diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
index f212554ad5..da4626b51d 100755
--- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
+++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
@@ -75,8 +75,9 @@ destdir="${workdir}/kata-static"
 default_binary_permissions='0744'
 
 # Rootfs image variants that carry a dm-verity root hash (measured rootfs).
-# Their hashes are collected at build time and consumed by the Rust runtime,
-# so this list is walked in a few places - keep it in one spot to avoid drift.
+# Their hashes are collected at build time and consumed by both runtimes
+# (Go and Rust), so this list is walked in a few places - keep it in one spot to
+# avoid drift.
 readonly MEASURED_ROOTFS_VARIANTS=(
 	base
 	confidential
@@ -536,8 +537,10 @@ install_image() {
 		# Both the standard confidential image and the NVIDIA confidential
 		# image bake the CoCo guest components + pause image into the
 		# rootfs, so each stays a usable standalone monolithic CoCo image.
-		# The runtime-rs split path instead ships these in the separate
-		# CoCo extension image (rootfs-image-coco-extension).
+		# These monolithic images are no longer built in CI nor consumed by
+		# the shipped configs (both runtimes now use the composable split
+		# path: base image + CoCo extension, rootfs-image-coco-extension);
+		# they are retained only as manually buildable targets.
 		if [[ "${variant}" == *confidential ]]; then
 			COCO_GUEST_COMPONENTS_TARBALL="$(get_coco_guest_components_tarball_path)"
 			export COCO_GUEST_COMPONENTS_TARBALL
@@ -594,12 +597,11 @@ install_image_base() {
 
 #Install guest image for confidential guests
 #
-# During the transition to composable (base + extension) images this monolithic
-# confidential image still bakes in the CoCo guest components and is the image
-# used by the Go runtime. The runtime-rs shims instead use the base image plus
-# the separately built CoCo extension image (rootfs-image-coco-extension),
-# attached as an extra block device. Once the split path is validated for the
-# Go runtime too, the components can stop being baked in here.
+# This monolithic confidential image bakes the CoCo guest components into the
+# rootfs. It is no longer built in CI nor referenced by the shipped configs:
+# both the Go runtime and runtime-rs now boot the measured base image plus the
+# separately built CoCo extension image (rootfs-image-coco-extension), attached
+# as an extra block device. It is kept as a manually buildable standalone image.
 install_image_confidential() {
 	export CONFIDENTIAL_GUEST="yes"
 	if [[ "${ARCH}" == "s390x" ]]; then
diff --git a/tools/packaging/kata-deploy/shim-components.json b/tools/packaging/kata-deploy/shim-components.json
index 085aa8ed06..afcf14f51c 100644
--- a/tools/packaging/kata-deploy/shim-components.json
+++ b/tools/packaging/kata-deploy/shim-components.json
@@ -16,13 +16,13 @@
       "s390x":   ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-image", "rootfs-initrd"]
     },
     "qemu-snp": {
-      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"]
+      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-sev"]
     },
     "qemu-snp-runtime-rs": {
       "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-sev"]
     },
     "qemu-tdx": {
-      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image-confidential", "ovmf-tdx"]
+      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-tdx"]
     },
     "qemu-tdx-runtime-rs": {
       "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-tdx"]
@@ -34,7 +34,7 @@
       "s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"]
     },
     "qemu-nvidia-gpu": {
-      "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
+      "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"]
     },
     "qemu-nvidia-gpu-runtime-rs": {
       "x86_64":  ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"]
@@ -48,20 +48,20 @@
       "aarch64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia"]
     },
     "qemu-nvidia-gpu-snp": {
-      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
+      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-sev"]
     },
     "qemu-nvidia-gpu-snp-runtime-rs": {
       "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-sev"]
     },
     "qemu-nvidia-gpu-tdx": {
-      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
+      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-tdx"]
     },
     "qemu-nvidia-gpu-tdx-runtime-rs": {
       "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-tdx"]
     },
     "qemu-coco-dev": {
-      "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"],
-      "s390x":  ["shim-v2-go", "qemu", "kernel", "rootfs-image-confidential"]
+      "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension"],
+      "s390x":  ["shim-v2-go", "qemu", "kernel", "rootfs-image", "rootfs-image-coco-extension"]
     },
     "qemu-coco-dev-runtime-rs": {
       "x86_64":  ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension"],
diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh
index dd8c71254e..1f2b0b63a9 100755
--- a/tools/packaging/static-build/shim-v2/build.sh
+++ b/tools/packaging/static-build/shim-v2/build.sh
@@ -39,22 +39,17 @@ esac
 
 # Variants (targets) that build a measured rootfs as of now are:
 # - rootfs-image (the base image, measured; root hash labelled "base")
-# - rootfs-image-confidential (monolithic CoCo image, root hash "confidential")
-# - rootfs-image-coco-extension
-# - rootfs-image-nvidia-gpu / rootfs-image-nvidia-gpu-confidential (monolithic)
+# - rootfs-image-coco-extension (the CoCo guest-components extension)
 # - rootfs-image-nvidia (the driver-agnostic NVIDIA boot image)
 # - rootfs-image-nvidia-gpu-extension (the driver-versioned gpu extension)
 #
-# Both the CoCo and the NVIDIA GPU configs come in two flavours during the
-# transition to split images, and the two runtimes are built in separate `make`
-# invocations so each maps the same make var to a different root hash:
-# - runtime-rs (Rust) uses the split layout: the measured base image
-#   (@KERNELVERITYPARAMS@) plus the CoCo extension (@COCOVERITYPARAMS@), and for
-#   NVIDIA the nvidia base image (@KERNELVERITYPARAMS_NV@) plus the gpu extension
+# Both runtimes now boot the composable split layout (base image plus
+# cold-plugged extensions), so the Go and Rust `make` invocations map the same
+# make vars to the same root hashes:
+# - the measured base image (@KERNELVERITYPARAMS@) plus the CoCo extension
+#   (@COCOVERITYPARAMS@), and for NVIDIA the nvidia base image
+#   (@KERNELVERITYPARAMS_NV@) plus the gpu extension
 #   (@NVIDIAGPUEXTENSIONVERITYPARAMS@).
-# - runtime (Go) still uses the monolithic images: the confidential image
-#   (@KERNELVERITYPARAMS@) and, for NVIDIA, nvidia-gpu (@KERNELVERITYPARAMS_NV@)
-#   and nvidia-gpu-confidential (@KERNELVERITYPARAMS_CONFIDENTIAL_NV@).
 #
 # shellcheck disable=SC2154
 root_hash_dir="${repo_root_dir}/tools/packaging/kata-deploy/local-build/build"
@@ -76,27 +71,22 @@ read_verity_param() {
 	printf ' %s=%s' "${param_var}" "${root_measure_config}"
 }
 
-# The NVIDIA GPU verity params differ per runtime: runtime-rs boots the
-# composable split layout (nvidia base + gpu extension) while the Go runtime
-# still boots the monolithic nvidia-gpu / nvidia-gpu-confidential images.  Since
-# both runtimes reuse KERNELVERITYPARAMS_NV but map it to different root hashes,
-# the reads live in each runtime's own EXTRA_OPTS rather than the shared one.
+# Both runtimes boot the composable split layout, so they share the same
+# root-hash-to-make-var mapping: the measured base image plus the CoCo extension,
+# and for NVIDIA the nvidia base image plus the gpu extension.  qemu-nvidia-cpu
+# (Go) also boots the driver-agnostic nvidia base image verity-backed and reads
+# it through its own KERNELVERITYPARAMS_NV_BASE var.
+SPLIT_EXTRA_OPTS="$(read_verity_param "base" "KERNELVERITYPARAMS")"
+SPLIT_EXTRA_OPTS+="$(read_verity_param "coco-extension" "COCOVERITYPARAMS")"
+SPLIT_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV")"
+SPLIT_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-extension" "NVIDIAGPUEXTENSIONVERITYPARAMS")"
 
-# runtime-rs (Rust): split images -> base hash + CoCo extension hash, plus the
-# nvidia base and gpu extension hashes for the NVIDIA GPU configs.
-RUST_EXTRA_OPTS="$(read_verity_param "base" "KERNELVERITYPARAMS")"
-RUST_EXTRA_OPTS+="$(read_verity_param "coco-extension" "COCOVERITYPARAMS")"
-RUST_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV")"
-RUST_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-extension" "NVIDIAGPUEXTENSIONVERITYPARAMS")"
+# runtime-rs (Rust): composable split layout.
+RUST_EXTRA_OPTS="${SPLIT_EXTRA_OPTS}"
 
-# runtime (Go): monolithic confidential image -> confidential hash, plus the
-# monolithic nvidia-gpu / nvidia-gpu-confidential hashes for the NVIDIA configs.
-GO_EXTRA_OPTS="$(read_verity_param "confidential" "KERNELVERITYPARAMS")"
-GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu" "KERNELVERITYPARAMS_NV")"
-GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-confidential" "KERNELVERITYPARAMS_CONFIDENTIAL_NV")"
-# qemu-nvidia-cpu (Go) boots the driver-agnostic nvidia base image verity-backed;
-# it needs the "nvidia" base hash in its own var since KERNELVERITYPARAMS_NV
-# above is the monolithic nvidia-gpu hash.
+# runtime (Go): also the composable split layout, plus the nvidia base hash in
+# KERNELVERITYPARAMS_NV_BASE consumed by the qemu-nvidia-cpu config.
+GO_EXTRA_OPTS="${SPLIT_EXTRA_OPTS}"
 GO_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV_BASE")"
 
 # shellcheck disable=SC2154,SC2086