diff --git a/Makefile b/Makefile
index 75224e310..c5f19ce77 100644
--- a/Makefile
+++ b/Makefile
@@ -103,6 +103,7 @@ images_push:
 	bazel run \
 		--stamp \
 		--platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 \
+		--@io_bazel_rules_go//go/config:pure \
 		//:images.push
 
 ctl:
diff --git a/build/BUILD.bazel b/build/BUILD.bazel
index 596606bfc..2e8626009 100644
--- a/build/BUILD.bazel
+++ b/build/BUILD.bazel
@@ -20,10 +20,12 @@ DOCKERIZED_BINARIES = {
     },
 }
 
-# Allows passing --define image_type=dynamic custom flag to Bazel command. Used
-# to allow optionally build with the dynamic base image. This would only be used
-# by alternative/experimental cert-manager builds that, for example, need to
-# create dynamically linked binaries due to linking to a C library.
+# Allows passing --define image_type custom flag to Bazel command. Used to allow
+# optionally build with the dynamic base image. This would only be used by
+# alternative/experimental cert-manager builds that, for example, need to create
+# dynamically linked binaries due to linking to a C library.
+# Example command to build server images with dynamic base:
+# bazel run --define image_type=dynamic --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //build:server-images.
 config_setting(
     name = "dynamic_image",
     values = {
diff --git a/build/README.md b/build/README.md
index 930182987..cb666bcaa 100644
--- a/build/README.md
+++ b/build/README.md
@@ -3,10 +3,23 @@
 ### How the images are built
 
 `cert-manager` images in `quay.io` are multi-arch images for a number of `linux` architectures.
-The individual container bundles for each architecture are built using `Bazel` functionality in this repository.
-Docker [manifest list](https://docs.docker.com/registry/spec/manifest-v2-2/#manifest-list) is then created by [`cmrel`](https://github.com/cert-manager/release) and the arch-specific container bundles and the manifest list pushed to `quay.io`.
+The individual container bundles for each architecture are built using `Bazel` functionality in cert-manager repository.
+Docker [manifest list](https://docs.docker.com/registry/spec/manifest-v2-2/#manifest-list) is then created using [`cmrel`](https://github.com/cert-manager/release) and the arch-specific container bundles and the manifest list pushed to `quay.io`.
 Therefore the `multi_arch..`-named rules in this repository don't refer to 'multi-arch' in a sense of creating multi-arch images (i.e manifest lists) and the functionality related to pushing images is mostly unused.
+### Base image types
 
+By default, cert-manager binaries are built statically linked, with cgo disabled. Binaries are packaged in a [static distroless base image](https://github.com/GoogleContainerTools/distroless). Unless you're making changes to cert-manager itself, this default is probably exactly what you want.
+
+In some scenarios - such as if you need to link against a different TLS library - you might want to enable cgo and use a dynamic distroless base image.
+Example command to build cert-manager images for linux/amd64 with cgo enabled and dynamic linking:
+
+```bash
+bazel run \
+		--stamp \
+		--platforms=@io_bazel_rules_go//go/toolchain:linux_amd64_cgo \
+		--define image_type=dynamic \
+		//build:server-images
+```
 ### Stamping
 
 Bazel has a concept of stamping which allows embedding additional information into binaries and ensuring that those binaries get rebuilt when the information changes. 
@@ -14,7 +27,5 @@ The additional information has to come from Bazel's stable workspace variables,
 Stamping can be used with rules that have the `stamp` attribute such as `go_image`.
 To enable stamping on a particular rule and build, we set `stamp = True` on the rule and pass `--stamp` to the `bazel build` command.
 
-We use stamping to tag images with a name of a Docker registry and a version and ensure that if a different registry or version is specified, the image will be re-bundled.
-
-Stamping values come from `STABLE_DOCKER_REGISTRY`, `STABLE_DOCKER_TAG` stable workspace variables declared in ./hack/build/print-workspace-status.sh.
+We use stamping to tag images with a name of a Docker registry and a version and ensure that if a different registry or version is specified, the image will be re-bundled.These image stamping values come from `STABLE_DOCKER_REGISTRY`, `STABLE_DOCKER_TAG` stable workspace variables declared in ./hack/build/print-workspace-status.sh.
 This script will be run before every Bazel build as specified in our in .bazelrc file.
diff --git a/build/container.bzl b/build/container.bzl
index 00d923ee8..f823741fb 100644
--- a/build/container.bzl
+++ b/build/container.bzl
@@ -44,6 +44,8 @@ load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
 #   visibility: will be applied only to the container_bundles; the internal
 #     container_image is private
 #   All other args will be applied to the internal container_image.
+# TODO: remove kwargs, instead pass all args explicitly. I think we don't need
+# dynamic params and defining them explicitly would make this more clear.
 def multi_arch_container(
         name,
         architectures,