diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4289b5..6fda6eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,6 @@ jobs:
       yaml-paths: ".github/workflows/ci.yml"
       release-notes-extra: |
         CPython 3.12.3 distribution for Nanvix with pure Python pip packages.
-      docker-image: "ghcr.io/nanvix/nanvix-sdk-c-clang@sha256:f61737cb0780e6a2058c6d0bdf8ae5562db18de437173b2bcbbe6973abd3689f" # yamllint disable-line rule:line-length
       test-output-globs: '["nanvix_rootfs.img"]'
     secrets:
       GH_TOKEN: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.nanvix/nanvix.lock b/.nanvix/nanvix.lock
new file mode 100644
index 0000000..8dc0dda
--- /dev/null
+++ b/.nanvix/nanvix.lock
@@ -0,0 +1,352 @@
+# nanvix.lock - auto-generated by nanvix_zutil. DO NOT EDIT.
+
+[metadata]
+manifest-hash = "sha256:37bb421f448d064d95a792c5242d1f32ce8f6d4ddb036663044f48f9abd26dfb"
+nanvix-zutil-version = "0.15.3"
+
+[metadata.sdk]
+schema-version = 1
+sdk-version = "v0.20.0-sdk.2"
+provider-id = "c-clang"
+provider = "clang"
+role = "c"
+image-name = "ghcr.io/nanvix/nanvix-sdk-c-clang"
+image-digest = "sha256:880ed7e6a20fe9bf2536b1b3ba9bdbbd067a48f043ec9131d3dd398c65f11f35"
+image-ref = "ghcr.io/nanvix/nanvix-sdk-c-clang@sha256:880ed7e6a20fe9bf2536b1b3ba9bdbbd067a48f043ec9131d3dd398c65f11f35"
+nanvix-tag = "v0.20.0"
+nanvix-version = "0.20.0"
+nanvix-commit = "edda6ab30be8c804a9a2baeaca0195945c3e3bc1"
+sysroot-sha256 = "2bebdcf3679936de83f125821ddc033aef5727532fc2d2e2c720023cb5836788"
+
+[metadata.sdk.target]
+alias = "i686-nanvix"
+triple = "i686-unknown-nanvix"
+
+[metadata.sdk.toolchain]
+llvm_commit = "2540a4de042a39d88c4ecd920bf0351288f1dc4a"
+llvm_version = "22.1.8"
+port_branch = "nanvix/v22.1.8"
+
+[metadata.sdk.compat]
+abi = "static-elf"
+c_abi = "i686-nanvix-sysv-1"
+cxx_abi = "libc++"
+min_nanvix_os = "0.19.9"
+
+[metadata.sdk.features]
+compiler_rt = "builtins-only"
+dynamic_loader = false
+filesystem = true
+localization = true
+wide_chars = true
+
+
+[[package]]
+name = "nanvix"
+repo = "nanvix/nanvix"
+kind = "sysroot"
+ref-kind = "tag"
+ref-value = "0.20.0"
+resolved-tag = "v0.20.0"
+resolved-commitish = "edda6ab30be8c804a9a2baeaca0195945c3e3bc1"
+release-id = 352415131
+dependencies = []
+
+[[package.assets]]
+name = "nanvix-windows-x86-microvm-standalone-release-256mb-edda6ab30be8c804a9a2baeaca0195945c3e3bc1.zip"
+url = "https://github.com/nanvix/nanvix/releases/download/v0.20.0/nanvix-windows-x86-microvm-standalone-release-256mb-edda6ab30be8c804a9a2baeaca0195945c3e3bc1.zip"
+id = 473170262
+
+[[package.assets]]
+name = "nanvix-x86-microvm-single-process-release-256mb-edda6ab30be8c804a9a2baeaca0195945c3e3bc1.tar.bz2"
+url = "https://github.com/nanvix/nanvix/releases/download/v0.20.0/nanvix-x86-microvm-single-process-release-256mb-edda6ab30be8c804a9a2baeaca0195945c3e3bc1.tar.bz2"
+id = 473170304
+
+[[package.assets]]
+name = "nanvix-x86-microvm-standalone-release-256mb-edda6ab30be8c804a9a2baeaca0195945c3e3bc1.tar.bz2"
+url = "https://github.com/nanvix/nanvix/releases/download/v0.20.0/nanvix-x86-microvm-standalone-release-256mb-edda6ab30be8c804a9a2baeaca0195945c3e3bc1.tar.bz2"
+id = 473170309
+
+[[package]]
+name = "cpython"
+repo = "nanvix/cpython"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "3.12.3-nanvix-0.20.0-sdk.2"
+resolved-tag = "3.12.3-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v3.12.3"
+release-id = 352920498
+dependencies = [
+    "zlib",
+    "sqlite",
+    "openssl",
+    "bzip2",
+    "libffi",
+    "libxml2",
+    "libxslt",
+    "lxml",
+    "xz",
+]
+
+[[package.assets]]
+name = "cpython-microvm-standalone-256mb-buildroot.tar.gz"
+url = "https://github.com/nanvix/cpython/releases/download/3.12.3-nanvix-0.20.0-sdk.2/cpython-microvm-standalone-256mb-buildroot.tar.gz"
+id = 475043949
+
+[[package.assets]]
+name = "cpython-microvm-standalone-256mb-buildroot.zip"
+url = "https://github.com/nanvix/cpython/releases/download/3.12.3-nanvix-0.20.0-sdk.2/cpython-microvm-standalone-256mb-buildroot.zip"
+id = 475043943
+
+[[package.assets]]
+name = "cpython-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/cpython/releases/download/3.12.3-nanvix-0.20.0-sdk.2/cpython-microvm-standalone-256mb.tar.gz"
+id = 475043951
+
+[[package.assets]]
+name = "cpython-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/cpython/releases/download/3.12.3-nanvix-0.20.0-sdk.2/cpython-microvm-standalone-256mb.zip"
+id = 475043945
+
+[[package]]
+name = "zlib"
+repo = "nanvix/zlib"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "1.3.1-nanvix-0.20.0-sdk.2"
+resolved-tag = "1.3.1-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v1.3.1"
+release-id = 352904054
+dependencies = []
+transitive = true
+required-by = [
+    "cpython",
+    "sqlite",
+    "libxml2",
+    "libxslt",
+    "lxml",
+]
+
+[[package.assets]]
+name = "zlib-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/zlib/releases/download/1.3.1-nanvix-0.20.0-sdk.2/zlib-microvm-standalone-256mb.tar.gz"
+id = 474984229
+
+[[package.assets]]
+name = "zlib-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/zlib/releases/download/1.3.1-nanvix-0.20.0-sdk.2/zlib-microvm-standalone-256mb.zip"
+id = 474984228
+
+[[package]]
+name = "sqlite"
+repo = "nanvix/sqlite"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "3.49.0-nanvix-0.20.0-sdk.2"
+resolved-tag = "3.49.0-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v3.49.0"
+release-id = 352907375
+dependencies = [
+    "zlib",
+]
+transitive = true
+required-by = [
+    "cpython",
+]
+
+[[package.assets]]
+name = "sqlite-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/sqlite/releases/download/3.49.0-nanvix-0.20.0-sdk.2/sqlite-microvm-standalone-256mb.tar.gz"
+id = 474998208
+
+[[package.assets]]
+name = "sqlite-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/sqlite/releases/download/3.49.0-nanvix-0.20.0-sdk.2/sqlite-microvm-standalone-256mb.zip"
+id = 474998211
+
+[[package]]
+name = "openssl"
+repo = "nanvix/openssl"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "3.5.0-nanvix-0.20.0-sdk.2"
+resolved-tag = "3.5.0-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v3.5.0"
+release-id = 352904634
+dependencies = []
+transitive = true
+required-by = [
+    "cpython",
+]
+
+[[package.assets]]
+name = "openssl-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/openssl/releases/download/3.5.0-nanvix-0.20.0-sdk.2/openssl-microvm-standalone-256mb.tar.gz"
+id = 474986554
+
+[[package.assets]]
+name = "openssl-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/openssl/releases/download/3.5.0-nanvix-0.20.0-sdk.2/openssl-microvm-standalone-256mb.zip"
+id = 474986552
+
+[[package]]
+name = "bzip2"
+repo = "nanvix/bzip2"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "1.0.8-nanvix-0.20.0-sdk.2"
+resolved-tag = "1.0.8-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v1.0.8"
+release-id = 352904038
+dependencies = []
+transitive = true
+required-by = [
+    "cpython",
+]
+
+[[package.assets]]
+name = "bzip2-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/bzip2/releases/download/1.0.8-nanvix-0.20.0-sdk.2/bzip2-microvm-standalone-256mb.tar.gz"
+id = 474984175
+
+[[package.assets]]
+name = "bzip2-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/bzip2/releases/download/1.0.8-nanvix-0.20.0-sdk.2/bzip2-microvm-standalone-256mb.zip"
+id = 474984177
+
+[[package]]
+name = "libffi"
+repo = "nanvix/libffi"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "3.4.6-nanvix-0.20.0-sdk.2"
+resolved-tag = "3.4.6-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v3.4.6"
+release-id = 352904257
+dependencies = []
+transitive = true
+required-by = [
+    "cpython",
+]
+
+[[package.assets]]
+name = "libffi-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/libffi/releases/download/3.4.6-nanvix-0.20.0-sdk.2/libffi-microvm-standalone-256mb.tar.gz"
+id = 474985211
+
+[[package.assets]]
+name = "libffi-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/libffi/releases/download/3.4.6-nanvix-0.20.0-sdk.2/libffi-microvm-standalone-256mb.zip"
+id = 474985210
+
+[[package]]
+name = "libxml2"
+repo = "nanvix/libxml2"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "2.12.9-nanvix-0.20.0-sdk.2"
+resolved-tag = "2.12.9-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v2.12.9"
+release-id = 352907253
+dependencies = [
+    "zlib",
+]
+transitive = true
+required-by = [
+    "cpython",
+    "libxslt",
+    "lxml",
+]
+
+[[package.assets]]
+name = "libxml2-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/libxml2/releases/download/2.12.9-nanvix-0.20.0-sdk.2/libxml2-microvm-standalone-256mb.tar.gz"
+id = 474997764
+
+[[package.assets]]
+name = "libxml2-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/libxml2/releases/download/2.12.9-nanvix-0.20.0-sdk.2/libxml2-microvm-standalone-256mb.zip"
+id = 474997762
+
+[[package]]
+name = "libxslt"
+repo = "nanvix/libxslt"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "1.1.42-nanvix-0.20.0-sdk.2"
+resolved-tag = "1.1.42-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v1.1.42"
+release-id = 352909833
+dependencies = [
+    "libxml2",
+    "zlib",
+]
+transitive = true
+required-by = [
+    "cpython",
+    "lxml",
+]
+
+[[package.assets]]
+name = "libxslt-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/libxslt/releases/download/1.1.42-nanvix-0.20.0-sdk.2/libxslt-microvm-standalone-256mb.tar.gz"
+id = 475005107
+
+[[package.assets]]
+name = "libxslt-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/libxslt/releases/download/1.1.42-nanvix-0.20.0-sdk.2/libxslt-microvm-standalone-256mb.zip"
+id = 475005106
+
+[[package]]
+name = "lxml"
+repo = "nanvix/lxml"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "5.3.0-nanvix-0.20.0-sdk.2"
+resolved-tag = "5.3.0-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v5.3.0"
+release-id = 352911729
+dependencies = [
+    "zlib",
+    "libxml2",
+    "libxslt",
+]
+transitive = true
+required-by = [
+    "cpython",
+]
+
+[[package.assets]]
+name = "lxml-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/lxml/releases/download/5.3.0-nanvix-0.20.0-sdk.2/lxml-microvm-standalone-256mb.tar.gz"
+id = 475011677
+
+[[package.assets]]
+name = "lxml-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/lxml/releases/download/5.3.0-nanvix-0.20.0-sdk.2/lxml-microvm-standalone-256mb.zip"
+id = 475011680
+
+[[package]]
+name = "xz"
+repo = "nanvix/xz"
+kind = "dependency"
+ref-kind = "version"
+ref-value = "5.2.5-nanvix-0.20.0-sdk.2"
+resolved-tag = "5.2.5-nanvix-0.20.0-sdk.2"
+resolved-commitish = "nanvix/v5.2.5"
+release-id = 352904234
+dependencies = []
+transitive = true
+required-by = [
+    "cpython",
+]
+
+[[package.assets]]
+name = "xz-microvm-standalone-256mb.tar.gz"
+url = "https://github.com/nanvix/xz/releases/download/5.2.5-nanvix-0.20.0-sdk.2/xz-microvm-standalone-256mb.tar.gz"
+id = 474985033
+
+[[package.assets]]
+name = "xz-microvm-standalone-256mb.zip"
+url = "https://github.com/nanvix/xz/releases/download/5.2.5-nanvix-0.20.0-sdk.2/xz-microvm-standalone-256mb.zip"
+id = 474985031
diff --git a/.nanvix/nanvix.toml b/.nanvix/nanvix.toml
index 33f7020..21dcbda 100644
--- a/.nanvix/nanvix.toml
+++ b/.nanvix/nanvix.toml
@@ -11,3 +11,10 @@ memory = ["256mb"]
 
 [dependencies]
 cpython = "3.12.3"
+
+[toolchain]
+kind = "nanvix-sdk"
+provider = "c-clang"
+sdk-version = "v0.20.0-sdk.2"
+sdk-image = "ghcr.io/nanvix/nanvix-sdk-c-clang"
+sdk-digest = "sha256:880ed7e6a20fe9bf2536b1b3ba9bdbbd067a48f043ec9131d3dd398c65f11f35"
diff --git a/.nanvix/src/build.py b/.nanvix/src/build.py
index 59d5770..ed155dd 100644
--- a/.nanvix/src/build.py
+++ b/.nanvix/src/build.py
@@ -24,7 +24,7 @@
 from nanvix_zutil.helpers import InitRdArgs
 from nanvix_zutil.paths import nanvix_root, repo_root, test_out
 
-from .lib import SDK_IMAGE, LibMixin, mkramfs_binary, nanvixd_binary
+from .lib import LibMixin, mkramfs_binary, nanvixd_binary
 
 
 class BuildMixin(LibMixin):
@@ -417,12 +417,19 @@ def _precompile_pyc(
             tf.add(str(pylib), arcname=".")
         in_bytes = in_buf.getvalue()
 
+        sdk_image = self.manifest.toolchain.effective_build_ref
+        if sdk_image is None:
+            log.fatal(
+                "nanvix.toml does not define an SDK build image.",
+                code=EXIT_BUILD_FAILURE,
+            )
+
         cmd = [
             "docker",
             "run",
             "--rm",
             "-i",
-            SDK_IMAGE,
+            sdk_image,
             "sh",
             "-c",
             script,
diff --git a/.nanvix/src/lib.py b/.nanvix/src/lib.py
index 5d97b75..4b13b5a 100644
--- a/.nanvix/src/lib.py
+++ b/.nanvix/src/lib.py
@@ -25,7 +25,6 @@
     "DEFAULT_TIMEOUT",
     "IS_WINDOWS",
     "LibMixin",
-    "SDK_IMAGE",
     "mkramfs_binary",
     "nanvixd_binary",
 )
@@ -35,12 +34,6 @@
 
 IS_WINDOWS = sys.platform == "win32"
 
-SDK_IMAGE = (
-    "ghcr.io/nanvix/nanvix-sdk-c-clang"
-    "@sha256:f61737cb0780e6a2058c6d0bdf8ae5562db18de437173b2bcbbe6973abd3689f"
-)
-
-
 def nanvixd_binary() -> str:
     """Return the nanvixd binary name for the current host platform."""
     return "nanvixd.exe" if IS_WINDOWS else "nanvixd.elf"
diff --git a/README.md b/README.md
index fdd26d3..4ebc544 100644
--- a/README.md
+++ b/README.md
@@ -145,8 +145,7 @@ git clone https://github.com/nanvix/nanvix-python.git
 cd nanvix-python
 
 # Download the runtime-only sysroot and SDK-built CPython.
-./z setup --with-docker \
-  ghcr.io/nanvix/nanvix-sdk-c-clang@sha256:f61737cb0780e6a2058c6d0bdf8ae5562db18de437173b2bcbbe6973abd3689f
+./z setup
 ./z build      # Install pip packages and generate ramfs image
 ./z test       # Run smoke test and functional tests
 ./z release    # Package standalone runtime bundle into dist/
diff --git a/doc/building.md b/doc/building.md
index c3dbc4d..48161a5 100644
--- a/doc/building.md
+++ b/doc/building.md
@@ -34,8 +34,7 @@ git clone --recurse-submodules https://github.com/nanvix/nanvix-python.git
 cd nanvix-python
 
 # 2. Download the runtime and exact SDK-built CPython dependency
-./z setup --with-docker \
-  ghcr.io/nanvix/nanvix-sdk-c-clang@sha256:f61737cb0780e6a2058c6d0bdf8ae5562db18de437173b2bcbbe6973abd3689f
+./z setup
 
 # 3. Install packages and generate the bytecode-only ramfs
 ./z build
@@ -52,7 +51,7 @@ cd nanvix-python
 On Windows, use the PowerShell wrapper:
 
 ```powershell
-.\z.ps1 setup --with-docker ghcr.io/nanvix/nanvix-sdk-c-clang@sha256:f61737cb0780e6a2058c6d0bdf8ae5562db18de437173b2bcbbe6973abd3689f
+.\z.ps1 setup
 .\z.ps1 build
 .\z.ps1 test
 ```