diff --git a/src/agent/Makefile b/src/agent/Makefile
index 0fed742b9b..9639ce2d61 100644
--- a/src/agent/Makefile
+++ b/src/agent/Makefile
@@ -217,4 +217,11 @@ codecov-html: check_tarpaulin
 
 ##TARGET generate-protocols: generate/update grpc agent protocols
 generate-protocols:
+	image=$$(docker build -q \
+	  --build-arg GO_VERSION=$$(yq '.languages.golang.version' $(CURDIR)/../../versions.yaml) \
+	  --build-arg PROTOC_VERSION=$$(yq '.externals.protoc.version' $(CURDIR)/../../versions.yaml | grep -oE "[0-9.]+") \
+	  --build-arg PROTOC_GEN_GO_VERSION=$$(yq '.externals.protoc-gen-go.version' $(CURDIR)/../../versions.yaml) \
+	  --build-arg TTRPC_VERSION=$$(yq '.externals.ttrpc.version' $(CURDIR)/../../versions.yaml) \
+	  $(CURDIR)/../../tools/packaging/static-build/codegen) && \
+	docker run --rm --workdir /kata/src/agent -v $(CURDIR)/../..:/kata --user $(shell id -u) $$image \
 	../libs/protocols/hack/update-generated-proto.sh all
diff --git a/tools/packaging/static-build/codegen/Dockerfile b/tools/packaging/static-build/codegen/Dockerfile
new file mode 100644
index 0000000000..6d3671ea3c
--- /dev/null
+++ b/tools/packaging/static-build/codegen/Dockerfile
@@ -0,0 +1,23 @@
+# Copyright (c) 2025 Edgeless Systems gmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+ARG GO_VERSION=
+
+FROM busybox:1.37.0 AS resources
+
+WORKDIR /usr/local
+
+ARG PROTOC_VERSION=
+RUN wget -O /tmp/protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip && \
+    unzip /tmp/protoc.zip
+
+FROM golang:${GO_VERSION}
+
+COPY --from=resources /usr/local /usr
+
+ARG PROTOC_GEN_GO_VERSION=
+RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}
+ARG TTRPC_VERSION=
+RUN go install github.com/containerd/ttrpc/cmd/protoc-gen-go-ttrpc@${TTRPC_VERSION}
+RUN go install github.com/containerd/ttrpc/cmd/protoc-gen-gogottrpc@${TTRPC_VERSION}
diff --git a/versions.yaml b/versions.yaml
index fd2ceaf37d..000904f492 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -374,6 +374,21 @@ externals:
       package: "ArmVirtPkg/ArmVirtQemu.dsc"
       package_output_dir: "ArmVirtQemu-AARCH64"
 
+  protoc:
+    description: "Protobuf compiler"
+    url: "https://github.com/protocolbuffers/protobuf/releases"
+    version: "v21.12"
+
+  protoc-gen-go:
+    description: "Protobuf Go compiler"
+    url: "https://github.com/protocolbuffers/protobuf-go/releases"
+    version: "v1.28.1"
+
+  ttrpc:
+    description: "ttRPC libary and code generation utilities"
+    url: "https://github.com/containerd/ttrpc/releases"
+    version: "v1.2.7"
+
   virtiofsd:
     description: "vhost-user virtio-fs device backend written in Rust"
     url: "https://gitlab.com/virtio-fs/virtiofsd"