diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad1bd5074..69e08958e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,8 @@ All notable changes to this project will be documented in this file.
 - opensearch-dashboards: Add `3.4.0` ([#1392]).
 - testing-tools: build testing tools subimages in workflow ([#1366]).
 - kafka: Add `4.1.1` ([#1395]).
+- spark: Add `4.1.1` ([#1402]).
+- spark-connect-client: Add `4.1.1` ([#1402]).
 
 ### Changed
 
@@ -26,6 +28,9 @@ All notable changes to this project will be documented in this file.
 - trino: Backport Kafka offset handling to 477 ([#1373]).
 - ubi: Bumped ubi9 and ubi10 hashes ([#1386]).
 - vector: Bumped from 0.49.0 to 0.52.0 ([#1387]).
+- spark: Use one Dockerfile per major product version ([#1402]).
+  Remove all HBase dependencies from the Spark 4 image.
+  Pull logging dependencies with `mvn` instead of `curl` to remove manual maintenance in Nexus `packages`.
 
 ### Removed
 
@@ -33,6 +38,8 @@ All notable changes to this project will be documented in this file.
 - superset: Remove 4.0.2 and 4.1.2 ([#1394]).
 - kafka: Remove `3.7.2` and `4.1.0` ([#1395]).
 - opa: remove 1.4.2 ([#1396]).
+- spark: Remove `3.5.6` and `4.0.1` ([#1402]).
+- spark-connect-client: Remove `3.5.6` and `4.0.1` ([#1402]).
 
 ### Fixed
 
@@ -60,6 +67,7 @@ All notable changes to this project will be documented in this file.
 [#1394]: https://github.com/stackabletech/docker-images/pull/1394
 [#1395]: https://github.com/stackabletech/docker-images/pull/1395
 [#1396]: https://github.com/stackabletech/docker-images/pull/1396
+[#1402]: https://github.com/stackabletech/docker-images/pull/1402
 
 ## [25.11.0] - 2025-11-07
 
diff --git a/spark-connect-client/boil-config.toml b/spark-connect-client/boil-config.toml
index c0cfddf69..88d33dfe1 100644
--- a/spark-connect-client/boil-config.toml
+++ b/spark-connect-client/boil-config.toml
@@ -1,10 +1,3 @@
-[versions."3.5.6".local-images]
-spark-k8s = "3.5.6"
-java-base = "17"
-
-[versions."3.5.6".build-arguments]
-python-version = "3.11"
-
 [versions."3.5.7".local-images]
 spark-k8s = "3.5.7"
 java-base = "17"
@@ -12,9 +5,9 @@ java-base = "17"
 [versions."3.5.7".build-arguments]
 python-version = "3.11"
 
-[versions."4.0.1".local-images]
-spark-k8s = "4.0.1"
-java-base = "17"
+[versions."4.1.1".local-images]
+spark-k8s = "4.1.1"
+java-base = "21"
 
-[versions."4.0.1".build-arguments]
-python-version = "3.11"
+[versions."4.1.1".build-arguments]
+python-version = "3.12"
diff --git a/spark-k8s/Dockerfile b/spark-k8s/Dockerfile.3
similarity index 57%
rename from spark-k8s/Dockerfile
rename to spark-k8s/Dockerfile.3
index 562a435eb..bf9be8cb4 100644
--- a/spark-k8s/Dockerfile
+++ b/spark-k8s/Dockerfile.3
@@ -33,106 +33,7 @@ EOF
 
 # hbase-connectors-builder: Build the Spark HBase connector and copy
 # required JARs into /stackable/spark/jars
-FROM local-image/java-devel AS hbase-connectors-builder
-
-ARG PRODUCT_VERSION
-ARG RELEASE_VERSION
-ARG HADOOP_HADOOP_VERSION
-# Reassign the arg to `HADOOP_VERSION` for better readability.
-ENV HADOOP_VERSION=${HADOOP_HADOOP_VERSION}
-ARG HBASE_VERSION
-ARG HBASE_CONNECTOR_VERSION
-ARG STACKABLE_USER_UID
-
-WORKDIR /stackable
-
-# Copy the pom.xml file from the patched Spark source code to read the
-# versions used by Spark. The pom.xml defines child modules which are
-# not required and not copied, therefore mvn must be called with the
-# parameter --non-recursive.
-COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-source-builder \
-    /stackable/src/spark-k8s/patchable-work/worktree/${PRODUCT_VERSION}/pom.xml \
-    spark/
-
-# Patch the hbase-connectors source code
-WORKDIR /stackable
-
-COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/hbase-connectors/stackable/patches/patchable.toml /stackable/src/spark-k8s/hbase-connectors/stackable/patches/patchable.toml
-COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/hbase-connectors/stackable/patches/${HBASE_CONNECTOR_VERSION} /stackable/src/spark-k8s/hbase-connectors/stackable/patches/${HBASE_CONNECTOR_VERSION}
-
-RUN <<EOF
-
-# IMPORTANT: HBase connectors don't support Spark 4 yet, so we skip the build.
-# Watch this PR for updates: https://github.com/apache/hbase-connectors/pull/130
-if [[ "${PRODUCT_VERSION}" == 4* ]]; then
-    # Create this empty directory so that following COPY layers succeed.
-    mkdir -p /stackable/spark/jars
-    # Create a dummy tarball to satisfy the build process for Spark 3.
-    touch hbase-connector-${HBASE_CONNECTOR_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz
-    exit 0
-fi
-
-cd "$(/stackable/patchable --images-repo-root=src checkout spark-k8s/hbase-connectors ${HBASE_CONNECTOR_VERSION})/spark"
-
-NEW_VERSION="${HBASE_CONNECTOR_VERSION}-stackable${RELEASE_VERSION}"
-
-mvn versions:set -DnewVersion=$NEW_VERSION
-
-# Create snapshot of the source code including custom patches
-tar -czf /stackable/hbase-connector-${HBASE_CONNECTOR_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz .
-
-# Building the hbase-connectors with JDK 17 is not yet supported, see
-# https://github.com/apache/hbase-connectors/pull/132.
-# As there are no JDK profiles, access to the non-public elements must
-# be enabled with --add-opens, see https://openjdk.org/jeps/403 and
-# https://openjdk.org/jeps/261#Breaking-encapsulation.
-export JDK_JAVA_OPTIONS="\
-    --add-opens java.base/java.lang=ALL-UNNAMED \
-    --add-opens java.base/java.util=ALL-UNNAMED"
-
-# Get the Scala version used by Spark
-SCALA_VERSION=$(grep "scala.version" /stackable/spark/pom.xml | head -n1 | awk -F '[<>]' '{print $3}')
-
-# Get the Scala binary version used by Spark
-SCALA_BINARY_VERSION=$(grep "scala.binary.version" /stackable/spark/pom.xml | head -n1 | awk -F '[<>]' '{print $3}')
-
-# Build the Spark HBase connector
-# Skip the tests because the MiniHBaseCluster does not get ready for
-# whatever reason:
-#   Caused by: java.lang.RuntimeException: Master not active after 30000ms
-#     at org.apache.hadoop.hbase.util.JVMClusterUtil.waitForEvent(JVMClusterUtil.java:221)
-#     at org.apache.hadoop.hbase.util.JVMClusterUtil.startup(JVMClusterUtil.java:177)
-#     at org.apache.hadoop.hbase.LocalHBaseCluster.startup(LocalHBaseCluster.java:407)
-#     at org.apache.hadoop.hbase.MiniHBaseCluster.init(MiniHBaseCluster.java:250)
-mvn \
-    --batch-mode \
-    --no-transfer-progress \
-    --define spark.version="${PRODUCT_VERSION}" \
-    --define scala.version="${SCALA_VERSION}" \
-    --define scala.binary.version="${SCALA_BINARY_VERSION}" \
-    --define hadoop-three.version="${HADOOP_VERSION}" \
-    --define hbase.version="${HBASE_VERSION}" \
-    --define skipTests \
-    --define maven.test.skip=true \
-    clean package
-
-mkdir -p /stackable/spark/jars
-ln -s "$(pwd)/hbase-spark/target/hbase-spark-${HBASE_CONNECTOR_VERSION}-stackable${RELEASE_VERSION}.jar" /stackable/spark/jars/hbase-spark-${HBASE_CONNECTOR_VERSION}-stackable${RELEASE_VERSION}.jar
-
-cd /stackable/spark/jars
-
-# Download log4j-slf4j-impl-x.x.x.jar containing the StaticLoggerBinder
-# which is required by the connector.
-# Spark contains only log4j-slf4j2-impl-x.x.x.jar but not
-# log4j-slf4j-impl-x.x.x.jar. It is okay to have both JARs in the
-# classpath as long as they have the same version.
-mvn --non-recursive --file /stackable/spark/pom.xml \
-    dependency:copy \
-    -Dartifact=org.apache.logging.log4j:log4j-slf4j-impl:'${log4j.version}' \
-    -DoutputDirectory=./jars
-chmod g=u /stackable/hbase-connector-${HBASE_CONNECTOR_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz .
-EOF
-
+FROM local-image/spark-k8s/hbase-connectors AS hbase-connectors-builder
 
 # spark-builder: Build Spark into /stackable/spark-${PRODUCT_VERSION}/dist,
 # download additional JARs and perform checks
@@ -173,26 +74,11 @@ RUN <<EOF
     MAVEN_BIN="/usr/bin/mvn"
     export MAVEN_OPTS="-Xss64m -Xmx2g -XX:ReservedCodeCacheSize=1g"
 
-    case "${PRODUCT_VERSION}" in
-        4*)
-            # The Spark 4 script has a --connect option which is not available in Spark 3.
-            # This option is required to build Spark Connect.
-            # Also this option breaks the Spark 3 build so we ensure it's only provided here.
-            ./dev/make-distribution.sh \
-            --mvn "${MAVEN_BIN}" \
-            --connect \
-            -Dhadoop.version="${HADOOP_VERSION}-stackable${RELEASE_VERSION}" \
-            -DskipTests \
-            -P'hadoop-3' -Pkubernetes -Phive -Phive-thriftserver
-            ;;
-        *)
-            ./dev/make-distribution.sh \
-            --mvn "${MAVEN_BIN}" \
-            -Dhadoop.version="${HADOOP_VERSION}-stackable${RELEASE_VERSION}" \
-            -DskipTests \
-            -P'hadoop-3' -Pkubernetes -Phive -Phive-thriftserver
-            ;;
-    esac
+    ./dev/make-distribution.sh \
+    --mvn "${MAVEN_BIN}" \
+    -Dhadoop.version="${HADOOP_VERSION}-stackable${RELEASE_VERSION}" \
+    -DskipTests \
+    -P'hadoop-3' -Pkubernetes -Phive -Phive-thriftserver
 
     sed -i "s/${NEW_VERSION}/${ORIGINAL_VERSION}/g" assembly/target/bom.json
 EOF
@@ -206,18 +92,9 @@ RUN <<EOF
     mkdir -p dist/connect
     cd dist/connect
 
-    case "${PRODUCT_VERSION}" in
-        4*)
-            cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/sql/connect/server/target/spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
-            cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/sql/connect/common/target/spark-connect-common_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
-            cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/sql/connect/client/jvm/target/spark-connect-client-jvm_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
-            ;;
-        *)
-            cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/connector/connect/server/target/spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
-            cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/connector/connect/common/target/spark-connect-common_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
-            cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/connector/connect/client/jvm/target/spark-connect-client-jvm_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
-            ;;
-    esac
+    cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/connector/connect/server/target/spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
+    cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/connector/connect/common/target/spark-connect-common_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
+    cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/connector/connect/client/jvm/target/spark-connect-client-jvm_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
 
     # This link is needed by the operator and is kept for backwards compatibility.
     # TODO: remove it at some time in the future.
@@ -272,12 +149,17 @@ WORKDIR /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/ext
 
 RUN <<EOF
 # Download jackson-dataformat-xml, stax2-api, and woodstox-core which are required for logging.
-curl --fail https://repo.stackable.tech/repository/packages/jackson-dataformat-xml/jackson-dataformat-xml-${JACKSON_DATAFORMAT_XML_VERSION}.jar \
-  -o /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/jackson-dataformat-xml-${JACKSON_DATAFORMAT_XML_VERSION}.jar
-curl --fail https://repo.stackable.tech/repository/packages/stax2-api/stax2-api-${STAX2_API_VERSION}.jar \
-  -o /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/stax2-api-${STAX2_API_VERSION}.jar
-curl --fail https://repo.stackable.tech/repository/packages/woodstox-core/woodstox-core-${WOODSTOX_CORE_VERSION}.jar \
-  -o /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/woodstox-core-${WOODSTOX_CORE_VERSION}.jar
+mvn dependency:get -Dartifact=com.fasterxml.jackson.dataformat:jackson-dataformat-xml:${JACKSON_DATAFORMAT_XML_VERSION}
+cp /root/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-xml/${JACKSON_DATAFORMAT_XML_VERSION}/jackson-dataformat-xml-${JACKSON_DATAFORMAT_XML_VERSION}.jar \
+  /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/jackson-dataformat-xml-${JACKSON_DATAFORMAT_XML_VERSION}.jar
+
+mvn dependency:get -Dartifact=mvn dependency:get -Dartifact=org.codehaus.woodstox:stax2-api:${STAX2_API_VERSION}
+cp /root/.m2/repository/org/codehaus/woodstox/stax2-api/${STAX2_API_VERSION}/stax2-api-${STAX2_API_VERSION}.jar \
+  /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/stax2-api-${STAX2_API_VERSION}.jar
+
+mvn dependency:get -Dartifact=mvn dependency:get -Dartifact=com.fasterxml.woodstox:woodstox-core:${WOODSTOX_CORE_VERSION}
+cp /root/.m2/repository/com/fasterxml/woodstox/woodstox-core/${WOODSTOX_CORE_VERSION}/woodstox-core-${WOODSTOX_CORE_VERSION}.jar \
+  /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/woodstox-core-${WOODSTOX_CORE_VERSION}.jar
 
 # Get the correct `tini` binary for our architecture.
 curl --fail "https://repo.stackable.tech/repository/packages/tini/tini-${TINI_VERSION}-${TARGETARCH}" \
diff --git a/spark-k8s/Dockerfile.4 b/spark-k8s/Dockerfile.4
new file mode 100644
index 000000000..be0fa88d8
--- /dev/null
+++ b/spark-k8s/Dockerfile.4
@@ -0,0 +1,243 @@
+# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7
+# check=error=true
+
+# hadoop-builder: Provides Hadoop libraries
+FROM local-image/hadoop/hadoop AS hadoop-builder
+
+# spark-source-builder: Clone the Spark source code and apply patches
+FROM local-image/java-devel AS spark-source-builder
+
+ARG PRODUCT_VERSION
+ARG RELEASE_VERSION
+ARG STACKABLE_USER_UID
+
+WORKDIR /stackable
+
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/stackable/patches/patchable.toml /stackable/src/spark-k8s/stackable/patches/patchable.toml
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/stackable/patches/${PRODUCT_VERSION} /stackable/src/spark-k8s/stackable/patches/${PRODUCT_VERSION}
+
+RUN <<EOF
+cd "$(/stackable/patchable --images-repo-root=src checkout spark-k8s ${PRODUCT_VERSION})"
+
+NEW_VERSION="${PRODUCT_VERSION}-stackable${RELEASE_VERSION}"
+
+mvn versions:set -DnewVersion=$NEW_VERSION
+
+# Create snapshot of the source code including custom patches
+tar -czf /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz .
+chmod g=u /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz
+EOF
+
+# spark-builder: Build Spark into /stackable/spark-${PRODUCT_VERSION}/dist,
+# download additional JARs and perform checks
+FROM local-image/java-devel AS spark-builder
+
+ARG PRODUCT_VERSION
+ARG HADOOP_HADOOP_VERSION
+# Reassign the arg to `HADOOP_VERSION` for better readability.
+ENV HADOOP_VERSION=${HADOOP_HADOOP_VERSION}
+ARG AWS_JAVA_SDK_BUNDLE_VERSION
+ARG AZURE_STORAGE_VERSION
+ARG AZURE_KEYVAULT_CORE_VERSION
+ARG JACKSON_DATAFORMAT_XML_VERSION
+ARG STAX2_API_VERSION
+ARG WOODSTOX_CORE_VERSION
+ARG JMX_EXPORTER_VERSION
+ARG TARGETARCH
+ARG TINI_VERSION
+ARG RELEASE_VERSION
+ARG STACKABLE_USER_UID
+
+WORKDIR /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}
+
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-source-builder \
+    /stackable/src/spark-k8s/patchable-work/worktree/${PRODUCT_VERSION} \
+    ./
+COPY --from=hadoop-builder --chown=${STACKABLE_USER_UID}:0 /stackable/patched-libs /stackable/patched-libs
+
+# >>> Build spark
+RUN <<EOF
+    # Make Maven aware of custom Stackable libraries
+    mv /stackable/patched-libs/maven /root/.m2/repository
+
+    ORIGINAL_VERSION="${PRODUCT_VERSION}"
+    NEW_VERSION="${PRODUCT_VERSION}-stackable${RELEASE_VERSION}"
+
+    MAVEN_BIN="/usr/bin/mvn"
+    export MAVEN_OPTS="-Xss64m -Xmx2g -XX:ReservedCodeCacheSize=1g"
+
+    # The Spark 4 script has a --connect option which is not available in Spark 3.
+    # This option is required to build Spark Connect.
+    # Also this option breaks the Spark 3 build so we ensure it's only provided here.
+    ./dev/make-distribution.sh \
+    --mvn "${MAVEN_BIN}" \
+    --connect \
+    -Dhadoop.version="${HADOOP_VERSION}-stackable${RELEASE_VERSION}" \
+    -DskipTests \
+    -P'hadoop-3' -Pkubernetes -Phive -Phive-thriftserver
+
+    sed -i "s/${NEW_VERSION}/${ORIGINAL_VERSION}/g" assembly/target/bom.json
+EOF
+
+# To avoid classpath conflicts with existing spark applications,
+# we create a new dist/connect folder, and copy spark connect jars here.
+RUN <<EOF
+
+    SCALA_BINARY_VERSION=$(grep "scala.binary.version" pom.xml | head -n1 | awk -F '[<>]' '{print $3}')
+
+    mkdir -p dist/connect
+    cd dist/connect
+
+    cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/sql/connect/server/target/spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
+    cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/sql/connect/common/target/spark-connect-common_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
+    cp "/stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/sql/connect/client/jvm/target/spark-connect-client-jvm_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" .
+
+    # This link is needed by the operator and is kept for backwards compatibility.
+    # TODO: remove it at some time in the future.
+    ln -s "spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" "spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}.jar"
+    # Link to the spark-connect jar without the stackable suffix and scala version.
+    # This link supersedes the previous link.
+    ln -s "spark-connect_${SCALA_BINARY_VERSION}-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.jar" "spark-connect-${PRODUCT_VERSION}.jar"
+EOF
+
+# <<< Build spark
+
+WORKDIR /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/jars
+
+# Copy modules required for s3a://
+COPY --from=hadoop-builder --chown=${STACKABLE_USER_UID}:0 \
+    /stackable/hadoop/share/hadoop/tools/lib/hadoop-aws-${HADOOP_VERSION}-stackable${RELEASE_VERSION}.jar \
+    /stackable/hadoop/share/hadoop/tools/lib/bundle-${AWS_JAVA_SDK_BUNDLE_VERSION}.jar \
+    ./
+
+# Copy modules required for abfs://
+COPY --from=hadoop-builder --chown=${STACKABLE_USER_UID}:0 \
+    /stackable/hadoop/share/hadoop/tools/lib/hadoop-azure-${HADOOP_VERSION}-stackable${RELEASE_VERSION}.jar \
+    /stackable/hadoop/share/hadoop/tools/lib/azure-storage-${AZURE_STORAGE_VERSION}.jar \
+    /stackable/hadoop/share/hadoop/tools/lib/azure-keyvault-core-${AZURE_KEYVAULT_CORE_VERSION}.jar \
+    ./
+
+COPY spark-k8s/stackable/jmx /stackable/jmx
+
+WORKDIR /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars
+
+RUN <<EOF
+# Download jackson-dataformat-xml, stax2-api, and woodstox-core which are required for logging.
+mvn dependency:get -Dartifact=com.fasterxml.jackson.dataformat:jackson-dataformat-xml:${JACKSON_DATAFORMAT_XML_VERSION}
+cp /root/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-xml/${JACKSON_DATAFORMAT_XML_VERSION}/jackson-dataformat-xml-${JACKSON_DATAFORMAT_XML_VERSION}.jar \
+  /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/jackson-dataformat-xml-${JACKSON_DATAFORMAT_XML_VERSION}.jar
+
+mvn dependency:get -Dartifact=mvn dependency:get -Dartifact=org.codehaus.woodstox:stax2-api:${STAX2_API_VERSION}
+cp /root/.m2/repository/org/codehaus/woodstox/stax2-api/${STAX2_API_VERSION}/stax2-api-${STAX2_API_VERSION}.jar \
+  /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/stax2-api-${STAX2_API_VERSION}.jar
+
+mvn dependency:get -Dartifact=mvn dependency:get -Dartifact=com.fasterxml.woodstox:woodstox-core:${WOODSTOX_CORE_VERSION}
+cp /root/.m2/repository/com/fasterxml/woodstox/woodstox-core/${WOODSTOX_CORE_VERSION}/woodstox-core-${WOODSTOX_CORE_VERSION}.jar \
+  /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist/extra-jars/woodstox-core-${WOODSTOX_CORE_VERSION}.jar
+
+# Get the correct `tini` binary for our architecture.
+curl --fail "https://repo.stackable.tech/repository/packages/tini/tini-${TINI_VERSION}-${TARGETARCH}" \
+  -o /usr/bin/tini
+chmod +x /usr/bin/tini
+
+# JMX Exporter
+curl --fail "https://repo.stackable.tech/repository/packages/jmx-exporter/jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION}.jar" \
+  -o "/stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION}.jar"
+ln -s "/stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION}.jar" /stackable/jmx/jmx_prometheus_javaagent.jar
+
+chmod -R g=u /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist
+chmod -R g=u /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/assembly/target/bom.json
+chmod -R g=u /stackable/jmx
+EOF
+
+# TODO: java-base installs the Adoptium dnf repo and the Termurin jre which is not needed here.
+# To reduce the size of this image, the Adoptium repo could be moved to stackable-base instead.
+FROM local-image/java-base AS final
+
+ARG PRODUCT_VERSION
+ARG PYTHON_VERSION
+ARG RELEASE_VERSION
+ARG JMX_EXPORTER_VERSION
+ARG STACKABLE_USER_UID
+
+LABEL name="Apache Spark" \
+    maintainer="info@stackable.tech" \
+    vendor="Stackable GmbH" \
+    version="${PRODUCT_VERSION}" \
+    release="${RELEASE_VERSION}" \
+    summary="The Stackable image for Apache Spark with PySpark support." \
+    description="This image is deployed by the Stackable Operator for Apache Spark on Kubernetes."
+
+
+ENV HOME=/stackable
+ENV SPARK_HOME=/stackable/spark
+# Override the java-base version of JAVA_HOME to point to the jdk.
+ENV JAVA_HOME="/usr/lib/jvm/temurin-${JAVA_VERSION}-jdk"
+ENV PATH=$SPARK_HOME/bin:$JAVA_HOME/bin:$PATH
+ENV PYSPARK_PYTHON=/usr/bin/python
+ENV PYTHONPATH=$SPARK_HOME/python
+
+
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-builder /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/dist /stackable/spark
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-source-builder /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz /stackable
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-builder /stackable/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}/assembly/target/bom.json /stackable/spark/spark-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}.cdx.json
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-builder /stackable/jmx /stackable/jmx
+COPY --from=spark-builder /usr/bin/tini /usr/bin/tini
+
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/stackable/run-spark.sh /stackable/run-spark.sh
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/licenses /licenses
+
+RUN <<EOF
+microdnf update
+
+# procps:
+#    Required for spark startup scripts.
+# temurin-{version}-jdk:
+#    Needed by the Spark UI to display process information using "jps" and "jmap".
+#    Spark-Connect needs "javac" to compile auto-generated classes on the fly.
+microdnf install --nodocs \
+  gzip \
+  hostname \
+  procps \
+  "python${PYTHON_VERSION}" \
+  "python${PYTHON_VERSION}-pip" \
+  zip \
+  "temurin-${JAVA_VERSION}-jdk"
+microdnf clean all
+rm -rf /var/cache/yum
+
+ln -s /usr/bin/python${PYTHON_VERSION} /usr/bin/python
+ln -s /usr/bin/pip-${PYTHON_VERSION} /usr/bin/pip
+
+# Symlink example jar, so that we can easily use it in tests
+ln -s /stackable/spark/examples/jars/spark-examples_*.jar /stackable/spark/examples/jars/spark-examples.jar
+chown -h ${STACKABLE_USER_UID}:0 /stackable/spark/examples/jars/spark-examples.jar
+
+# fix permissions
+chmod g=u /stackable/spark
+chmod g=u /stackable/jmx
+chmod g=u /stackable/run-spark.sh
+chmod g=u /stackable/*-src.tar.gz
+EOF
+
+# ----------------------------------------
+# Checks
+# This section is to run final checks to ensure the created final images
+# adhere to several minimal requirements like:
+# - check file permissions and ownerships
+# ----------------------------------------
+
+# Check that permissions and ownership in /stackable are set correctly
+# This will fail and stop the build if any mismatches are found.
+RUN <<EOF
+/bin/check-permissions-ownership.sh /stackable ${STACKABLE_USER_UID} 0
+EOF
+
+# ----------------------------------------
+# Attention: Do not perform any file based actions (copying/creating etc.) below this comment because the permissions would not be checked.
+# ----------------------------------------
+
+USER ${STACKABLE_USER_UID}
+
+WORKDIR ${SPARK_HOME}
+ENTRYPOINT [ "/stackable/run-spark.sh" ]
diff --git a/spark-k8s/boil-config.toml b/spark-k8s/boil-config.toml
index 5d082b569..9545f617e 100644
--- a/spark-k8s/boil-config.toml
+++ b/spark-k8s/boil-config.toml
@@ -1,26 +1,12 @@
-[versions."3.5.6".local-images]
-"hadoop/hadoop" = "3.4.2"
-java-base = "17"
-java-devel = "17"
-hbase = "2.6.3"
-
-[versions."3.5.6".build-arguments]
-python-version = "3.11"
-aws-java-sdk-bundle-version = "2.29.52"   # needs to match the version shipped by Hadoop
-azure-storage-version = "7.0.1"           # needs to match the version shipped by Hadoop
-azure-keyvault-core-version = "1.0.0"     # needs to match the version shipped by Hadoop
-jackson-dataformat-xml-version = "2.15.2" # needs to match the version shipped by Spark https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.12/3.5.6
-stax2-api-version = "4.2.1"               # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2
-woodstox-core-version = "6.5.1"           # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2
-jmx-exporter-version = "1.3.0"
-tini-version = "0.19.0"
-hbase-connector-version = "1.0.1"
+[versions."3.5.7"]
+containerfile = "Dockerfile.3"
 
 [versions."3.5.7".local-images]
 "hadoop/hadoop" = "3.4.2"
 java-base = "17"
 java-devel = "17"
 hbase = "2.6.3"
+"spark-k8s/hbase-connectors" = "1.0.1_3"
 
 [versions."3.5.7".build-arguments]
 python-version = "3.11"
@@ -32,22 +18,24 @@ stax2-api-version = "4.2.1"               # needs to match the jackson version h
 woodstox-core-version = "6.5.1"           # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2
 jmx-exporter-version = "1.3.0"
 tini-version = "0.19.0"
-hbase-connector-version = "1.0.1"
+hbase-connector-version = "1.0.1_3"
+
+[versions."4.1.1"]
+containerfile = "Dockerfile.4"
 
-[versions."4.0.1".local-images]
+[versions."4.1.1".local-images]
 "hadoop/hadoop" = "3.4.2"
-java-base = "17"
-java-devel = "17"
-hbase = "2.6.3"
+java-base = "21"
+java-devel = "21"
+# hbase = "2.6.3"                         # Not yet available for Spark 4.x https://github.com/apache/hbase-connectors/pull/130
 
-[versions."4.0.1".build-arguments]
-python-version = "3.11"
+[versions."4.1.1".build-arguments]
+python-version = "3.12"
 aws-java-sdk-bundle-version = "2.29.52"   # needs to match the version shipped by Hadoop
 azure-storage-version = "7.0.1"           # needs to match the version shipped by Hadoop
 azure-keyvault-core-version = "1.0.0"     # needs to match the version shipped by Hadoop
-jackson-dataformat-xml-version = "2.18.2" # needs to match the version shipped by Spark https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.13/4.0.1
-stax2-api-version = "4.2.2"               # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.18.2
-woodstox-core-version = "7.0.0"           # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.18.2
+jackson-dataformat-xml-version = "2.20.0" # needs to match the version shipped by Spark https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.13/4.1.1/dependencies
+stax2-api-version = "4.2.2"               # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.20.0/dependencies
+woodstox-core-version = "7.1.1"           # needs to match the jackson version https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.20.0/dependencies
 jmx-exporter-version = "1.3.0"
 tini-version = "0.19.0"
-hbase-connector-version = "1.0.1"         # This is not supported in Spark 4 yet.
diff --git a/spark-k8s/hbase-connectors/Dockerfile b/spark-k8s/hbase-connectors/Dockerfile
new file mode 100644
index 000000000..f32ae2bcf
--- /dev/null
+++ b/spark-k8s/hbase-connectors/Dockerfile
@@ -0,0 +1,119 @@
+# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7
+# check=error=true
+
+# The purpose of this stage is to gather jars and environment variables needed in the final stage.
+# These are collected in the /stackable/spark directory.
+FROM local-image/java-devel AS spark-source-builder
+
+ARG RELEASE_VERSION
+ARG SPARK_VERSION
+ARG STACKABLE_USER_UID
+
+WORKDIR /stackable
+
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/stackable/patches/patchable.toml /stackable/src/spark-k8s/stackable/patches/patchable.toml
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/stackable/patches/${SPARK_VERSION} /stackable/src/spark-k8s/stackable/patches/${SPARK_VERSION}
+
+RUN <<EOF
+cd "$(/stackable/patchable --images-repo-root=src checkout spark-k8s ${SPARK_VERSION})"
+
+# NEW_VERSION="${SPARK_VERSION}-stackable${RELEASE_VERSION}"
+
+# mvn versions:set -DnewVersion=$NEW_VERSION
+
+mkdir -p /stackable/spark/jars
+
+# Download log4j-slf4j-impl-x.x.x.jar containing the StaticLoggerBinder
+# which is required by the connector.
+# Spark contains only log4j-slf4j2-impl-x.x.x.jar but not
+# log4j-slf4j-impl-x.x.x.jar. It is okay to have both JARs in the
+# classpath as long as they have the same version.
+mvn --non-recursive --file pom.xml \
+    dependency:copy \
+    -Dartifact=org.apache.logging.log4j:log4j-slf4j-impl:'${log4j.version}' \
+    -DoutputDirectory=/stackable/spark/jars
+
+
+# Create an environment files with properties needed to build the connector
+# Get the Scala version used by Spark
+SCALA_VERSION=$(grep "scala.version" pom.xml | head -n1 | awk -F '[<>]' '{print $3}')
+
+# Get the Scala binary version used by Spark
+SCALA_BINARY_VERSION=$(grep "scala.binary.version" pom.xml | head -n1 | awk -F '[<>]' '{print $3}')
+
+echo "SCALA_VERSION=${SCALA_VERSION}" > /stackable/spark/env
+echo "SCALA_BINARY_VERSION=${SCALA_BINARY_VERSION}" >> /stackable/spark/env
+echo "SPARK_VERSION=${SPARK_VERSION}" >> /stackable/spark/env
+EOF
+
+# hbase-connectors-builder: Build the Spark HBase connector and copy
+# required JARs into /stackable/spark/jars
+FROM local-image/java-devel AS final
+
+ARG PRODUCT_VERSION
+ARG RELEASE_VERSION
+ARG HADOOP_VERSION
+ARG HBASE_VERSION
+ARG STACKABLE_USER_UID
+
+# Patch the hbase-connectors source code
+WORKDIR /stackable
+
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/hbase-connectors/stackable/patches/patchable.toml /stackable/src/spark-k8s/hbase-connectors/stackable/patches/patchable.toml
+COPY --chown=${STACKABLE_USER_UID}:0 spark-k8s/hbase-connectors/stackable/patches/${PRODUCT_VERSION} /stackable/src/spark-k8s/hbase-connectors/stackable/patches/${PRODUCT_VERSION}
+
+# Copy jars and env from spark-source-builder
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-source-builder \
+    /stackable/spark/jars \
+    spark/jars
+COPY --chown=${STACKABLE_USER_UID}:0 --from=spark-source-builder \
+    /stackable/spark/env \
+    spark/env
+
+RUN <<EOF
+
+cd "$(/stackable/patchable --images-repo-root=src checkout spark-k8s/hbase-connectors ${PRODUCT_VERSION})"/spark
+
+NEW_VERSION="${PRODUCT_VERSION}-stackable${RELEASE_VERSION}"
+
+mvn versions:set -DnewVersion=$NEW_VERSION
+
+# Create snapshot of the source code including custom patches
+tar -czf /stackable/hbase-connector-${NEW_VERSION}-src.tar.gz .
+
+# Building the hbase-connectors with JDK 17 is not yet supported, see
+# https://github.com/apache/hbase-connectors/pull/132.
+# As there are no JDK profiles, access to the non-public elements must
+# be enabled with --add-opens, see https://openjdk.org/jeps/403 and
+# https://openjdk.org/jeps/261#Breaking-encapsulation.
+export JDK_JAVA_OPTIONS="\
+    --add-opens java.base/java.lang=ALL-UNNAMED \
+    --add-opens java.base/java.util=ALL-UNNAMED"
+
+source /stackable/spark/env
+
+# Build the Spark HBase connector
+# Skip the tests because the MiniHBaseCluster does not get ready for
+# whatever reason:
+#   Caused by: java.lang.RuntimeException: Master not active after 30000ms
+#     at org.apache.hadoop.hbase.util.JVMClusterUtil.waitForEvent(JVMClusterUtil.java:221)
+#     at org.apache.hadoop.hbase.util.JVMClusterUtil.startup(JVMClusterUtil.java:177)
+#     at org.apache.hadoop.hbase.LocalHBaseCluster.startup(LocalHBaseCluster.java:407)
+#     at org.apache.hadoop.hbase.MiniHBaseCluster.init(MiniHBaseCluster.java:250)
+mvn \
+    --batch-mode \
+    --no-transfer-progress \
+    --define spark.version="${SPARK_VERSION}" \
+    --define scala.version="${SCALA_VERSION}" \
+    --define scala.binary.version="${SCALA_BINARY_VERSION}" \
+    --define hadoop-three.version="${HADOOP_VERSION}" \
+    --define hbase.version="${HBASE_VERSION}" \
+    --define skipTests \
+    --define maven.test.skip=true \
+    clean package
+
+
+cp "$(pwd)/hbase-spark/target/hbase-spark-${NEW_VERSION}.jar" /stackable/spark/jars/hbase-spark-${NEW_VERSION}.jar
+
+chmod g=u /stackable/hbase-connector-${NEW_VERSION}-src.tar.gz .
+EOF
diff --git a/spark-k8s/hbase-connectors/boil-config.toml b/spark-k8s/hbase-connectors/boil-config.toml
new file mode 100644
index 000000000..beb9e4493
--- /dev/null
+++ b/spark-k8s/hbase-connectors/boil-config.toml
@@ -0,0 +1,10 @@
+[versions."1.0.1_3"]
+containerfile = "Dockerfile"
+
+[versions."1.0.1_3".local-images]
+java-devel = "17"
+
+[versions."1.0.1_3".build-arguments]
+spark-version = "3.5.7"
+hadoop-version = "3.4.2"
+hbase-version = "2.6.3"
diff --git a/spark-k8s/hbase-connectors/stackable/patches/1.0.1/0001-Fix-protobuf-on-aarch64.patch b/spark-k8s/hbase-connectors/stackable/patches/1.0.1_3/0001-Fix-protobuf-on-aarch64.patch
similarity index 100%
rename from spark-k8s/hbase-connectors/stackable/patches/1.0.1/0001-Fix-protobuf-on-aarch64.patch
rename to spark-k8s/hbase-connectors/stackable/patches/1.0.1_3/0001-Fix-protobuf-on-aarch64.patch
diff --git a/spark-k8s/hbase-connectors/stackable/patches/1.0.1/patchable.toml b/spark-k8s/hbase-connectors/stackable/patches/1.0.1_3/patchable.toml
similarity index 100%
rename from spark-k8s/hbase-connectors/stackable/patches/1.0.1/patchable.toml
rename to spark-k8s/hbase-connectors/stackable/patches/1.0.1_3/patchable.toml
diff --git a/spark-k8s/stackable/patches/3.5.6/0001-Update-CycloneDX-plugin.patch b/spark-k8s/stackable/patches/3.5.6/0001-Update-CycloneDX-plugin.patch
deleted file mode 100644
index 9ad9eea3c..000000000
--- a/spark-k8s/stackable/patches/3.5.6/0001-Update-CycloneDX-plugin.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 94ccf32b4d0eb7c3191b4e5a646605e7386c39ff Mon Sep 17 00:00:00 2001
-From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
-Date: Tue, 11 Mar 2025 17:29:39 +0200
-Subject: Update CycloneDX plugin
-
----
- dev/make-distribution.sh | 1 -
- pom.xml                  | 7 ++++++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/dev/make-distribution.sh b/dev/make-distribution.sh
-index ef7c010e93..0f4c1c74e4 100755
---- a/dev/make-distribution.sh
-+++ b/dev/make-distribution.sh
-@@ -171,7 +171,6 @@ BUILD_COMMAND=("$MVN" clean package \
-     -Dmaven.javadoc.skip=true \
-     -Dmaven.scaladoc.skip=true \
-     -Dmaven.source.skip \
--    -Dcyclonedx.skip=true \
-     $@)
- 
- # Actually build the jar
-diff --git a/pom.xml b/pom.xml
-index 68e2c422a2..6216ebb08e 100644
---- a/pom.xml
-+++ b/pom.xml
-@@ -3534,7 +3534,12 @@
-       <plugin>
-         <groupId>org.cyclonedx</groupId>
-         <artifactId>cyclonedx-maven-plugin</artifactId>
--        <version>2.7.9</version>
-+        <version>2.8.0</version>
-+        <configuration>
-+          <projectType>application</projectType>
-+          <schemaVersion>1.5</schemaVersion>
-+          <skipNotDeployed>false</skipNotDeployed>
-+        </configuration>
-         <executions>
-           <execution>
-             <phase>package</phase>
diff --git a/spark-k8s/stackable/patches/3.5.6/0002-Backport-SPARK-51311-BUILD-Promote-bcprov-jdk18on-to.patch b/spark-k8s/stackable/patches/3.5.6/0002-Backport-SPARK-51311-BUILD-Promote-bcprov-jdk18on-to.patch
deleted file mode 100644
index 1a7029a6f..000000000
--- a/spark-k8s/stackable/patches/3.5.6/0002-Backport-SPARK-51311-BUILD-Promote-bcprov-jdk18on-to.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 37d866706d952702effd640babf891fef349da7d Mon Sep 17 00:00:00 2001
-From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
-Date: Tue, 22 Jul 2025 17:34:03 +0200
-Subject: Backport [SPARK-51311][BUILD] Promote bcprov-jdk18on to compile scope
-
----
- LICENSE-binary                           |  1 +
- assembly/pom.xml                         | 14 ++++++++++++++
- dev/deps/spark-deps-hadoop-3-hive-2.3    |  1 +
- licenses-binary/LICENSE-bouncycastle.txt | 13 +++++++++++++
- 4 files changed, 29 insertions(+)
- create mode 100644 licenses-binary/LICENSE-bouncycastle.txt
-
-diff --git a/LICENSE-binary b/LICENSE-binary
-index 05645977a0..9834cf333f 100644
---- a/LICENSE-binary
-+++ b/LICENSE-binary
-@@ -480,6 +480,7 @@ org.typelevel:algebra_2.12:jar
- org.typelevel:cats-kernel_2.12
- org.typelevel:machinist_2.12
- net.razorvine:pickle
-+org.bouncycastle:bcprov-jdk18on
- org.slf4j:jcl-over-slf4j
- org.slf4j:jul-to-slf4j
- org.slf4j:slf4j-api
-diff --git a/assembly/pom.xml b/assembly/pom.xml
-index dcc46b0b82..def40ad52e 100644
---- a/assembly/pom.xml
-+++ b/assembly/pom.xml
-@@ -85,8 +85,22 @@
-       <artifactId>guava</artifactId>
-       <scope>${hadoop.deps.scope}</scope>
-     </dependency>
-+
-+    <!--
-+      Adapted from https://github.com/apache/spark/pull/50077
-+
-+      SPARK-51311: HDFS-15098 (3.4.0) adds hard dependency on bcprov-jdk18on, Spark fails to submit
-+      to Kerberized cluster without this dependency, until HADOOP-19152 (3.5.0, unreleased)
-+      -->
-+    <dependency>
-+      <groupId>org.bouncycastle</groupId>
-+      <artifactId>bcprov-jdk18on</artifactId>
-+      <scope>${hadoop.deps.scope}</scope>
-+    </dependency>
-+
-   </dependencies>
- 
-+
-   <build>
-     <plugins>
-       <plugin>
-diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
-index dbf0cb34c5..689f50612b 100644
---- a/dev/deps/spark-deps-hadoop-3-hive-2.3
-+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
-@@ -28,6 +28,7 @@ aws-java-sdk-bundle/1.12.262//aws-java-sdk-bundle-1.12.262.jar
- azure-data-lake-store-sdk/2.3.9//azure-data-lake-store-sdk-2.3.9.jar
- azure-keyvault-core/1.0.0//azure-keyvault-core-1.0.0.jar
- azure-storage/7.0.1//azure-storage-7.0.1.jar
-+bcprov-jdk18on/1.77//bcprov-jdk18on-1.77.jar
- blas/3.0.3//blas-3.0.3.jar
- bonecp/0.8.0.RELEASE//bonecp-0.8.0.RELEASE.jar
- breeze-macros_2.12/2.1.0//breeze-macros_2.12-2.1.0.jar
-diff --git a/licenses-binary/LICENSE-bouncycastle.txt b/licenses-binary/LICENSE-bouncycastle.txt
-new file mode 100644
-index 0000000000..277dcd1ebb
---- /dev/null
-+++ b/licenses-binary/LICENSE-bouncycastle.txt
-@@ -0,0 +1,13 @@
-+Copyright (c) 2000-2024 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org).
-+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
-+associated documentation files (the "Software"), to deal in the Software without restriction,
-+including without limitation the rights to use, copy, modify, merge, publish, distribute,
-+sub license, and/or sell copies of the Software, and to permit persons to whom the Software is
-+furnished to do so, subject to the following conditions: The above copyright notice and this
-+permission notice shall be included in all copies or substantial portions of the Software.
-+
-+**THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
-+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
-+OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.**
diff --git a/spark-k8s/stackable/patches/3.5.6/patchable.toml b/spark-k8s/stackable/patches/3.5.6/patchable.toml
deleted file mode 100644
index 633d26c88..000000000
--- a/spark-k8s/stackable/patches/3.5.6/patchable.toml
+++ /dev/null
@@ -1 +0,0 @@
-base = "303c18c74664f161b9b969ac343784c088b47593"
diff --git a/spark-k8s/stackable/patches/4.0.1/patchable.toml b/spark-k8s/stackable/patches/4.0.1/patchable.toml
deleted file mode 100644
index bd074097c..000000000
--- a/spark-k8s/stackable/patches/4.0.1/patchable.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-base = "29434ea766b0fc3c3bf6eaadb43a8f931133649e"
-mirror = "https://github.com/stackabletech/spark.git"
diff --git a/spark-k8s/stackable/patches/4.0.1/0001-Update-CycloneDX-plugin.patch b/spark-k8s/stackable/patches/4.1.1/0001-Update-CycloneDX-plugin.patch
similarity index 63%
rename from spark-k8s/stackable/patches/4.0.1/0001-Update-CycloneDX-plugin.patch
rename to spark-k8s/stackable/patches/4.1.1/0001-Update-CycloneDX-plugin.patch
index 863f280c6..fc0b0ec9f 100644
--- a/spark-k8s/stackable/patches/4.0.1/0001-Update-CycloneDX-plugin.patch
+++ b/spark-k8s/stackable/patches/4.1.1/0001-Update-CycloneDX-plugin.patch
@@ -1,6 +1,6 @@
-From b5de94e20aff25a394c6095c0649b4fcbaa941aa Mon Sep 17 00:00:00 2001
+From 81b0e112da483402a453c22b672608779eeb8187 Mon Sep 17 00:00:00 2001
 From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
-Date: Fri, 4 Jul 2025 15:54:55 +0200
+Date: Thu, 15 Jan 2026 14:27:23 +0100
 Subject: Update CycloneDX plugin
 
 ---
@@ -9,25 +9,25 @@ Subject: Update CycloneDX plugin
  2 files changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/dev/make-distribution.sh b/dev/make-distribution.sh
-index 16607e45ae6..44e345a245d 100755
+index 16598bda873..327fa763144 100755
 --- a/dev/make-distribution.sh
 +++ b/dev/make-distribution.sh
-@@ -176,7 +176,6 @@ BUILD_COMMAND=("$MVN" clean package \
-     -Dmaven.javadoc.skip=true \
-     -Dmaven.scaladoc.skip=true \
-     -Dmaven.source.skip \
--    -Dcyclonedx.skip=true \
-     $@)
+@@ -185,7 +185,6 @@ else
+       -Dmaven.javadoc.skip=true \
+       -Dmaven.scaladoc.skip=true \
+       -Dmaven.source.skip \
+-      -Dcyclonedx.skip=true \
+       $@)
+ fi
  
- # Actually build the jar
 diff --git a/pom.xml b/pom.xml
-index 22922143fc3..59c3747c625 100644
+index dc757d78812..05f1af034f3 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -3327,6 +3327,11 @@
+@@ -3333,6 +3333,11 @@
          <groupId>org.cyclonedx</groupId>
          <artifactId>cyclonedx-maven-plugin</artifactId>
-         <version>2.8.0</version>
+         <version>2.9.1</version>
 +        <configuration>
 +          <projectType>application</projectType>
 +          <schemaVersion>1.5</schemaVersion>
diff --git a/spark-k8s/stackable/patches/4.1.1/patchable.toml b/spark-k8s/stackable/patches/4.1.1/patchable.toml
new file mode 100644
index 000000000..15b658491
--- /dev/null
+++ b/spark-k8s/stackable/patches/4.1.1/patchable.toml
@@ -0,0 +1 @@
+base = "c0690c763bafabd08e7079d1137fa0a769a05bae"