diff --git a/README.md b/README.md
index 6ba4826..9e6df78 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ in your password manager.
 ## Building kernels in Qubes
 
 Here's how to set up a build environment in [Qubes], suitable for use with [SecureDrop].
-The build requires `docker`, so make sure your TemplateVM has docker configured.
+The build requires `podman` or `docker`, so make sure your TemplateVM has one of those set up.
 
 ```
 qvm-create sd-kernel-builder --template debian-11 --label purple
@@ -42,15 +42,6 @@ qvm-volume resize sd-kernel-builder:private 50G
 
 ```
 
-Then add the following customization to the AppVM to ensure
-the private volume [bind-dir](https://www.qubes-os.org/doc/bind-dirs/)
-is used for the build:
-
-```
-sudo mkdir -p /rw/config/qubes-bind-dirs.d
-echo "binds+=( '/var/lib/docker' )" | sudo tee -a /rw/config/qubes-bind-dirs.d/50_user.conf
-```
-
 And reboot the AppVM. Otherwise, you will need a large system partition.
 Finally, make sure you've got the [grsec env vars](##enabling-grsecurity-patches)
 exported in your environment, or set in e.g. `~/grsec-env`, as below. Now build:
diff --git a/scripts/build-kernel-wrapper b/scripts/build-kernel-wrapper
index 7e63827..b5e2bfa 100755
--- a/scripts/build-kernel-wrapper
+++ b/scripts/build-kernel-wrapper
@@ -14,9 +14,16 @@ export DEB_BUILD_TIMESTAMP="${SOURCE_DATE_EPOCH}"
 export TERM=dumb  # to omit control characters from "script" transcripts
 export BUILD_DISTRO="${BUILD_DISTRO:-bookworm}"
 
+# Container runtime; podman is preferred, docker also works
+CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-$(command -v podman || command -v docker || true)}"
+if [[ -z "$CONTAINER_RUNTIME" ]]; then
+    echo "ERROR: podman or docker is required" >&2
+    exit 1
+fi
+
 # Build container image for kernel dependencies
 IMG_NAME="fpf.local/kernel-builder"
-docker build -t "${IMG_NAME}-${BUILD_DISTRO}" \
+"$CONTAINER_RUNTIME" build -t "${IMG_NAME}-${BUILD_DISTRO}" \
     --build-arg UID="$(id -u)" \
     --build-arg GID="$(id -g)" \
     --build-arg BUILD_DISTRO="$BUILD_DISTRO" \
@@ -25,11 +32,11 @@ docker build -t "${IMG_NAME}-${BUILD_DISTRO}" \
 # Configure local customizations
 local_config_volume_opt=""
 if [[ -n "${LINUX_LOCAL_CONFIG_PATH:-}" ]]; then
-    local_config_volume_opt="-v ${LINUX_LOCAL_CONFIG_PATH}:/config:ro"
+    local_config_volume_opt="-v ${LINUX_LOCAL_CONFIG_PATH}:/config:ro,z"
 fi
 local_patches_volume_opt=""
 if [[ -n "${LINUX_LOCAL_PATCHES_PATH:-}" ]]; then
-    local_patches_volume_opt="-v ${LINUX_LOCAL_PATCHES_PATH}:/patches:ro"
+    local_patches_volume_opt="-v ${LINUX_LOCAL_PATCHES_PATH}:/patches:ro,z"
 fi
 
 # Create output dir
@@ -41,8 +48,13 @@ DOCKER_RUN_ARGUMENTS=""
 if test -t 0; then
     DOCKER_RUN_ARGUMENTS="${DOCKER_RUN_ARGUMENTS} -it"
 fi
+if [[ "$CONTAINER_RUNTIME" == *podman ]]; then
+    # rootless podman maps the invoking user to container root, so without this
+    # the build user can't write to /output
+    DOCKER_RUN_ARGUMENTS="${DOCKER_RUN_ARGUMENTS} --userns=keep-id"
+fi
 
-docker run --rm $DOCKER_RUN_ARGUMENTS \
+"$CONTAINER_RUNTIME" run --rm $DOCKER_RUN_ARGUMENTS \
     -e GRSECURITY_USERNAME \
     -e GRSECURITY_PASSWORD \
     -e GRSECURITY_PATCH_TYPE \