diff --git a/python/3.12/Dockerfile b/python/3.12/Dockerfile
index 596c0da..a2456ee 100644
--- a/python/3.12/Dockerfile
+++ b/python/3.12/Dockerfile
@@ -3,7 +3,6 @@ FROM $BUILD_FROM
 
 ARG \
     PYTHON_VERSION \
-    PIP_VERSION \
     CERT_IDENTITY \
     CERT_OIDC_ISSUER \
     QEMU_CPU
@@ -14,8 +13,9 @@ ENV PATH=/usr/local/bin:$PATH
 # Set shell
 SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 
-COPY *.patch /usr/src/
-RUN set -ex \
+RUN \
+    --mount=type=bind,source=./patches,target=/usr/src/patches \
+    set -ex \
     && export PYTHON_VERSION=${PYTHON_VERSION} \
     && apk add --no-cache --virtual .fetch-deps \
         openssl \
@@ -67,7 +67,7 @@ RUN set -ex \
     # add build deps before removing fetch deps in case there's overlap
     && apk del .fetch-deps .cosign \
     \
-    && for i in /usr/src/*.patch; do \
+    && for i in /usr/src/patches/*.patch; do \
         patch -d /usr/src/python -p 1 < "${i}"; done \
     && cd /usr/src/python \
     && gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" \
@@ -102,32 +102,16 @@ RUN set -ex \
             -type d -a \( -name test -o -name tests \) \
         \) -exec rm -rf '{}' + \
     && rm -rf /usr/src/python \
-    && rm -f /usr/src/*.patch
-
 # make some useful symlinks that are expected to exist
-RUN cd /usr/local/bin \
+    && cd /usr/local/bin \
     && ln -s idle3 idle \
     && ln -s pydoc3 pydoc \
     && ln -s python3 python \
     && ln -s python3-config python-config
 
+ARG PIP_VERSION
+
 RUN set -ex; \
-    \
-    apk add --no-cache --virtual .fetch-deps openssl; \
-    \
-    curl -L -o get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
-    \
-    apk del .fetch-deps; \
-    \
-    python get-pip.py \
-        --disable-pip-version-check \
-        --no-cache-dir \
-        pip==${PIP_VERSION} \
-    ; \
-    pip --version; \
-    \
-    find /usr/local -depth \
-        \( \
-            -type d -a \( -name test -o -name tests \) \
-        \) -exec rm -rf '{}' +; \
-    rm -f get-pip.py
+    python -m ensurepip --upgrade --default-pip; \
+    pip3 install --no-cache-dir --upgrade pip=="${PIP_VERSION}"; \
+    pip --version
diff --git a/python/3.12/arm-alignment.patch b/python/3.12/patches/arm-alignment.patch
similarity index 100%
rename from python/3.12/arm-alignment.patch
rename to python/3.12/patches/arm-alignment.patch
diff --git a/python/3.12/asynctio_unix_events.patch b/python/3.12/patches/asynctio_unix_events.patch
similarity index 100%
rename from python/3.12/asynctio_unix_events.patch
rename to python/3.12/patches/asynctio_unix_events.patch
diff --git a/python/3.12/gh-106527-asyncio-optimize-to-add-remove-readers-and.patch b/python/3.12/patches/gh-106527-asyncio-optimize-to-add-remove-readers-and.patch
similarity index 100%
rename from python/3.12/gh-106527-asyncio-optimize-to-add-remove-readers-and.patch
rename to python/3.12/patches/gh-106527-asyncio-optimize-to-add-remove-readers-and.patch
diff --git a/python/3.12/gh-106554-replace-_BaseSelectorImpl._key_from_fd-wit.patch b/python/3.12/patches/gh-106554-replace-_BaseSelectorImpl._key_from_fd-wit.patch
similarity index 100%
rename from python/3.12/gh-106554-replace-_BaseSelectorImpl._key_from_fd-wit.patch
rename to python/3.12/patches/gh-106554-replace-_BaseSelectorImpl._key_from_fd-wit.patch
diff --git a/python/3.12/gh-106664-selectors-add-get-method-to-_SelectorMappi.patch b/python/3.12/patches/gh-106664-selectors-add-get-method-to-_SelectorMappi.patch
similarity index 100%
rename from python/3.12/gh-106664-selectors-add-get-method-to-_SelectorMappi.patch
rename to python/3.12/patches/gh-106664-selectors-add-get-method-to-_SelectorMappi.patch
diff --git a/python/3.12/gh-106751-selectors-optimize-EpollSelector.select-10.patch b/python/3.12/patches/gh-106751-selectors-optimize-EpollSelector.select-10.patch
similarity index 100%
rename from python/3.12/gh-106751-selectors-optimize-EpollSelector.select-10.patch
rename to python/3.12/patches/gh-106751-selectors-optimize-EpollSelector.select-10.patch
diff --git a/python/3.12/gh-110733-Optimize-_run_once-for-many-iterations-of-.patch b/python/3.12/patches/gh-110733-Optimize-_run_once-for-many-iterations-of-.patch
similarity index 100%
rename from python/3.12/gh-110733-Optimize-_run_once-for-many-iterations-of-.patch
rename to python/3.12/patches/gh-110733-Optimize-_run_once-for-many-iterations-of-.patch
diff --git a/python/3.12/gh-112989-asyncio-Reduce-overhead-to-connect-sockets.patch b/python/3.12/patches/gh-112989-asyncio-Reduce-overhead-to-connect-sockets.patch
similarity index 100%
rename from python/3.12/gh-112989-asyncio-Reduce-overhead-to-connect-sockets.patch
rename to python/3.12/patches/gh-112989-asyncio-Reduce-overhead-to-connect-sockets.patch
diff --git a/python/3.12/gh-126156-Improve-performance-of-creating-Morsel-obj.patch b/python/3.12/patches/gh-126156-Improve-performance-of-creating-Morsel-obj.patch
similarity index 100%
rename from python/3.12/gh-126156-Improve-performance-of-creating-Morsel-obj.patch
rename to python/3.12/patches/gh-126156-Improve-performance-of-creating-Morsel-obj.patch
diff --git a/python/3.12/musl-find_library.patch b/python/3.12/patches/musl-find_library.patch
similarity index 100%
rename from python/3.12/musl-find_library.patch
rename to python/3.12/patches/musl-find_library.patch
diff --git a/python/3.13/Dockerfile b/python/3.13/Dockerfile
index 596c0da..a2456ee 100644
--- a/python/3.13/Dockerfile
+++ b/python/3.13/Dockerfile
@@ -3,7 +3,6 @@ FROM $BUILD_FROM
 
 ARG \
     PYTHON_VERSION \
-    PIP_VERSION \
     CERT_IDENTITY \
     CERT_OIDC_ISSUER \
     QEMU_CPU
@@ -14,8 +13,9 @@ ENV PATH=/usr/local/bin:$PATH
 # Set shell
 SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 
-COPY *.patch /usr/src/
-RUN set -ex \
+RUN \
+    --mount=type=bind,source=./patches,target=/usr/src/patches \
+    set -ex \
     && export PYTHON_VERSION=${PYTHON_VERSION} \
     && apk add --no-cache --virtual .fetch-deps \
         openssl \
@@ -67,7 +67,7 @@ RUN set -ex \
     # add build deps before removing fetch deps in case there's overlap
     && apk del .fetch-deps .cosign \
     \
-    && for i in /usr/src/*.patch; do \
+    && for i in /usr/src/patches/*.patch; do \
         patch -d /usr/src/python -p 1 < "${i}"; done \
     && cd /usr/src/python \
     && gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" \
@@ -102,32 +102,16 @@ RUN set -ex \
             -type d -a \( -name test -o -name tests \) \
         \) -exec rm -rf '{}' + \
     && rm -rf /usr/src/python \
-    && rm -f /usr/src/*.patch
-
 # make some useful symlinks that are expected to exist
-RUN cd /usr/local/bin \
+    && cd /usr/local/bin \
     && ln -s idle3 idle \
     && ln -s pydoc3 pydoc \
     && ln -s python3 python \
     && ln -s python3-config python-config
 
+ARG PIP_VERSION
+
 RUN set -ex; \
-    \
-    apk add --no-cache --virtual .fetch-deps openssl; \
-    \
-    curl -L -o get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
-    \
-    apk del .fetch-deps; \
-    \
-    python get-pip.py \
-        --disable-pip-version-check \
-        --no-cache-dir \
-        pip==${PIP_VERSION} \
-    ; \
-    pip --version; \
-    \
-    find /usr/local -depth \
-        \( \
-            -type d -a \( -name test -o -name tests \) \
-        \) -exec rm -rf '{}' +; \
-    rm -f get-pip.py
+    python -m ensurepip --upgrade --default-pip; \
+    pip3 install --no-cache-dir --upgrade pip=="${PIP_VERSION}"; \
+    pip --version
diff --git a/python/3.13/gh-126156-Improve-performance-of-creating-Morsel-obj.patch b/python/3.13/patches/gh-126156-Improve-performance-of-creating-Morsel-obj.patch
similarity index 100%
rename from python/3.13/gh-126156-Improve-performance-of-creating-Morsel-obj.patch
rename to python/3.13/patches/gh-126156-Improve-performance-of-creating-Morsel-obj.patch
diff --git a/python/3.13/gh-134173-optimize-state-transfer-between-concurrent.patch b/python/3.13/patches/gh-134173-optimize-state-transfer-between-concurrent.patch
similarity index 100%
rename from python/3.13/gh-134173-optimize-state-transfer-between-concurrent.patch
rename to python/3.13/patches/gh-134173-optimize-state-transfer-between-concurrent.patch
diff --git a/python/3.13/musl-find_library.patch b/python/3.13/patches/musl-find_library.patch
similarity index 100%
rename from python/3.13/musl-find_library.patch
rename to python/3.13/patches/musl-find_library.patch
diff --git a/python/3.13/musl-skip_failing_tests.patch b/python/3.13/patches/musl-skip_failing_tests.patch
similarity index 100%
rename from python/3.13/musl-skip_failing_tests.patch
rename to python/3.13/patches/musl-skip_failing_tests.patch
diff --git a/python/3.14/Dockerfile b/python/3.14/Dockerfile
index 61da9c6..03a1788 100644
--- a/python/3.14/Dockerfile
+++ b/python/3.14/Dockerfile
@@ -3,7 +3,6 @@ FROM $BUILD_FROM
 
 ARG \
     PYTHON_VERSION \
-    PIP_VERSION \
     CERT_IDENTITY \
     CERT_OIDC_ISSUER \
     QEMU_CPU
@@ -14,8 +13,9 @@ ENV PATH=/usr/local/bin:$PATH
 # Set shell
 SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 
-COPY *.patch /usr/src/
-RUN set -ex \
+RUN \
+    --mount=type=bind,source=./patches,target=/usr/src/patches \
+    set -ex \
     && export PYTHON_VERSION=${PYTHON_VERSION} \
     && apk add --no-cache --virtual .fetch-deps \
         openssl \
@@ -67,7 +67,7 @@ RUN set -ex \
     # add build deps before removing fetch deps in case there's overlap
     && apk del .fetch-deps .cosign \
     \
-    && for i in /usr/src/*.patch; do \
+    && for i in /usr/src/patches/*.patch; do \
         patch -d /usr/src/python -p 1 < "${i}"; done \
     && cd /usr/src/python \
     && gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" \
@@ -103,32 +103,16 @@ RUN set -ex \
             -type d -a \( -name test -o -name tests \) \
         \) -exec rm -rf '{}' + \
     && rm -rf /usr/src/python \
-    && rm -f /usr/src/*.patch
-
 # make some useful symlinks that are expected to exist
-RUN cd /usr/local/bin \
+    && cd /usr/local/bin \
     && ln -s idle3 idle \
     && ln -s pydoc3 pydoc \
     && ln -s python3 python \
     && ln -s python3-config python-config
 
+ARG PIP_VERSION
+
 RUN set -ex; \
-    \
-    apk add --no-cache --virtual .fetch-deps openssl; \
-    \
-    curl -L -o get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
-    \
-    apk del .fetch-deps; \
-    \
-    python get-pip.py \
-        --disable-pip-version-check \
-        --no-cache-dir \
-        pip==${PIP_VERSION} \
-    ; \
-    pip --version; \
-    \
-    find /usr/local -depth \
-        \( \
-            -type d -a \( -name test -o -name tests \) \
-        \) -exec rm -rf '{}' +; \
-    rm -f get-pip.py
+    python -m ensurepip --upgrade --default-pip; \
+    pip3 install --no-cache-dir --upgrade pip=="${PIP_VERSION}"; \
+    pip --version
diff --git a/python/3.14/gh-134173-optimize-state-transfer-between-concurrent.patch b/python/3.14/patches/gh-134173-optimize-state-transfer-between-concurrent.patch
similarity index 100%
rename from python/3.14/gh-134173-optimize-state-transfer-between-concurrent.patch
rename to python/3.14/patches/gh-134173-optimize-state-transfer-between-concurrent.patch
diff --git a/python/3.14/musl-find_library.patch b/python/3.14/patches/musl-find_library.patch
similarity index 100%
rename from python/3.14/musl-find_library.patch
rename to python/3.14/patches/musl-find_library.patch