabf5515b39e539bc148.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs": {
@@ -17,10 +17,10 @@
         "homepage": "https://github.com/NixOS/nixpkgs",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0da3c44a9460a26d2025ec3ed2ec60a895eb1114",
-        "sha256": "1n435wya14pbl04g6n4zrqaslpik4xq0fv1i2g2mz8sq3dqg7dk0",
+        "rev": "7901e285e8b54a2f0e51ce6183980738447130e5",
+        "sha256": "1gdwfkqy7zich82dzxzjcsi613zm7p8cigj2fzqsagn63f5g0pnr",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/0da3c44a9460a26d2025ec3ed2ec60a895eb1114.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/7901e285e8b54a2f0e51ce6183980738447130e5.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "oldpkgs": {
@@ -29,10 +29,10 @@
         "homepage": "https://github.com/NixOS/nixpkgs",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "057f9aecfb71c4437d2b27d3323df7f93c010b7e",
-        "sha256": "1ndiv385w1qyb3b18vw13991fzb9wg4cl21wglk89grsfsnra41k",
+        "rev": "0da3c44a9460a26d2025ec3ed2ec60a895eb1114",
+        "sha256": "1n435wya14pbl04g6n4zrqaslpik4xq0fv1i2g2mz8sq3dqg7dk0",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/057f9aecfb71c4437d2b27d3323df7f93c010b7e.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/0da3c44a9460a26d2025ec3ed2ec60a895eb1114.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }
diff --git a/offline/default-build/build.sh b/offline/default-build/build.sh
index a94855536..801ced27f 100755
--- a/offline/default-build/build.sh
+++ b/offline/default-build/build.sh
@@ -25,6 +25,11 @@ TASKS_DIR="${SCRIPT_DIR}/../tasks"
 # Processing helm charts
 # --------------------------
 
+ansible --version
+
+# build linux packages
+"${TASKS_DIR}"/build_linux_pkgs.sh "${OUTPUT_DIR}" "${ROOT_DIR}"
+
 # pulling the charts based on builds.json, charts to be skipped are passed as arguments HELM_CHART_EXCLUDE_LIST
 "${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit"
 
@@ -67,9 +72,6 @@ cp -r "${ROOT_DIR}"/dashboards "${OUTPUT_DIR}"/
 # building admin host containers, has dependenct on the helm charts
 "${TASKS_DIR}"/build_adminhost_containers.sh "${OUTPUT_DIR}" --adminhost --zauth
 
-# build linux packages
-"${TASKS_DIR}"/build_linux_pkgs.sh "${OUTPUT_DIR}" "${ROOT_DIR}"
-
 # Creating system containers tarball
 "${TASKS_DIR}"/proc_system_containers.sh "${OUTPUT_DIR}"