diff --git a/kas-container b/kas-container
index af938285..6b2131c3 100755
--- a/kas-container
+++ b/kas-container
@@ -2,7 +2,7 @@
 #
 # kas - setup tool for bitbake based projects
 #
-# Copyright (c) Siemens AG, 2018-2022
+# Copyright (c) Siemens AG, 2018-2024
 #
 # Authors:
 #  Jan Kiszka <jan.kiszka@siemens.com>
@@ -27,6 +27,11 @@
 
 set -e
 
+KAS_IMAGE_VERSION_DEFAULT="4.5"
+KAS_CONTAINER_IMAGE_PATH_DEFAULT="ghcr.io/siemens/kas"
+KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas"
+KAS_CONTAINER_SELF_NAME="$(basename "$0")"
+
 usage()
 {
 	SELF="${KAS_CONTAINER_SELF_NAME}"
@@ -144,11 +149,6 @@ run_clean() {
 	fi
 }
 
-KAS_IMAGE_VERSION_DEFAULT="4.3.1"
-KAS_CONTAINER_IMAGE_PATH_DEFAULT="ghcr.io/siemens/kas"
-KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas"
-KAS_CONTAINER_SELF_NAME="$(basename "$0")"
-
 set_container_image_var() {
 	KAS_IMAGE_VERSION="${KAS_IMAGE_VERSION:-${KAS_IMAGE_VERSION_DEFAULT}}"
 	KAS_CONTAINER_IMAGE_NAME="${KAS_CONTAINER_IMAGE_NAME:-${KAS_CONTAINER_IMAGE_NAME_DEFAULT}}"
@@ -330,15 +330,22 @@ while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do
 	case "$1" in
 	--skip|--target|--task)
 		KAS_OPTIONS="${KAS_OPTIONS} $1 $2"
-		shift 2
+		shift 1
+		shift 1 || KAS_OPTIONS="--help"
 		;;
 	-c|--cmd|--command)
 		KAS_BITBAKE_C_OPTION_ARGS="$2"
-		shift 2
+		shift 1
+		shift 1 || KAS_OPTIONS="--help"
 		;;
 	-E|--preserve-env)
 		fatal_error "$1 is not supported with ${KAS_CONTAINER_SELF_NAME}"
 		;;
+	--provenance)
+		KAS_OPTIONS="${KAS_OPTIONS} $1 $2"
+		shift 1
+		shift 1 || KAS_OPTIONS="--help"
+		;;
 	--)
 		KAS_EXTRA_BITBAKE_ARGS=$#
 		;;
@@ -347,10 +354,21 @@ while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do
 		shift 1
 		;;
 	*)
+		ARG="$1"
+		shift 1
+		if [ "$KAS_CMD" = "for-all-repos" ]; then
+			if [ $# -gt 0 ]; then
+				KAS_REPO_CMD="$1"
+				shift 1
+			else
+				KAS_REPO_CMD="$ARG"
+				unset ARG
+			fi
+		fi
 		KAS_FILES=
 		# SC2086: Double quote to prevent globbing and word splitting.
 		# shellcheck disable=2086
-		for FILE in $(IFS=':'; echo $1); do
+		for FILE in $(IFS=':'; echo $ARG); do
 			if ! KAS_REAL_FILE="$(realpath -qe "$FILE")"; then
 				fatal_error "configuration file '${FILE}' not found"
 			fi
@@ -361,11 +379,6 @@ while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do
 				KAS_FILES="${KAS_FILES}:${KAS_REAL_FILE}"
 			fi
 		done
-		shift 1
-		if [ "$KAS_CMD" = "for-all-repos" ]; then
-			KAS_REPO_CMD="$1"
-			shift 1
-		fi
 		;;
 	esac
 done
@@ -401,7 +414,7 @@ if [ "${KAS_CMD}" = "menu" ]; then
 		set -- "$@" -e _KAS_REPO_DIR_HOST="$(readlink -fv "${KAS_REPO_DIR}")"
 	fi
 
-	BUILD_SYSTEM=$(tr '\n' '\f' 2>/dev/null < ${KAS_FIRST_FILE} | \
+	BUILD_SYSTEM=$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILE}" | \
 		sed -e 's/\(.*\fconfig KAS_BUILD_SYSTEM\f\(.*\)\|.*\)/\2/' \
 		    -e 's/\f\([[:alpha:]].*\|$\)//' \
 		    -e 's/.*default \"\(.*\)\".*/\1/')
@@ -439,7 +452,7 @@ if [ "$(id -u)" -eq 0 ] && [ "${KAS_ALLOW_ROOT}" != "yes" ] ; then
 	            "KAS_ALLOW_ROOT=yes to override."
 fi
 
-set -- "$@" -v "${KAS_REPO_DIR}":/repo:${KAS_REPO_MOUNT_OPT} \
+set -- "$@" -v "${KAS_REPO_DIR}:/repo:${KAS_REPO_MOUNT_OPT}" \
 	-v "${KAS_WORK_DIR}":/work:rw -e KAS_WORK_DIR=/work \
 	-v "${KAS_BUILD_DIR}":/build:rw \
 	--workdir=/repo \
@@ -505,6 +518,11 @@ if [ -f "${GITCONFIG_FILE}" ]; then
 		-e GITCONFIG_FILE="/var/kas/userdata/.gitconfig"
 fi
 
+if [ -f "${REGISTRY_AUTH_FILE}" ]; then
+	set -- "$@" -v "$(readlink -fv "${REGISTRY_AUTH_FILE}")":/var/kas/userdata/.docker/config.json:ro \
+		-e REGISTRY_AUTH_FILE="/var/kas/userdata/.docker/config.json"
+fi
+
 if [ -t 1 ]; then
 	set -- "$@" -t -i
 fi
@@ -539,7 +557,7 @@ if [ -n "${KAS_REPO_REF_DIR}" ]; then
 		-e KAS_REPO_REF_DIR=/repo-ref
 fi
 
-for var in TERM KAS_DISTRO KAS_MACHINE KAS_TARGET KAS_TASK \
+for var in TERM KAS_DISTRO KAS_MACHINE KAS_TARGET KAS_TASK KAS_CLONE_DEPTH \
            KAS_PREMIRRORS DISTRO_APT_PREMIRRORS BB_NUMBER_THREADS PARALLEL_MAKE \
            GIT_CREDENTIAL_USEHTTPPATH; do
 	if [ -n "$(eval echo \$${var})" ]; then
@@ -587,4 +605,5 @@ while [ $KAS_EXTRA_BITBAKE_ARGS -gt 0 ]; do
 	KAS_EXTRA_BITBAKE_ARGS=$((KAS_EXTRA_BITBAKE_ARGS - 1))
 done
 
+# shellcheck disable=SC2086
 trace ${KAS_CONTAINER_COMMAND} run "$@"
diff --git a/kas/ci/fast.yml b/kas/ci/fast.yml
index f262b142..d15086c2 100644
--- a/kas/ci/fast.yml
+++ b/kas/ci/fast.yml
@@ -12,7 +12,7 @@
 build_system: isar
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
 
diff --git a/kas/ci/full.yml b/kas/ci/full.yml
index 4a49bebe..6c0574cf 100644
--- a/kas/ci/full.yml
+++ b/kas/ci/full.yml
@@ -12,7 +12,7 @@
 build_system: isar
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
 
diff --git a/kas/common/base.yml b/kas/common/base.yml
index d8b3066b..3fb1b572 100644
--- a/kas/common/base.yml
+++ b/kas/common/base.yml
@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------------------
 
 header:
-  version: 16
+  version: 17
 
 machine: qemuamd64
 target: mtda-image
diff --git a/kas/debian/bookworm-base.yml b/kas/debian/bookworm-base.yml
index 5b1a2ed7..b001202d 100644
--- a/kas/debian/bookworm-base.yml
+++ b/kas/debian/bookworm-base.yml
@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------------------
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/common/base.yml
 
diff --git a/kas/debian/mtda-beaglebone-black.yml b/kas/debian/mtda-beaglebone-black.yml
index 18f77a65..dbfc9607 100644
--- a/kas/debian/mtda-beaglebone-black.yml
+++ b/kas/debian/mtda-beaglebone-black.yml
@@ -13,6 +13,6 @@ build_system: isar
 machine: beaglebone-black
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
diff --git a/kas/debian/mtda-nanopi-all.yml b/kas/debian/mtda-nanopi-all.yml
index df469daa..12d247fe 100644
--- a/kas/debian/mtda-nanopi-all.yml
+++ b/kas/debian/mtda-nanopi-all.yml
@@ -12,7 +12,7 @@
 build_system: isar
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
 
diff --git a/kas/debian/mtda-nanopi-neo.yml b/kas/debian/mtda-nanopi-neo.yml
index 5ba00e3a..467a1f9d 100644
--- a/kas/debian/mtda-nanopi-neo.yml
+++ b/kas/debian/mtda-nanopi-neo.yml
@@ -13,6 +13,6 @@ build_system: isar
 machine: nanopi-neo
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
diff --git a/kas/debian/mtda-nanopi-r1.yml b/kas/debian/mtda-nanopi-r1.yml
index 895d5989..b56ff2a6 100644
--- a/kas/debian/mtda-nanopi-r1.yml
+++ b/kas/debian/mtda-nanopi-r1.yml
@@ -13,6 +13,6 @@ build_system: isar
 machine: nanopi-r1
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
diff --git a/kas/debian/mtda-qemu-amd64.yml b/kas/debian/mtda-qemu-amd64.yml
index 91b4d2c6..3e4cb047 100644
--- a/kas/debian/mtda-qemu-amd64.yml
+++ b/kas/debian/mtda-qemu-amd64.yml
@@ -13,6 +13,6 @@ build_system: isar
 machine: qemuamd64
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
diff --git a/kas/debian/mtda-rpi4b.yml b/kas/debian/mtda-rpi4b.yml
index 5864ccdd..1e19274a 100644
--- a/kas/debian/mtda-rpi4b.yml
+++ b/kas/debian/mtda-rpi4b.yml
@@ -13,6 +13,6 @@ build_system: isar
 machine: rpi4b
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/debian/bookworm-base.yml
diff --git a/kas/opt/lava.yml b/kas/opt/lava.yml
index e7aaae63..436e3596 100644
--- a/kas/opt/lava.yml
+++ b/kas/opt/lava.yml
@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------------------
 
 header:
-  version: 16
+  version: 17
 
 local_conf_header:
   lava_override: |
diff --git a/kas/ubuntu/mtda-qemu-amd64.yml b/kas/ubuntu/mtda-qemu-amd64.yml
index 067472bc..8f54d677 100644
--- a/kas/ubuntu/mtda-qemu-amd64.yml
+++ b/kas/ubuntu/mtda-qemu-amd64.yml
@@ -12,7 +12,7 @@
 build_system: isar
 
 header:
-  version: 16
+  version: 17
   includes:
     - kas/common/base.yml