diff --git a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo
index 55810d39..d23e3d84 100644
--- a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo
+++ b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo
@@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/karmab/kcli/pubkey.gpg
 repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
+includepkgs=kcli
diff --git a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo
index 27bea4ee..e370362a 100644
--- a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo
+++ b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo
@@ -1,9 +1,15 @@
+# update includepkgs, remove docker-model-plugin
+# podman run --rm -ti quay.io/fedora/fedora:45
+# dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo
+# dnf list --available --repo=docker-ce-stable | grep "docker-ce-stable" | grep -vE "(debug|devel|\.src)" | cut -f1 -d\ | sed 's/\.x86_64//' | sed 's/\.noarch//' | paste -sd " " -
+
 [docker-ce-stable]
 name=Docker CE Stable - $basearch
 baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
 enabled=0
 gpgcheck=1
 gpgkey=https://download.docker.com/linux/fedora/gpg
+includepkgs=containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin
 
 [docker-ce-stable-source]
 name=Docker CE Stable - Sources
diff --git a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo
index 3159383c..86e03f82 100644
--- a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo
+++ b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo
@@ -4,3 +4,4 @@ baseurl=https://packages.microsoft.com/yumrepos/vscode
 enabled=0
 gpgcheck=1
 gpgkey=https://packages.microsoft.com/keys/microsoft.asc
+includepkgs=code
diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo
index 3ddb325a..bc84b829 100644
--- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo
+++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo
@@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/ledif/kairpods/pubkey.
 repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
+includepkgs=kairpods
diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo
index 22ae23ab..1eedbd1d 100644
--- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo
+++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo
@@ -9,3 +9,4 @@ repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
 priority=1
+includepkgs=Sunshine
diff --git a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo
index 791f20a1..1b2ef49a 100644
--- a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo
+++ b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo
@@ -6,3 +6,4 @@ type=rpm
 repo_gpgcheck=1
 gpgcheck=1
 gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
+includepkgs=tailscale
diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh
index 99353288..ff75157e 100755
--- a/build_scripts/base/01-packages.sh
+++ b/build_scripts/base/01-packages.sh
@@ -128,9 +128,6 @@ fi
 
 dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}"
 
-# Fedora Tailscale is usually behind
-dnf -y install --from-repo='tailscale-stable' tailscale
-
 COPR_UBLUE_OS_PACKAGES=(
     kcm_ublue
     krunner-bazaar
@@ -138,13 +135,22 @@ COPR_UBLUE_OS_PACKAGES=(
     # https://github.com/ublue-os/akmods/issues/537
     ublue-os-selinux-workarounds
     uupd
-  )
+)
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' "${COPR_UBLUE_OS_PACKAGES[@]}"
+# Fedora Tailscale is usually behind
+TAILSCALE=(tailscale)
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ledif:kairpods' kairpods
+COPR_PREFIX="copr:copr.fedorainfracloud.org"
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:lizardbyte:stable' sunshine
+dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}"
+
+# TODO: figure something out that works well across DX, nvidia with the ublue-os coprs
+# so we can have less transactions, while still not being vulnerable to copr injections
+# shellcheck disable=SC1010
+dnf do -y \
+  --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}" \
+  --action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \
+  --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine
 
 # Packages to exclude - common to all versions
 EXCLUDED_PACKAGES=(
diff --git a/build_scripts/dx/00-dx.sh b/build_scripts/dx/00-dx.sh
index 5e0a77ae..634e9549 100755
--- a/build_scripts/dx/00-dx.sh
+++ b/build_scripts/dx/00-dx.sh
@@ -61,24 +61,26 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then
   FEDORA_PACKAGES+=("rocm-hip" "rocm-opencl" "rocm-smi")
 fi
 
-echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..."
 dnf5 -y install "${FEDORA_PACKAGES[@]}"
 
-# Docker packages from their repo
-dnf -y install --from-repo=docker-ce-stable \
-    containerd.io \
-    docker-buildx-plugin \
-    docker-ce \
-    docker-ce-cli \
-    docker-compose-plugin
+# We could use Fedora's moby packages, these are "official"
+DOCKER_CE=(
+  containerd.io
+  docker-buildx-plugin
+  docker-ce
+  docker-ce-cli
+  docker-compose-plugin
+)
 
-# VSCode package from Microsoft repo
-dnf -y install --from-repo=code \
-    code
+COPR_PREFIX="copr:copr.fedorainfracloud.org"
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:karmab:kcli' kcli
+# shellcheck disable=SC1010
+dnf do -y \
+  --action install --from-repo=code code \
+  --action install --from-repo=docker-ce-stable "${DOCKER_CE[@]}" \
+  --action install --from-repo="${COPR_PREFIX}:karmab:kcli" kcli
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' ublue-os-libvirt-workarounds
+dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" ublue-os-libvirt-workarounds
 
 rsync -rvK /ctx/system_files/dx/ /