diff --git a/.gitlab-ci/container/debian/test-base.sh b/.gitlab-ci/container/debian/test-base.sh
index ba6471e4506..50969f5527a 100644
--- a/.gitlab-ci/container/debian/test-base.sh
+++ b/.gitlab-ci/container/debian/test-base.sh
@@ -21,6 +21,8 @@ sed -i -e 's/http:\/\/deb/https:\/\/deb/g' /etc/apt/sources.list.d/*
 
 echo "deb [trusted=yes] https://gitlab.freedesktop.org/gfx-ci/ci-deb-repo/-/raw/${PKG_REPO_REV}/ ${FDO_DISTRIBUTION_VERSION%-*} main" | tee /etc/apt/sources.list.d/gfx-ci_.list
 
+echo "deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] https://deb.debian.org/debian ${FDO_DISTRIBUTION_VERSION%-*} non-free-firmware" | tee /etc/apt/sources.list.d/non-free-firmware.list
+
 : "${LLVM_VERSION:?llvm version not set!}"
 
 . .gitlab-ci/container/debian/maybe-add-llvm-repo.sh
@@ -145,6 +147,22 @@ DEPS=(
     zstd
 )
 
+HW_DEPS=(
+    firmware-realtek
+)
+
+[ "$DEBIAN_ARCH" = "arm64" ] && ARCH_DEPS=(
+    firmware-linux-nonfree
+    firmware-qcom-media
+)
+[ "$DEBIAN_ARCH" = "armhf" ] && ARCH_DEPS=(
+    firmware-misc-nonfree
+)
+[ "$DEBIAN_ARCH" = "amd64" ] && ARCH_DEPS=(
+    firmware-amd-graphics
+    firmware-misc-nonfree
+)
+
 apt-get update
 apt-get dist-upgrade -y
 
@@ -165,10 +183,10 @@ pip3 install --break-system-packages yq
 
 section_end debian_setup
 
-############### Download prebuilt kernel
+############### Download prebuilt kernel and firmware
 
 if [ "$DEBIAN_ARCH" = amd64 ]; then
-  uncollapsed_section_start kernel "Downloading kernel for crosvm"
+  uncollapsed_section_start kernel "Downloading kernel and firmware"
   export KERNEL_IMAGE_NAME=bzImage
   mkdir -p /kernel
   # shellcheck disable=SC2153 # KERNEL_IMAGE_BASE is set in the root .gitlab-ci.yml file
@@ -176,6 +194,7 @@ if [ "$DEBIAN_ARCH" = amd64 ]; then
       -o "/kernel/${KERNEL_IMAGE_NAME}" "${KERNEL_IMAGE_BASE}/${DEBIAN_ARCH}/${KERNEL_IMAGE_NAME}"
   section_end kernel
 fi
+. .gitlab-ci/container/get-firmware-from-source.sh / "$FIRMWARE_FILES"
 
 ############### Build mold
 
diff --git a/.gitlab-ci/container/gitlab-ci.yml b/.gitlab-ci/container/gitlab-ci.yml
index 92752efcd7a..ee1587b1220 100644
--- a/.gitlab-ci/container/gitlab-ci.yml
+++ b/.gitlab-ci/container/gitlab-ci.yml
@@ -346,6 +346,7 @@ fedora/x86_64_build:
 debian/x86_64_test-base:
   extends:
     - .debian-container
+    - .firmware_x86_64
   variables:
     MESA_IMAGE_TAG: &debian-x86_64_test-base "${DEBIAN_BASE_TAG}--${PKG_REPO_REV}--${KERNEL_TAG}"
     LLVM_VERSION: *debian-x86_64-llvm
@@ -397,6 +398,7 @@ debian/arm64_test-base:
     - $FDO_RUNNER_JOB_PRIORITY_TAG_AARCH64
   extends:
     - .debian-container
+    - .firmware_arm64
   variables:
     MESA_IMAGE_TAG: &debian-arm64_test-base "${DEBIAN_BASE_TAG}--${PKG_REPO_REV}"
     LLVM_VERSION: *debian-arm64-llvm
@@ -588,7 +590,7 @@ debian/arm64_test-vk:
     - debian/arm64_test-vk
 
 # Get firmware directly rather than using package versions.
-# Change KERNEL_ROOTFS_TAG to add firmware changes.
+# Change DEBIAN_BASE_TAG to add firmware changes.
 # FIRMWARE_FILES is a list of json files arranged by vendor in .gitlab-ci/firmware/*
 .firmware_x86_64:
   variables:
diff --git a/.gitlab-ci/image-tags.yml b/.gitlab-ci/image-tags.yml
index be49679b5f3..9bc8570396c 100644
--- a/.gitlab-ci/image-tags.yml
+++ b/.gitlab-ci/image-tags.yml
@@ -19,14 +19,14 @@ include:
   - .gitlab-ci/conditional-build-image-tags.yml
 
 variables:
-  DEBIAN_BASE_TAG: "20250425-apitrace"
+  DEBIAN_BASE_TAG: "20250424-rootfs"
 
   DEBIAN_BUILD_TAG: "20250422-ci-fairy"
 
-  DEBIAN_TEST_ANDROID_TAG: "20250422-angle-f3"
-  DEBIAN_TEST_GL_TAG: "20250422-piglit-c50"
-  DEBIAN_TEST_VK_TAG: "20250422-piglit-c50"
-  KERNEL_ROOTFS_TAG: "20250422-piglit-c50"
+  DEBIAN_TEST_ANDROID_TAG: "20250414-goldilocks"
+  DEBIAN_TEST_GL_TAG: "20250414-goldilocks"
+  DEBIAN_TEST_VK_TAG: "20250414-goldilocks"
+  KERNEL_ROOTFS_TAG: "20250414-goldilocks"
 
   DEBIAN_PYUTILS_TAG: "20250422-ci-fairy"