diff --git a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile
index 82dc2d5cff2..db0908faf59 100644
--- a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile
+++ b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile
@@ -1,16 +1,20 @@
-FROM ghcr.io/cross-rs/aarch64-unknown-linux-gnu:0.2.4@sha256:3356619b020614effd22e83cec41236e69f17ce581ffe35e252898b0c693b4e2
+# cross-rs hasn't cut a release after 0.2.5 (which is Ubuntu 16.04 / xenial,
+# whose default clang is too old for bindgen >= 0.72 used by zstd-sys >= 2.0.16).
+# The `main` tag tracks Ubuntu 20.04 (focal) and ships libclang-10, which
+# satisfies bindgen's libclang >= 9.0 requirement. Pinned by digest for
+# reproducibility.
+FROM ghcr.io/cross-rs/aarch64-unknown-linux-gnu:main@sha256:c51ec2691be5935bd08d3143994ef1b57eaf970b6ce2b723f6dea4459791bfc0
 
 ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip"
 
-#TODO: 
-# We can switch to static linking (remove `libsasl2-dev:arm64`) using 
-# `rdkafka/gssapi-vendored` feature when there is a release including: 
+#TODO:
+# We can switch to static linking (remove `libsasl2-dev:arm64`) using
+# `rdkafka/gssapi-vendored` feature when there is a release including:
 # https://github.com/MaterializeInc/rust-sasl/pull/48
 
 RUN dpkg --add-architecture arm64 && \
     apt-get update && \
-    apt-get install -y clang-3.9 \
-        libclang-3.9-dev \
+    apt-get install -y --no-install-recommends \
         binutils-aarch64-linux-gnu \
         libsasl2-dev:arm64 \
         unzip && \
diff --git a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile
index 78701740713..0e50e6ed366 100644
--- a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile
+++ b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile
@@ -1,10 +1,14 @@
-FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:0.2.4@sha256:7c9067212c2283be2a1d5585af5ecebd4c4a2e18091e2a6aafd23f9b4b81d496
+# cross-rs hasn't cut a release after 0.2.5 (which is Ubuntu 16.04 / xenial,
+# whose default clang is too old for bindgen >= 0.72 used by zstd-sys >= 2.0.16).
+# The `main` tag tracks Ubuntu 20.04 (focal) and ships libclang-10, which
+# satisfies bindgen's libclang >= 9.0 requirement. Pinned by digest for
+# reproducibility.
+FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main@sha256:2431cbfcf2499f8a00570e864c5f5d3c81363dbdc23c92c9c1f9331484a44365
 
 ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip"
 
 RUN apt-get update && \
-    apt-get install -y clang-3.9 \
-        libclang-3.9-dev \
+    apt-get install -y --no-install-recommends \
         libsasl2-dev \
         unzip && \
     rm -rf /var/lib/apt/lists/*