diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e22d4bfa..eb13ca32 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,25 +15,33 @@ jobs:
     - run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
     - uses: docker/setup-buildx-action@v2
     - name: Cache var-cache-apt
-      uses: actions/cache@v3
+      uses: actions/cache@v3.4.0
       with:
         path: var-cache-apt
         key: var-cache-apt-${{ hashFiles('Containerfile.cross') }}
     - name: Cache var-lib-apt
-      uses: actions/cache@v3
+      uses: actions/cache@v3.4.0
       with:
         path: var-lib-apt
         key: var-lib-apt-${{ hashFiles('Containerfile.cross') }}
     - name: inject var-cache-apt into docker
-      uses: reproducible-containers/buildkit-cache-dance@v2.1.2
+      uses: reproducible-containers/buildkit-cache-dance@v3.3.0
       with:
         cache-source: var-cache-apt
-        cache-target: /var/cache/apt
+        cache-map: |
+          {
+            "var-cache-apt": "/var/cache/apt",
+            "var-lib-apt": "/var/lib/apt"
+          }
     - name: inject var-lib-apt into docker
-      uses: reproducible-containers/buildkit-cache-dance@v2.1.2
+      uses: reproducible-containers/buildkit-cache-dance@v3.3.0
       with:
         cache-source: var-lib-apt
-        cache-target: /var/lib/apt
+        cache-map: |
+          {
+            "var-cache-apt": "/var/cache/apt",
+            "var-lib-apt": "/var/lib/apt"
+          }
     - name: "Build binaries from Containerfile.cross"
       run: docker buildx build -o /tmp/fuse-overlayfs-builds --build-arg SOURCE_DATE_EPOCH --platform=amd64,arm64,arm,s390x,ppc64le,riscv64 -f Containerfile.cross .
     - name: "Create /tmp/artifact"
diff --git a/Containerfile.cross b/Containerfile.cross
index 0610827e..00aadf98 100644
--- a/Containerfile.cross
+++ b/Containerfile.cross
@@ -4,10 +4,10 @@
 #   --build-arg SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) \
 #   --platform=amd64,arm64,arm,s390x,ppc64le,riscv64 \
 #   -f Containerfile.cross .
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.2.1 AS xx
-FROM --platform=$BUILDPLATFORM ubuntu:jammy-20230804 AS fuse-overlayfs
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.8.0 AS xx
+FROM --platform=$BUILDPLATFORM ubuntu:questing AS fuse-overlayfs
 ADD --chmod=0755 \
-  https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.0/repro-sources-list.sh \
+  https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
   /usr/local/bin/repro-sources-list.sh
 RUN \
   --mount=type=cache,target=/var/cache/apt,sharing=locked \
@@ -34,7 +34,7 @@ RUN \
   if xx-info is-cross; then gcc="gcc-$(xx-info triple)"; fi; \
   apt-get install -y "${gcc}" "libfuse3-dev:${darch}"
 RUN ./autogen.sh && \
-  LIBS="-ldl" LDFLAGS="-static" ./configure --host=$(xx-info) && \
+  PKG_CONFIG_PATH="/usr/lib/$(xx-info)/pkgconfig" LIBS="-ldl" LDFLAGS="-static" ./configure --host=$(xx-info) && \
   make && mkdir /out && cp fuse-overlayfs /out && \
   file /out/fuse-overlayfs | grep "statically linked"
 
diff --git a/NEWS b/NEWS
index 4a4814e3..502bf31c 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,8 @@
+* fuse-overlayfs-1.16
+
+- main: fix incorrect directory entries due to unstable iteration
+  order.
+
 * fuse-overlayfs-1.15
 
 - main: lookup upperdir only for created directories.
diff --git a/configure.ac b/configure.ac
index de8fd392..e840a0f7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
 AC_PREREQ([2.69])
-AC_INIT([fuse-overlayfs], [1.16-dev], [giuseppe@scrivano.org])
+AC_INIT([fuse-overlayfs], [1.17-dev], [giuseppe@scrivano.org])
 AC_CONFIG_SRCDIR([main.c])
 AC_CONFIG_HEADERS([config.h])