diff --git a/build-utils/lib/XCAT/BuildUtils.pm b/build-utils/lib/XCAT/BuildUtils.pm
index 2efb89cc0..5145504d8 100644
--- a/build-utils/lib/XCAT/BuildUtils.pm
+++ b/build-utils/lib/XCAT/BuildUtils.pm
@@ -37,7 +37,7 @@ our @EXPORT_OK = qw(
     buildinfo_text
     targetarch_from_target
     genesis_chroot_name genesis_target_arch genesis_build_plan
-    genesis_log_errors genesis_log_deny_rules
+    genesis_log_errors genesis_log_deny_rules deb_belongs_to_dist
 );
 
 # Both builders echo the commands they run under --verbose.  Set once, after
@@ -572,6 +572,20 @@ my @GENESIS_LOG_DENY = (
 
 sub genesis_log_deny_rules { return @GENESIS_LOG_DENY; }
 
+# deb_belongs_to_dist: whether a built .deb may be published into one release.
+#
+# Almost every xcat-core deb is Architecture:all and the same file serves every release, so the
+# answer is yes. The Genesis image is not: it is built per codename and carries that codename in
+# its version (2.19.0-snap...~noble). Publishing all three into every suite lets apt serve the
+# newest, which is the image of another release.
+sub deb_belongs_to_dist {
+    my ($deb, $dist) = @_;
+    return 1 unless defined $deb && defined $dist && $dist ne '';
+    my $base = basename($deb);
+    return 1 unless $base =~ /_[^_]*~([A-Za-z0-9.]+)_[^_]*\.deb\z/;
+    return $1 eq $dist ? 1 : 0;
+}
+
 sub genesis_log_errors {
     my ($text) = @_;
     return () unless defined $text && length $text;
diff --git a/builddebs.pl b/builddebs.pl
index 685910be5..7f9ce1062 100755
--- a/builddebs.pl
+++ b/builddebs.pl
@@ -41,7 +41,7 @@ use XCAT::BuildUtils qw(
     reprepro_distributions reprepro_options
     lock_id_for take_build_lock sh_quote
     sh sh_or_die usage rewrite_file write_script read_line buildinfo_text
-    genesis_build_plan genesis_log_errors
+    genesis_build_plan genesis_log_errors deb_belongs_to_dist
 );
 
 # The xcat-core packages that ship as debs. xCAT-openbmc-py, xCAT-rmc and xCAT-release
@@ -441,6 +441,9 @@ sub assemble_repo {
         for my $deb (@debs) {
             # A release that predates an architecture must not be handed its packages.
             next if basename($deb) =~ /_(\w+)\.deb\z/ && $1 ne 'all' && !$ok{$1};
+            # Nor an image built for another release: the Genesis deb carries the codename it
+            # was built on, because it carries that release's kernel.
+            next unless deb_belongs_to_dist($deb, $dist);
             sh_or_die("cd " . sh_quote($repodir) . " && reprepro -b ./ includedeb "
                . sh_quote($dist) . ' ' . sh_quote($deb),
             "FATAL: reprepro could not add $deb to $dist\n");
diff --git a/xCAT-genesis-builder/builddeb-genesis-base b/xCAT-genesis-builder/builddeb-genesis-base
index e1c550ebd..6396754cc 100755
--- a/xCAT-genesis-builder/builddeb-genesis-base
+++ b/xCAT-genesis-builder/builddeb-genesis-base
@@ -81,7 +81,7 @@ REQUIRED_PACKAGES="
     dosfstools e2fsprogs lvm2 mdadm net-tools
     bc psmisc rsync wget cpio
     isc-dhcp-client ifenslave
-    systemd-sysv hwdata btrfs-progs netcat-openbsd iputils-ping fdisk
+    systemd-sysv hwdata btrfs-progs netcat-openbsd iputils-ping fdisk ncurses-term
     dpkg-dev debhelper fakeroot devscripts vim-tiny
 "
 if [ "$BUILDARCH" = "amd64" ]; then
diff --git a/xCAT-test/unit/genesis_deb_per_codename.t b/xCAT-test/unit/genesis_deb_per_codename.t
index 1f5b4e270..637ef06ff 100644
--- a/xCAT-test/unit/genesis_deb_per_codename.t
+++ b/xCAT-test/unit/genesis_deb_per_codename.t
@@ -61,6 +61,22 @@ ok(!eval { XCAT::BuildUtils::genesis_build_plan([], 'amd64'); 1 },
 ok(!eval { XCAT::BuildUtils::genesis_target_arch('riscv64'); 1 },
     'an architecture with no Genesis image directory is an error');
 
+# --- a per-codename image reaches only its own suite --------------------------------------
+ok(XCAT::BuildUtils->can('deb_belongs_to_dist'),
+    'XCAT::BuildUtils decides which suite a deb belongs to');
+if (XCAT::BuildUtils->can('deb_belongs_to_dist')) {
+    my $noble = 'xcat-genesis-base-amd64_2.19.0-snap202609121200~noble_all.deb';
+    ok(XCAT::BuildUtils::deb_belongs_to_dist($noble, 'noble'),
+        'the noble image is published into noble');
+    ok(!XCAT::BuildUtils::deb_belongs_to_dist($noble, 'jammy'),
+        'the noble image is not published into jammy');
+    # Everything else in xcat-core is the same file for every release.
+    ok(XCAT::BuildUtils::deb_belongs_to_dist('perl-xcat_2.19.0-snap1_all.deb', 'jammy'),
+        'a deb with no codename in its version reaches every suite');
+    ok(XCAT::BuildUtils::deb_belongs_to_dist('xcat_2.19.0-snap1_amd64.deb', 'resolute'),
+        'an architecture deb reaches every suite');
+}
+
 # --- the log guard ---------------------------------------------------------------------
 #
 # dracut prints FAILED: for a command it cannot install and exits 0. This is the log of the