diff --git a/dockerfiles/cd/builders/tiflash/Dockerfile b/dockerfiles/cd/builders/tiflash/Dockerfile
index 149ac1a1..8b2207ef 100644
--- a/dockerfiles/cd/builders/tiflash/Dockerfile
+++ b/dockerfiles/cd/builders/tiflash/Dockerfile
@@ -5,88 +5,47 @@
 #   - git clone --recurse-submodules https://github.com/pingcap/tiflash.git tiflash
 #   - docker build -t tiflash -f Dockerfile ./tiflash
 
-########### stage: extract-conda-openssl
-FROM quay.io/rockylinux/rockylinux:8.10.20240528-ubi as extract-conda-openssl
-RUN dnf install -y unzip wget zstd
-# install openssl with conda pre-build package.
-# index: in https://prefix.dev/channels/conda-forge/packages/openssl
-RUN zip_url=$([ "$(arch)" = "x86_64" ] && \
-        echo "https://conda.anaconda.org/conda-forge/linux-64/openssl-1.1.1w-hd590300_0.conda" || \
-        echo "https://conda.anaconda.org/conda-forge/linux-aarch64/openssl-1.1.1w-h31becfc_0.conda"\
-    ); \
-    pkg_file=$(basename "$zip_url" .conda); \
-    mkdir /output; \
-    wget ${zip_url} -O /output/openssl.conda && unzip -d /output /output/openssl.conda && \
-    mkdir -p /usr/local/opt/openssl && \
-    tar -C /usr/local/opt/openssl -I zstd -xvf /output/pkg-${pkg_file}.tar.zst
-
 ########### stage: builder
 FROM quay.io/rockylinux/rockylinux:8.10.20240528-ubi as builder
 LABEL org.opencontainers.image.authors "wuhui.zuo@pingcap.com"
 LABEL org.opencontainers.image.description "binary builder for TiFlash"
 LABEL org.opencontainers.image.source "https://github.com/PingCAP-QE/artifacts"
 
-# install packages.
-RUN --mount=type=cache,target=/var/cache/dnf \
-    dnf upgrade-minimal -y && \
-    dnf --enablerepo=powertools install -y git llvm-toolset cmake ninja-build python3.12 libcurl-devel
-ENV CC clang
-ENV CXX clang++
-ENV LD ld.lld
-
-# install openssl
-COPY --from=extract-conda-openssl /usr/local/opt/openssl /usr/local/opt/openssl
 
-# building and install libc++
-RUN git clone https://github.com/llvm/llvm-project.git  --branch llvmorg-17.0.6 --depth 1 /tmp/llvm-project && \
-    cd /tmp/llvm-project && rm -rf build && mkdir build && \
-    cmake -G Ninja -S runtimes -B build -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi;libunwind" -DCMAKE_INSTALL_PREFIX=/usr -DLLVM_LIBDIR_SUFFIX=64 && \
-    ninja -C build cxx cxxabi unwind && \
-    ninja -C build install-cxx install-cxxabi install-unwind && \
-    rm -rf /tmp/llvm-project
+# FIXME: replace with official repo and tag.
+# renovate: datasource=github-tags depName=pingcap/tiflash
+ARG TIFLASH_REPO=pingcap/tiflash
+ARG TIFLASH_REF=master
+RUN FILE="bake_llvm_base.sh"; \
+    TAR_DIR="tiflash-${TIFLASH_REF}"; \
+    curl -sSL https://github.com/${TIFLASH_REPO}/archive/refs/heads/${TIFLASH_REF}.tar.gz -o tiflash.tar.gz && \
+    tar -zxf tiflash.tar.gz "$TAR_DIR/release-linux-llvm/dockerfiles/misc" && \
+    pushd "$TAR_DIR/release-linux-llvm/dockerfiles/misc" && \
+    chmod +x * && ./${FILE} && \
+    popd && \
+    rm -rf tiflash.tar.gz "$TAR_DIR"
+
+ENV TZ Asia/Shanghai
+RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+
+ENV PATH="/opt/cmake/bin:/usr/local/bin/:${PATH}:/usr/local/go/bin:/root/.cargo/bin" \
+    LIBRARY_PATH="/usr/local/lib/$(uname -m)-unknown-linux-gnu/:${LIBRARY_PATH}" \
+    LD_LIBRARY_PATH="/usr/local/lib/$(uname -m)-unknown-linux-gnu/:${LD_LIBRARY_PATH}" \
+    CPLUS_INCLUDE_PATH="/usr/local/include/$(uname -m)-unknown-linux-gnu/c++/v1/:${CPLUS_INCLUDE_PATH}" \
+    OPENSSL_ROOT_DIR="/usr/local/opt/openssl" \
+    CC=clang \
+    CXX=clang++ \
+    LD=ld.lld
 
-# building and reinstall llvm toolsets.
-RUN git clone https://github.com/llvm/llvm-project.git  --branch llvmorg-17.0.6 --depth 1 /tmp/llvm-project && \
-    cd /tmp/llvm-project && rm -rf build && mkdir build && \
-    cd build && \
-    cmake -DCMAKE_BUILD_TYPE=Release \
-        -GNinja \
-        -DCMAKE_INSTALL_PREFIX=/usr -DLLVM_LIBDIR_SUFFIX=64 \
-        -DLLVM_ENABLE_PROJECTS="clang;lld" \
-        -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
-        -DLLVM_TARGETS_TO_BUILD=Native \
-        ../llvm && \
-    ninja && ninja install && \
-    \
-    cd .. && rm -rf build && mkdir -p build && cd build && \
-    cmake -DCMAKE_BUILD_TYPE=Release \
-        -GNinja \
-        -DCMAKE_INSTALL_PREFIX=/usr -DLLVM_LIBDIR_SUFFIX=64 \
-        -DLLVM_ENABLE_PROJECTS="clang;lld;polly;clang-tools-extra;bolt" \
-        -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi;openmp;compiler-rt" \
-        -DLLVM_TARGETS_TO_BUILD=Native \
-        -DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON \
-        -DCLANG_DEFAULT_LINKER=lld \
-        -DCLANG_DEFAULT_CXX_STDLIB=libc++ \
-        -DCMAKE_CXX_COMPILER=clang++ \
-        -DCMAKE_C_COMPILER=clang \
-        -DLLVM_ENABLE_LIBCXX=ON \
-        -DLLVM_ENABLE_LLD=ON \
-        -DLIBOMP_LIBFLAGS="-lm" \
-        ../llvm && \
-    ninja && ninja install && cd ../.. && rm -rf /tmp/llvm-project
-
-# install rust toolchain
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s - -y --default-toolchain none
-ENV PATH /root/.cargo/bin/:$PATH
 
 ########### stage: building
 FROM builder as building
 
 ADD . /ws
 RUN CARGO_NET_GIT_FETCH_WITH_CLI=true /ws/release-linux-llvm/scripts/build-release.sh
-RUN mkdir output && mv /ws/release-linux-llvm/tiflash output/tiflash
-RUN output/tiflash/tiflash version
+RUN mkdir /ws/output && mv /ws/release-linux-llvm/tiflash /ws/output/tiflash
+RUN /ws/output/tiflash/tiflash version
+
 
 ########### stage: Final image
 FROM ghcr.io/pingcap-qe/bases/tiflash-base:v1.9.2
diff --git a/dockerfiles/cd/builders/tiflash/centos7/Dockerfile b/dockerfiles/cd/builders/tiflash/centos7/Dockerfile
index 666a9121..45c52d0f 100644
--- a/dockerfiles/cd/builders/tiflash/centos7/Dockerfile
+++ b/dockerfiles/cd/builders/tiflash/centos7/Dockerfile
@@ -2,10 +2,10 @@
 #   - docker >= v20.10
 #
 # build steps:
-#   - git clone --recurse-submodules https://github.com/tikv/tikv.git tikv
-#   - docker build -t tikv -f Dockerfile ./tikv
+#   - git clone --recurse-submodules https://github.com/pingcap/tiflash.git tiflash
+#   - docker build -t tiflash -f Dockerfile ./tiflash
 
-########### stage: Builder
+########### stage: builder
 FROM centos:7.9.2009 as builder
 # CentOS 7 has reached EOL
 RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
@@ -13,8 +13,8 @@ RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
     && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
 
 LABEL org.opencontainers.image.authors "wuhui.zuo@pingcap.com"
-LABEL org.opencontainers.image.description "binary builder for tiflash"
-LABEL org.opencontainers.image.source = "https://github.com/PingCAP-QE/artifacts"
+LABEL org.opencontainers.image.description "binary builder for TiFlash"
+LABEL org.opencontainers.image.source "https://github.com/PingCAP-QE/artifacts"
 
 ARG TIFLASH_VER=v8.3.0
 RUN FILE=$([ "$(arch)" = "aarch64" ] && echo "bake_llvm_base_aarch64.sh" || echo "bake_llvm_base_amd64.sh"); \
@@ -31,19 +31,19 @@ ENV CC=clang
 ENV CXX=clang++
 ENV LD=ld.lld
 
-########### stage: Buiding
+########### stage: building
 FROM builder as building
 
-ADD . /tiflash
-RUN /tiflash/release-centos7-llvm/scripts/build-release.sh
-RUN mkdir output && mv release-centos7-llvm/tiflash output/tiflash
-RUN output/tiflash/tiflash version
+ADD . /ws
+RUN CARGO_NET_GIT_FETCH_WITH_CLI=true /ws/release-centos7-llvm/scripts/build-release.sh
+RUN mkdir /ws/output && mv /ws/release-centos7-llvm/tiflash /ws/output/tiflash
+RUN /ws/output/tiflash/tiflash version
 
 ########### stage: Final image
 FROM ghcr.io/pingcap-qe/bases/tiflash-base:v1.9.2
 
 ENV LD_LIBRARY_PATH /tiflash
-COPY --from=building /tiflash/output/tiflash /tiflash
+COPY --from=building /ws/output/tiflash /tiflash
 
 ENTRYPOINT ["/tiflash/tiflash", "server"]