diff --git a/sdks/python/apache_beam/runners/portability/sdk_container_builder.py b/sdks/python/apache_beam/runners/portability/sdk_container_builder.py
index bb5bfd48949d..2dffdf3a42ef 100644
--- a/sdks/python/apache_beam/runners/portability/sdk_container_builder.py
+++ b/sdks/python/apache_beam/runners/portability/sdk_container_builder.py
@@ -244,7 +244,7 @@ def _invoke_docker_build_and_push(self, container_image_name):
     build = cloud_build_types.Build()
     if self._cloud_build_machine_type:
       build.options = cloud_build_types.BuildOptions()
-      build.options.machineType = self._cloud_build_machine_type
+      build.options.machine_type = self._cloud_build_machine_type
     build.steps = []
     step = cloud_build_types.BuildStep()
     step.name = 'quay.io/buildah/stable:latest'
@@ -262,10 +262,10 @@ def _invoke_docker_build_and_push(self, container_image_name):
     build.steps.append(step)
 
     source = cloud_build_types.Source()
-    source.storageSource = cloud_build_types.StorageSource()
+    source.storage_source = cloud_build_types.StorageSource()
     gcs_bucket, gcs_object = self._get_gcs_bucket_and_name(gcs_location)
-    source.storageSource.bucket = os.path.join(gcs_bucket)
-    source.storageSource.object = gcs_object
+    source.storage_source.bucket = os.path.join(gcs_bucket)
+    source.storage_source.object = gcs_object
     build.source = source
     # TODO(zyichi): make timeout configurable
     build.timeout = '7200s'
diff --git a/sdks/python/container/Dockerfile b/sdks/python/container/Dockerfile
index 9aa9f0518dd9..bfba41712c99 100644
--- a/sdks/python/container/Dockerfile
+++ b/sdks/python/container/Dockerfile
@@ -83,12 +83,7 @@ RUN  \
     # Remove pip cache.
     rm -rf /root/.cache/pip && \
 
-    # Update ensurepip to use most recent versions of setuptools and pip. This avoids some vulnerabilities which won't be fixed on older versions of python.
-    pip install upgrade_ensurepip; \
-    python3 -m upgrade_ensurepip; \
-    find /usr/local/lib/python${py_version}/ensurepip/_bundled/setuptools-* -type f ! -name $(basename $(ls -v /usr/local/lib/python${py_version}/ensurepip/_bundled/setuptools-*-py3-none-any.whl | tail -n 1)) -delete; \
-    find /usr/local/lib/python${py_version}/ensurepip/_bundled/pip-* -type f ! -name $(basename $(ls -v /usr/local/lib/python${py_version}/ensurepip/_bundled/pip-*-py3-none-any.whl | tail -n 1)) -delete; \
-    pip uninstall upgrade_ensurepip -y; \
+    # Ensure pip is available. upgrade_ensurepip is skipped - it fails on Python 3.12+ due to ensurepip structure changes.
     python3 -m ensurepip;
 
 ENTRYPOINT ["/opt/apache/beam/boot"]
diff --git a/sdks/python/container/run_validatescontainer.sh b/sdks/python/container/run_validatescontainer.sh
index 875fd1a138c7..9deae1a5d8e3 100755
--- a/sdks/python/container/run_validatescontainer.sh
+++ b/sdks/python/container/run_validatescontainer.sh
@@ -85,9 +85,9 @@ if [[ "$ARCH" == "x86" ]]; then
   # Tag the docker container.
   docker tag "apache/$IMAGE_NAME:$SDK_VERSION" "$CONTAINER:$TAG"
 
-  # Push the container
-  gcloud docker -- push $CONTAINER:$TAG
-elif [[ "$ARCH" == "ARM" ]]; then
+  # Push the container (use docker push - gcloud docker is deprecated)
+  docker push $CONTAINER:$TAG
+  elif [[ "$ARCH" == "ARM" ]]; then
   # Reset the multi-arch Python SDK container image tag.
   TAG=$MULTIARCH_TAG
   MACHINE_TYPE_ARGS="--machine_type=t2a-standard-1"