diff --git a/.github/workflows/build-kata-static-tarball-amd64.yaml b/.github/workflows/build-kata-static-tarball-amd64.yaml
index 956e4eaba3..e57ce85670 100644
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -213,6 +213,8 @@ jobs:
           - rootfs-image-mariner
           - rootfs-image-nvidia-gpu
           - rootfs-image-nvidia-gpu-confidential
+          - rootfs-image-nvidia
+          - rootfs-image-nvidia-gpu-extension
           - rootfs-initrd
           - rootfs-initrd-confidential
     concurrency:
diff --git a/.github/workflows/build-kata-static-tarball-arm64.yaml b/.github/workflows/build-kata-static-tarball-arm64.yaml
index 01561a767a..c895185296 100644
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -205,6 +205,8 @@ jobs:
           - rootfs-image-confidential
           - rootfs-image-coco-extension
           - rootfs-image-nvidia-gpu
+          - rootfs-image-nvidia
+          - rootfs-image-nvidia-gpu-extension
           - rootfs-initrd
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }}
diff --git a/tools/packaging/kata-deploy/local-build/Makefile b/tools/packaging/kata-deploy/local-build/Makefile
index 09171ce7e7..92c7366190 100644
--- a/tools/packaging/kata-deploy/local-build/Makefile
+++ b/tools/packaging/kata-deploy/local-build/Makefile
@@ -123,6 +123,8 @@ NVGPU_FINAL_TARBALL_INPUTS = \
 	kata-static-virtiofsd.tar.zst \
 	kata-static-rootfs-image-nvidia-gpu.tar.zst \
 	kata-static-rootfs-image-nvidia-gpu-confidential.tar.zst \
+	kata-static-rootfs-image-nvidia.tar.zst \
+	kata-static-rootfs-image-nvidia-gpu-extension.tar.zst \
 	kata-static-shim-v2-go.tar.zst \
 	kata-static-shim-v2-rust.tar.zst
 
@@ -131,7 +133,7 @@ ifneq ($(NVGPU_BASE_TARBALLS),)
 nvgpu-tarball:
 	${MAKE} -f $(MK_PATH) kata-tarball \
 		BASE_TARBALLS="$(NVGPU_BASE_TARBALLS)" \
-		BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball" \
+		BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball rootfs-image-nvidia-tarball rootfs-image-nvidia-gpu-extension-tarball" \
 		FINAL_TARBALL_INPUTS="$(NVGPU_FINAL_TARBALL_INPUTS)" \
 		FINAL_TARBALL_MERGE_MODE=passthrough \
 		DEPS=
@@ -299,6 +301,17 @@ DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-
 rootfs-image-nvidia-gpu-confidential-tarball: $(DEPS)
 	${MAKE} $@-build
 
+# Composable NVIDIA stack: the driver-agnostic nvidia boot image and the
+# driver-versioned gpu extension are both carved out of the same chiseled tree, so
+# they share the monolith's (non-confidential) build dependencies.
+DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball
+rootfs-image-nvidia-tarball: $(DEPS)
+	${MAKE} $@-build
+
+DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball
+rootfs-image-nvidia-gpu-extension-tarball: $(DEPS)
+	${MAKE} $@-build
+
 DEPS := agent-tarball pause-image-tarball coco-guest-components-tarball kernel-cca-confidential-tarball
 rootfs-cca-confidential-image-tarball: $(DEPS)
 	${MAKE} $@-build
diff --git a/tools/packaging/kata-deploy/shim-components.json b/tools/packaging/kata-deploy/shim-components.json
index 7573cd1557..83a254c0f0 100644
--- a/tools/packaging/kata-deploy/shim-components.json
+++ b/tools/packaging/kata-deploy/shim-components.json
@@ -37,19 +37,19 @@
       "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
     },
     "qemu-nvidia-gpu-runtime-rs": {
-      "x86_64":  ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
+      "x86_64":  ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"]
     },
     "qemu-nvidia-gpu-snp": {
       "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
     },
     "qemu-nvidia-gpu-snp-runtime-rs": {
-      "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
+      "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-sev"]
     },
     "qemu-nvidia-gpu-tdx": {
       "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
     },
     "qemu-nvidia-gpu-tdx-runtime-rs": {
-      "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
+      "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-tdx"]
     },
     "qemu-coco-dev": {
       "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"],
diff --git a/tools/packaging/static-build/coco-guest-components/Dockerfile b/tools/packaging/static-build/coco-guest-components/Dockerfile
index 65cd49fa12..c8d8543ef1 100644
--- a/tools/packaging/static-build/coco-guest-components/Dockerfile
+++ b/tools/packaging/static-build/coco-guest-components/Dockerfile
@@ -22,6 +22,7 @@ RUN apt-get update && \
 	curl \
 	binutils \
 	clang \
+	cryptsetup-bin \
 	g++ \
 	gcc \
 	git \
diff --git a/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh b/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh
index 604e9ac5c9..745211d8c4 100755
--- a/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh
+++ b/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh
@@ -42,6 +42,16 @@ build_coco_guest_components_from_source() {
 
 	install -D -m0644 "confidential-data-hub/hub/src/image/ocicrypt_config.json" "${DESTDIR}/etc/ocicrypt_config.json"
 
+	# CDH's secure_mount LUKS-formats encrypted scratch volumes by exec'ing
+	# cryptsetup. Encrypted storage is a CoCo-only feature, so cryptsetup ships
+	# in this extension rather than the guest rootfs (the nvidia base image carries
+	# only veritysetup plus the plain mke2fs/mkfs.ext4/dd storage tooling).
+	# cryptsetup's shared-library closure is identical to veritysetup's, which
+	# the base already ships unconditionally, so bundle just the binary; the
+	# coco-extension manifest puts ${extension_root}/usr/sbin on CDH's PATH so the
+	# runtime lookup resolves (see kata-deploy-binaries.sh).
+	install -D -m0755 /usr/sbin/cryptsetup "${DESTDIR}/usr/sbin/cryptsetup"
+
 	if [[ -n "${NV_ATTESTER:-}" ]]; then
 		echo "build attestation-agent-nv with nvidia-attester support"
 
@@ -55,6 +65,18 @@ build_coco_guest_components_from_source() {
 
 		mkdir -p "${DESTDIR}/usr/local/lib"
 		cp -a /usr/local/lib/libnvat.so* "${DESTDIR}/usr/local/lib/"
+
+		# attestation-agent-nv links libnvat.so, which in turn pulls in
+		# libxml2/zlib/lzma and the C++ runtime. None of those ship in the
+		# guest rootfs, so bundle every non-glibc dependency next to
+		# libnvat.so. The coco-extension manifest points the nvidia attester's
+		# LD_LIBRARY_PATH here, so the dynamic linker resolves them at runtime.
+		ldd /usr/local/lib/libnvat.so | awk '/=> \// { print $3 }' | while read -r dep; do
+			case "$(basename "${dep}")" in
+				libc.so.*|libm.so.*|libdl.so.*|libpthread.so.*|librt.so.*|ld-linux*|linux-vdso*) continue ;;
+			esac
+			install -D -m0755 "${dep}" "${DESTDIR}/usr/local/lib/$(basename "${dep}")"
+		done
 	fi
 
 	popd