diff --git a/Dockerfile b/Dockerfile
index 3f31d3c5eccd..f31a6ba1adfe 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,6 +17,7 @@ ARG AZURITE_VERSION=3.18.0
 
 ARG GO_VERSION=1.19
 ARG ALPINE_VERSION=3.17
+ARG XX_VERSION=1.3.0
 
 # minio for s3 integration tests
 FROM minio/minio:${MINIO_VERSION} AS minio
@@ -33,7 +34,7 @@ FROM alpine:edge@sha256:c223f84e05c23c0571ce8decefef818864869187e1a3ea47719412e2
 FROM alpine-$TARGETARCH AS alpinebase
 
 # xx is a helper for cross-compilation
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.2.1 AS xx
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
 # go base image
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest
diff --git a/hack/images b/hack/images
index d1315e6a17ef..5f536557f048 100755
--- a/hack/images
+++ b/hack/images
@@ -7,9 +7,9 @@ PUSH=$3
 . $(dirname $0)/util
 set -eu -o pipefail
 
-: ${RELEASE=false}
-: ${PLATFORMS=}
-: ${TARGET=}
+: "${RELEASE=false}"
+: "${PLATFORMS=}"
+: "${TARGET=}"
 
 versionTag=$(git describe --always --tags --match "v[0-9]*")
 
diff --git a/hack/test b/hack/test
index cf928f70c11f..096753a8f041 100755
--- a/hack/test
+++ b/hack/test
@@ -3,17 +3,18 @@
 . $(dirname $0)/util
 set -eu -o pipefail
 
-: ${GO_VERSION=}
-: ${TEST_INTEGRATION=}
-: ${TEST_GATEWAY=}
-: ${TEST_DOCKERFILE=}
-: ${TEST_DOCKERD=}
-: ${TEST_DOCKERD_BINARY=$(which dockerd)}
-: ${TEST_COVERAGE=}
-: ${TEST_KEEP_CACHE=}
-: ${DOCKERFILE_RELEASES=}
-: ${BUILDKIT_WORKER_RANDOM=}
-: ${BUILDKITD_TAGS=}
+: "${ALPINE_VERSION=}"
+: "${GO_VERSION=}"
+: "${TEST_INTEGRATION=}"
+: "${TEST_GATEWAY=}"
+: "${TEST_DOCKERFILE=}"
+: "${TEST_DOCKERD=}"
+: "${TEST_DOCKERD_BINARY=$(which dockerd)}"
+: "${TEST_COVERAGE=}"
+: "${TEST_KEEP_CACHE=}"
+: "${DOCKERFILE_RELEASES=}"
+: "${BUILDKIT_WORKER_RANDOM=}"
+: "${BUILDKITD_TAGS=}"
 
 if [ "$TEST_DOCKERD" == "1" ]; then
   if [ ! -f "$TEST_DOCKERD_BINARY" ]; then
@@ -62,6 +63,7 @@ if [ "$TEST_COVERAGE" = "1" ]; then
 fi
 
 buildxCmd build $cacheFromFlags \
+  --build-arg ALPINE_VERSION \
   --build-arg GO_VERSION \
   --build-arg "BUILDKITD_TAGS=$BUILDKITD_TAGS" \
   --target "integration-tests" \