diff --git a/.github/workflows/build_packages.yaml b/.github/workflows/build_packages.yaml
index e7571d154..2715c5ee6 100644
--- a/.github/workflows/build_packages.yaml
+++ b/.github/workflows/build_packages.yaml
@@ -23,6 +23,7 @@ on:
 jobs:
   prepare:
     runs-on: ubuntu-20.04
+    container: ghcr.io/emqx/emqx-builder/5.0-17:1.13.4-24.2.1-1-ubuntu20.04
     outputs:
       BUILD_PROFILE: ${{ steps.get_profile.outputs.BUILD_PROFILE }}
       IS_EXACT_TAG: ${{ steps.get_profile.outputs.IS_EXACT_TAG }}
@@ -38,6 +39,7 @@ jobs:
         id: get_profile
         run: |
           cd source
+          git config --global --add safe.directory "$(pwd)"
           tag=${{ github.ref }}
           if git describe --tags --match "[v|e]*" --exact; then
             echo "This is an exact git tag, will publish release"
@@ -282,7 +284,7 @@ jobs:
             elixir: 1.13.4
             build_elixir: with_elixir
             arch: amd64
-            os: el7
+            os: el8
             build_machine: ubuntu-20.04
 
     defaults:
diff --git a/.github/workflows/run_relup_tests.yaml b/.github/workflows/run_relup_tests.yaml
index ddb8380b2..59e97d679 100644
--- a/.github/workflows/run_relup_tests.yaml
+++ b/.github/workflows/run_relup_tests.yaml
@@ -37,8 +37,8 @@ jobs:
         cd emqx
         ce_vsn="$(./pkg-vsn.sh opensource)"
         ee_vsn="$(./pkg-vsn.sh enterprise)"
-        old_ce_vsns="$(./scripts/relup-base-vsns.sh opensource | xargs)"
-        old_ee_vsns="$(./scripts/relup-base-vsns.sh enterprise | xargs)"
+        old_ce_vsns="$(./scripts/relup-build/base-vsns.sh opensource | xargs)"
+        old_ee_vsns="$(./scripts/relup-build/base-vsns.sh enterprise | xargs)"
         old_vsns=$(echo -n "${old_ce_vsns} ${old_ee_vsns}" | sed 's/ $//g' | jq -R -s -c 'split(" ")')
         echo "::set-output name=CUR_CE_VSN::$ce_vsn"
         echo "::set-output name=CUR_EE_VSN::$ee_vsn"
diff --git a/Makefile b/Makefile
index b3235eef5..09582709e 100644
--- a/Makefile
+++ b/Makefile
@@ -167,7 +167,7 @@ $(REL_PROFILES:%=%-rel) $(PKG_PROFILES:%=%-rel): $(COMMON_DEPS)
 .PHONY: $(REL_PROFILES:%=%-relup-downloads)
 define download-relup-packages
 $1-relup-downloads:
-	@if [ "$${EMQX_RELUP}" = "true" ]; then $(CURDIR)/scripts/relup-base-packages.sh $1; fi
+	@if [ "$${EMQX_RELUP}" = "true" ]; then $(CURDIR)/scripts/relup-build/download-base-packages.sh $1; fi
 endef
 ALL_ZIPS = $(REL_PROFILES)
 $(foreach zt,$(ALL_ZIPS),$(eval $(call download-relup-packages,$(zt))))
diff --git a/build b/build
index 322bd486e..1a7165ced 100755
--- a/build
+++ b/build
@@ -205,7 +205,7 @@ make_tgz() {
     fi
     $TAR zxf "${src_tarball}" -C "${tard}/emqx"
     if [ -f "${tard}/emqx/releases/${PKG_VSN}/relup" ]; then
-        ./scripts/inject-relup.escript "${tard}/emqx/releases/${PKG_VSN}/relup"
+        ./scripts/relup-build/inject-relup.escript "${tard}/emqx/releases/${PKG_VSN}/relup"
     fi
     ## try to be portable for tar.gz packages.
     ## for DEB and RPM packages the dependencies are resoved by yum and apt
diff --git a/scripts/relup-base-vsns.sh b/scripts/relup-build/base-vsns.sh
similarity index 97%
rename from scripts/relup-base-vsns.sh
rename to scripts/relup-build/base-vsns.sh
index e1ea79922..54a441e07 100755
--- a/scripts/relup-base-vsns.sh
+++ b/scripts/relup-build/base-vsns.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # ensure dir
-cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
+cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/../.."
 
 ## This script prints the relup upgrade base versions
 ## for the given EMQX edition (specified as first arg)
diff --git a/scripts/relup-base-packages.sh b/scripts/relup-build/download-base-packages.sh
similarity index 90%
rename from scripts/relup-base-packages.sh
rename to scripts/relup-build/download-base-packages.sh
index db6a74485..39c633395 100755
--- a/scripts/relup-base-packages.sh
+++ b/scripts/relup-build/download-base-packages.sh
@@ -6,7 +6,7 @@ if [[ -n "$DEBUG" ]]; then set -x; fi
 set -euo pipefail
 
 # ensure dir
-cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
+cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/../.."
 ROOT_DIR="$(pwd)"
 
 PROFILE="${1:-emqx}"
@@ -37,7 +37,7 @@ case "$UNAME" in
         ;;
 esac
 
-BASE_VERSIONS="$("${ROOT_DIR}"/scripts/relup-base-vsns.sh "$EDITION" | xargs echo -n)"
+BASE_VERSIONS="$("${ROOT_DIR}"/scripts/relup-build/base-vsns.sh "$EDITION" | xargs echo -n)"
 
 fullvsn() {
     env PKG_VSN="$1" "${ROOT_DIR}"/pkg-vsn.sh "$PROFILE" --long
diff --git a/scripts/inject-relup.escript b/scripts/relup-build/inject-relup.escript
similarity index 100%
rename from scripts/inject-relup.escript
rename to scripts/relup-build/inject-relup.escript