diff --git a/11/jdk/alpine/Dockerfile b/11/jdk/alpine/Dockerfile
index 71de566c6..104bd8e1c 100644
--- a/11/jdk/alpine/Dockerfile
+++ b/11/jdk/alpine/Dockerfile
@@ -25,11 +25,12 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -56,11 +57,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/11/jdk/centos/Dockerfile b/11/jdk/centos/Dockerfile
index 84e6b2137..ef5d357bc 100644
--- a/11/jdk/centos/Dockerfile
+++ b/11/jdk/centos/Dockerfile
@@ -25,8 +25,21 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar \
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -50,7 +63,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,11 +74,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/11/jdk/ubi/ubi9-minimal/Dockerfile b/11/jdk/ubi/ubi9-minimal/Dockerfile
index 44c244f22..0ad81f47c 100644
--- a/11/jdk/ubi/ubi9-minimal/Dockerfile
+++ b/11/jdk/ubi/ubi9-minimal/Dockerfile
@@ -25,8 +25,9 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -54,7 +55,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -65,11 +66,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/11/jdk/ubuntu/focal/Dockerfile b/11/jdk/ubuntu/focal/Dockerfile
index f686b6b8d..0b413f6f3 100644
--- a/11/jdk/ubuntu/focal/Dockerfile
+++ b/11/jdk/ubuntu/focal/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -57,7 +69,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,11 +86,12 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/11/jdk/ubuntu/jammy/Dockerfile b/11/jdk/ubuntu/jammy/Dockerfile
index 2e6963b63..907e7177e 100644
--- a/11/jdk/ubuntu/jammy/Dockerfile
+++ b/11/jdk/ubuntu/jammy/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -57,7 +69,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,11 +86,12 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/11/jdk/windows/nanoserver-1809/Dockerfile b/11/jdk/windows/nanoserver-1809/Dockerfile
index 06c4f8251..39ff4ee50 100644
--- a/11/jdk/windows/nanoserver-1809/Dockerfile
+++ b/11/jdk/windows/nanoserver-1809/Dockerfile
@@ -33,9 +33,9 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:11.0.21_9-jdk-windowsservercore-1809 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 
 CMD ["jshell"]
diff --git a/11/jdk/windows/nanoserver-ltsc2022/Dockerfile b/11/jdk/windows/nanoserver-ltsc2022/Dockerfile
index a5d681f7f..d96bd01b4 100644
--- a/11/jdk/windows/nanoserver-ltsc2022/Dockerfile
+++ b/11/jdk/windows/nanoserver-ltsc2022/Dockerfile
@@ -33,9 +33,9 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:11.0.21_9-jdk-windowsservercore-ltsc2022 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 
 CMD ["jshell"]
diff --git a/11/jre/alpine/Dockerfile b/11/jre/alpine/Dockerfile
index 5f9b00ae3..3514b88d3 100644
--- a/11/jre/alpine/Dockerfile
+++ b/11/jre/alpine/Dockerfile
@@ -25,11 +25,12 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -56,9 +57,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/11/jre/centos/Dockerfile b/11/jre/centos/Dockerfile
index 7942af501..acd7281ef 100644
--- a/11/jre/centos/Dockerfile
+++ b/11/jre/centos/Dockerfile
@@ -25,8 +25,21 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar \
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -50,7 +63,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,9 +74,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/11/jre/ubi/ubi9-minimal/Dockerfile b/11/jre/ubi/ubi9-minimal/Dockerfile
index 390aafc13..ce128d397 100644
--- a/11/jre/ubi/ubi9-minimal/Dockerfile
+++ b/11/jre/ubi/ubi9-minimal/Dockerfile
@@ -25,8 +25,9 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -54,7 +55,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -65,9 +66,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/11/jre/ubuntu/focal/Dockerfile b/11/jre/ubuntu/focal/Dockerfile
index 4a050c842..81428a69e 100644
--- a/11/jre/ubuntu/focal/Dockerfile
+++ b/11/jre/ubuntu/focal/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -57,7 +69,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,9 +86,9 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/11/jre/ubuntu/jammy/Dockerfile b/11/jre/ubuntu/jammy/Dockerfile
index 306477a93..d3cab7b82 100644
--- a/11/jre/ubuntu/jammy/Dockerfile
+++ b/11/jre/ubuntu/jammy/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-11.0.21+9
 
@@ -57,7 +69,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,9 +86,9 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/11/jre/windows/nanoserver-1809/Dockerfile b/11/jre/windows/nanoserver-1809/Dockerfile
index 889cdb7e8..b36948ed6 100644
--- a/11/jre/windows/nanoserver-1809/Dockerfile
+++ b/11/jre/windows/nanoserver-1809/Dockerfile
@@ -33,6 +33,6 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:11.0.21_9-jre-windowsservercore-1809 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
diff --git a/11/jre/windows/nanoserver-ltsc2022/Dockerfile b/11/jre/windows/nanoserver-ltsc2022/Dockerfile
index fd7a68b53..3e2733b59 100644
--- a/11/jre/windows/nanoserver-ltsc2022/Dockerfile
+++ b/11/jre/windows/nanoserver-ltsc2022/Dockerfile
@@ -33,6 +33,6 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:11.0.21_9-jre-windowsservercore-ltsc2022 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
diff --git a/17/jdk/alpine/Dockerfile b/17/jdk/alpine/Dockerfile
index 7c18920c5..ab320406e 100644
--- a/17/jdk/alpine/Dockerfile
+++ b/17/jdk/alpine/Dockerfile
@@ -25,11 +25,12 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
@@ -56,11 +57,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/17/jdk/centos/Dockerfile b/17/jdk/centos/Dockerfile
index 02ad3c779..18718902b 100644
--- a/17/jdk/centos/Dockerfile
+++ b/17/jdk/centos/Dockerfile
@@ -25,22 +25,38 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar binutils \
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(objdump="$(command -v objdump)" && objdump --file-headers "$objdump" | awk -F '[:,]+[[:space:]]+' '$1 == "architecture" { print $2 }')"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='e2c5e26f8572544b201bc22a9b28f2b1a3147ab69be111cea07c7f52af252e75'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='3ae4b254d5b720f94f986481e787fbd67f0667571140ba2e2ae5020ceddbc826'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -50,7 +66,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,11 +77,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/17/jdk/ubi/ubi9-minimal/Dockerfile b/17/jdk/ubi/ubi9-minimal/Dockerfile
index 6cd332dd7..df8662b44 100644
--- a/17/jdk/ubi/ubi9-minimal/Dockerfile
+++ b/17/jdk/ubi/ubi9-minimal/Dockerfile
@@ -25,22 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(objdump="$(command -v objdump)" && objdump --file-headers "$objdump" | awk -F '[:,]+[[:space:]]+' '$1 == "architecture" { print $2 }')"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='e2c5e26f8572544b201bc22a9b28f2b1a3147ab69be111cea07c7f52af252e75'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='3ae4b254d5b720f94f986481e787fbd67f0667571140ba2e2ae5020ceddbc826'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -54,7 +55,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -65,11 +66,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/17/jdk/ubuntu/focal/Dockerfile b/17/jdk/ubuntu/focal/Dockerfile
index 9cddfb9cf..650c3c614 100644
--- a/17/jdk/ubuntu/focal/Dockerfile
+++ b/17/jdk/ubuntu/focal/Dockerfile
@@ -25,25 +25,40 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit binutils \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='e2c5e26f8572544b201bc22a9b28f2b1a3147ab69be111cea07c7f52af252e75'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='3ae4b254d5b720f94f986481e787fbd67f0667571140ba2e2ae5020ceddbc826'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -57,7 +72,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,11 +89,12 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/17/jdk/ubuntu/jammy/Dockerfile b/17/jdk/ubuntu/jammy/Dockerfile
index fdd84ae12..05b2d7870 100644
--- a/17/jdk/ubuntu/jammy/Dockerfile
+++ b/17/jdk/ubuntu/jammy/Dockerfile
@@ -25,25 +25,40 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit binutils \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='e2c5e26f8572544b201bc22a9b28f2b1a3147ab69be111cea07c7f52af252e75'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='3ae4b254d5b720f94f986481e787fbd67f0667571140ba2e2ae5020ceddbc826'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -57,7 +72,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,11 +89,12 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/17/jre/alpine/Dockerfile b/17/jre/alpine/Dockerfile
index 70e0ddf70..e9555ca2f 100644
--- a/17/jre/alpine/Dockerfile
+++ b/17/jre/alpine/Dockerfile
@@ -25,11 +25,12 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
@@ -56,9 +57,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/17/jre/centos/Dockerfile b/17/jre/centos/Dockerfile
index be193c52c..5558ee836 100644
--- a/17/jre/centos/Dockerfile
+++ b/17/jre/centos/Dockerfile
@@ -25,22 +25,38 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar binutils \
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(objdump="$(command -v objdump)" && objdump --file-headers "$objdump" | awk -F '[:,]+[[:space:]]+' '$1 == "architecture" { print $2 }')"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='05b192f81ed478178ba953a2a779b67fc5a810acadb633ad69f8c4412399edb8'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='79c85ecf1320c67b828310167e1ced62e402bc86a5d47ca9cc7bfa3b708cb07a'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -50,7 +66,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,9 +77,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/17/jre/ubi/ubi9-minimal/Dockerfile b/17/jre/ubi/ubi9-minimal/Dockerfile
index 4571911b9..5eb70ce50 100644
--- a/17/jre/ubi/ubi9-minimal/Dockerfile
+++ b/17/jre/ubi/ubi9-minimal/Dockerfile
@@ -25,22 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(objdump="$(command -v objdump)" && objdump --file-headers "$objdump" | awk -F '[:,]+[[:space:]]+' '$1 == "architecture" { print $2 }')"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='05b192f81ed478178ba953a2a779b67fc5a810acadb633ad69f8c4412399edb8'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='79c85ecf1320c67b828310167e1ced62e402bc86a5d47ca9cc7bfa3b708cb07a'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -54,7 +55,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -65,9 +66,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/17/jre/ubuntu/focal/Dockerfile b/17/jre/ubuntu/focal/Dockerfile
index a90953668..430f7801d 100644
--- a/17/jre/ubuntu/focal/Dockerfile
+++ b/17/jre/ubuntu/focal/Dockerfile
@@ -25,25 +25,40 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit binutils \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='05b192f81ed478178ba953a2a779b67fc5a810acadb633ad69f8c4412399edb8'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='79c85ecf1320c67b828310167e1ced62e402bc86a5d47ca9cc7bfa3b708cb07a'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -57,7 +72,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,9 +89,9 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/17/jre/ubuntu/jammy/Dockerfile b/17/jre/ubuntu/jammy/Dockerfile
index fd0c113fe..e674d957b 100644
--- a/17/jre/ubuntu/jammy/Dockerfile
+++ b/17/jre/ubuntu/jammy/Dockerfile
@@ -25,25 +25,40 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit binutils \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-17.0.9+9
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
-         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='05b192f81ed478178ba953a2a779b67fc5a810acadb633ad69f8c4412399edb8'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.9_9.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733'; \
+         BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='79c85ecf1320c67b828310167e1ced62e402bc86a5d47ca9cc7bfa3b708cb07a'; \
          BINARY_URL='https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.9_9.tar.gz'; \
@@ -57,7 +72,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -74,9 +89,9 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/21/jdk/alpine/Dockerfile b/21/jdk/alpine/Dockerfile
index 09dea9d66..e18618e96 100644
--- a/21/jdk/alpine/Dockerfile
+++ b/21/jdk/alpine/Dockerfile
@@ -25,25 +25,26 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION jdk-21.0.1+12
 
 RUN set -eux; \
     ARCH="$(apk --print-arch)"; \
     case "${ARCH}" in \
-       amd64|x86_64) \
-         ESUM='422f23f5109056cacb9227247bebf8532e2dc3c9d505e71637ba610569d6b3ff'; \
-         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.1_12.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='77006c0a753808c2a6662007906eb6eb230f2fb6eb9d201a39cc46113e68f82c'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.1_12.tar.gz'; \
          ;; \
+       amd64|x86_64) \
+         ESUM='422f23f5109056cacb9227247bebf8532e2dc3c9d505e71637ba610569d6b3ff'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.1_12.tar.gz'; \
+         ;; \
        *) \
          echo "Unsupported arch: ${ARCH}"; \
          exit 1; \
@@ -60,11 +61,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/21/jdk/ubi/ubi9-minimal/Dockerfile b/21/jdk/ubi/ubi9-minimal/Dockerfile
index 237a54572..4723ae699 100644
--- a/21/jdk/ubi/ubi9-minimal/Dockerfile
+++ b/21/jdk/ubi/ubi9-minimal/Dockerfile
@@ -25,22 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk-21.0.1+12
 
 RUN set -eux; \
     ARCH="$(objdump="$(command -v objdump)" && objdump --file-headers "$objdump" | awk -F '[:,]+[[:space:]]+' '$1 == "architecture" { print $2 }')"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='1a6fa8abda4c5caed915cfbeeb176e7fbd12eb6b222f26e290ee45808b529aa1'; \
-         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_linux_hotspot_21.0.1_12.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='e184dc29a6712c1f78754ab36fb48866583665fa345324f1a79e569c064f95e9'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.1_12.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='1a6fa8abda4c5caed915cfbeeb176e7fbd12eb6b222f26e290ee45808b529aa1'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_linux_hotspot_21.0.1_12.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='9574828ef3d735a25404ced82e09bf20e1614f7d6403956002de9cfbfcb8638f'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.1_12.tar.gz'; \
@@ -50,7 +51,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,11 +62,12 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/21/jdk/ubuntu/jammy/Dockerfile b/21/jdk/ubuntu/jammy/Dockerfile
index a8f501d42..35562be0c 100644
--- a/21/jdk/ubuntu/jammy/Dockerfile
+++ b/21/jdk/ubuntu/jammy/Dockerfile
@@ -25,25 +25,40 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit binutils \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-21.0.1+12
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='1a6fa8abda4c5caed915cfbeeb176e7fbd12eb6b222f26e290ee45808b529aa1'; \
-         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_linux_hotspot_21.0.1_12.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='e184dc29a6712c1f78754ab36fb48866583665fa345324f1a79e569c064f95e9'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.1_12.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='1a6fa8abda4c5caed915cfbeeb176e7fbd12eb6b222f26e290ee45808b529aa1'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_linux_hotspot_21.0.1_12.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='9574828ef3d735a25404ced82e09bf20e1614f7d6403956002de9cfbfcb8638f'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.1_12.tar.gz'; \
@@ -53,7 +68,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -70,11 +85,12 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo javac --version && javac --version \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
+    echo "javac --version"; javac --version; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
 
diff --git a/21/jre/alpine/Dockerfile b/21/jre/alpine/Dockerfile
index 49c89aae9..c941a48e6 100644
--- a/21/jre/alpine/Dockerfile
+++ b/21/jre/alpine/Dockerfile
@@ -25,25 +25,26 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION jdk-21.0.1+12
 
 RUN set -eux; \
     ARCH="$(apk --print-arch)"; \
     case "${ARCH}" in \
-       amd64|x86_64) \
-         ESUM='a8fcc43927664ba191c9a77d1013f1f32fec1acc22fe6f0c29d687221f2cc95d'; \
-         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.1_12.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='2898ea1ddf6f70f09b09cf99d928f6d4c862f78f81104f5dce3e44a832b8444a'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.1_12.tar.gz'; \
          ;; \
+       amd64|x86_64) \
+         ESUM='a8fcc43927664ba191c9a77d1013f1f32fec1acc22fe6f0c29d687221f2cc95d'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.1_12.tar.gz'; \
+         ;; \
        *) \
          echo "Unsupported arch: ${ARCH}"; \
          exit 1; \
@@ -60,9 +61,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/21/jre/ubi/ubi9-minimal/Dockerfile b/21/jre/ubi/ubi9-minimal/Dockerfile
index 902f656e8..b3e035559 100644
--- a/21/jre/ubi/ubi9-minimal/Dockerfile
+++ b/21/jre/ubi/ubi9-minimal/Dockerfile
@@ -25,22 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk-21.0.1+12
 
 RUN set -eux; \
     ARCH="$(objdump="$(command -v objdump)" && objdump --file-headers "$objdump" | awk -F '[:,]+[[:space:]]+' '$1 == "architecture" { print $2 }')"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='277f4084bee875f127a978253cfbaad09c08df597feaf5ccc82d2206962279a3'; \
-         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_linux_hotspot_21.0.1_12.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='4582c4cc0c6d498ba7a23fdb0a5179c9d9c0d7a26f2ee8610468d5c2954fcf2f'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.1_12.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='277f4084bee875f127a978253cfbaad09c08df597feaf5ccc82d2206962279a3'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_linux_hotspot_21.0.1_12.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='05cc9b7bfbe246c27d307783b3d5095797be747184b168018ae3f7cc55608db2'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.1_12.tar.gz'; \
@@ -50,7 +51,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,9 +62,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/21/jre/ubuntu/jammy/Dockerfile b/21/jre/ubuntu/jammy/Dockerfile
index b907608fa..64e476c3b 100644
--- a/21/jre/ubuntu/jammy/Dockerfile
+++ b/21/jre/ubuntu/jammy/Dockerfile
@@ -25,25 +25,40 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit binutils \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk-21.0.1+12
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
     case "${ARCH}" in \
-       amd64|i386:x86-64) \
-         ESUM='277f4084bee875f127a978253cfbaad09c08df597feaf5ccc82d2206962279a3'; \
-         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_linux_hotspot_21.0.1_12.tar.gz'; \
-         ;; \
        aarch64|arm64) \
          ESUM='4582c4cc0c6d498ba7a23fdb0a5179c9d9c0d7a26f2ee8610468d5c2954fcf2f'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.1_12.tar.gz'; \
          ;; \
+       amd64|i386:x86-64) \
+         ESUM='277f4084bee875f127a978253cfbaad09c08df597feaf5ccc82d2206962279a3'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_linux_hotspot_21.0.1_12.tar.gz'; \
+         ;; \
        ppc64el|powerpc:common64) \
          ESUM='05cc9b7bfbe246c27d307783b3d5095797be747184b168018ae3f7cc55608db2'; \
          BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.1_12.tar.gz'; \
@@ -53,7 +68,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -70,9 +85,9 @@ RUN set -eux; \
     # https://openjdk.java.net/jeps/341
     java -Xshare:dump;
 
-RUN echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    && echo java --version && java --version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java --version"; java --version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jdk/centos/Dockerfile b/8/jdk/centos/Dockerfile
index aaa763809..a67ac8a69 100644
--- a/8/jdk/centos/Dockerfile
+++ b/8/jdk/centos/Dockerfile
@@ -25,8 +25,21 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar \
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -50,7 +63,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,9 +74,10 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && echo javac -version && javac -version \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "javac -version"; javac -version; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jdk/ubi/ubi9-minimal/Dockerfile b/8/jdk/ubi/ubi9-minimal/Dockerfile
index d1c8fd227..95ecf4063 100644
--- a/8/jdk/ubi/ubi9-minimal/Dockerfile
+++ b/8/jdk/ubi/ubi9-minimal/Dockerfile
@@ -25,8 +25,9 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -50,7 +51,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,9 +62,10 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && echo javac -version && javac -version \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "javac -version"; javac -version; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jdk/ubuntu/focal/Dockerfile b/8/jdk/ubuntu/focal/Dockerfile
index 629aef4e5..5f272a79e 100644
--- a/8/jdk/ubuntu/focal/Dockerfile
+++ b/8/jdk/ubuntu/focal/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -53,7 +65,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -67,9 +79,10 @@ RUN set -eux; \
     find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
     ldconfig;
 
-RUN echo Verifying install ... \
-    && echo javac -version && javac -version \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "javac -version"; javac -version; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jdk/ubuntu/jammy/Dockerfile b/8/jdk/ubuntu/jammy/Dockerfile
index 90870cf30..f274819d6 100644
--- a/8/jdk/ubuntu/jammy/Dockerfile
+++ b/8/jdk/ubuntu/jammy/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -53,7 +65,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -67,9 +79,10 @@ RUN set -eux; \
     find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
     ldconfig;
 
-RUN echo Verifying install ... \
-    && echo javac -version && javac -version \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "javac -version"; javac -version; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jdk/windows/nanoserver-1809/Dockerfile b/8/jdk/windows/nanoserver-1809/Dockerfile
index 609aff572..9837a737b 100644
--- a/8/jdk/windows/nanoserver-1809/Dockerfile
+++ b/8/jdk/windows/nanoserver-1809/Dockerfile
@@ -33,7 +33,7 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:8u392-b08-jdk-windowsservercore-1809 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo javac -version && javac -version \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "javac -version"; javac -version; \
+    echo "java -version"; java -version; \
+    echo "Complete."
diff --git a/8/jdk/windows/nanoserver-ltsc2022/Dockerfile b/8/jdk/windows/nanoserver-ltsc2022/Dockerfile
index 6d719e754..4db3704ca 100644
--- a/8/jdk/windows/nanoserver-ltsc2022/Dockerfile
+++ b/8/jdk/windows/nanoserver-ltsc2022/Dockerfile
@@ -33,7 +33,7 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:8u392-b08-jdk-windowsservercore-ltsc2022 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo javac -version && javac -version \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "javac -version"; javac -version; \
+    echo "java -version"; java -version; \
+    echo "Complete."
diff --git a/8/jre/centos/Dockerfile b/8/jre/centos/Dockerfile
index ea460791e..52de2e222 100644
--- a/8/jre/centos/Dockerfile
+++ b/8/jre/centos/Dockerfile
@@ -25,8 +25,21 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar \
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -50,7 +63,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,8 +74,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jre/ubi/ubi9-minimal/Dockerfile b/8/jre/ubi/ubi9-minimal/Dockerfile
index 845d9c437..8c14979db 100644
--- a/8/jre/ubi/ubi9-minimal/Dockerfile
+++ b/8/jre/ubi/ubi9-minimal/Dockerfile
@@ -25,8 +25,9 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -50,7 +51,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -61,8 +62,9 @@ RUN set -eux; \
     ; \
     rm -f /tmp/openjdk.tar.gz ${JAVA_HOME}/lib/src.zip;
 
-RUN echo Verifying install ... \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jre/ubuntu/focal/Dockerfile b/8/jre/ubuntu/focal/Dockerfile
index ffbcb1cef..d90a51469 100644
--- a/8/jre/ubuntu/focal/Dockerfile
+++ b/8/jre/ubuntu/focal/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -53,7 +65,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -67,8 +79,9 @@ RUN set -eux; \
     find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
     ldconfig;
 
-RUN echo Verifying install ... \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jre/ubuntu/jammy/Dockerfile b/8/jre/ubuntu/jammy/Dockerfile
index 3412c95bc..e4ee9ed76 100644
--- a/8/jre/ubuntu/jammy/Dockerfile
+++ b/8/jre/ubuntu/jammy/Dockerfile
@@ -25,11 +25,23 @@ ENV PATH $JAVA_HOME/bin:$PATH
 # Default to UTF-8 file.encoding
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit \
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION jdk8u392-b08
 
@@ -53,7 +65,7 @@ RUN set -eux; \
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
@@ -67,8 +79,9 @@ RUN set -eux; \
     find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
     ldconfig;
 
-RUN echo Verifying install ... \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN set -eux; \
+    echo "Verifying install ..."; \
+    echo "java -version"; java -version; \
+    echo "Complete."
 COPY entrypoint.sh /__cacert_entrypoint.sh
 ENTRYPOINT ["/__cacert_entrypoint.sh"]
diff --git a/8/jre/windows/nanoserver-1809/Dockerfile b/8/jre/windows/nanoserver-1809/Dockerfile
index 8d75a2414..765c3059f 100644
--- a/8/jre/windows/nanoserver-1809/Dockerfile
+++ b/8/jre/windows/nanoserver-1809/Dockerfile
@@ -33,6 +33,6 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:8u392-b08-jre-windowsservercore-1809 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "java -version"; java -version; \
+    echo "Complete."
diff --git a/8/jre/windows/nanoserver-ltsc2022/Dockerfile b/8/jre/windows/nanoserver-ltsc2022/Dockerfile
index c4481cb96..2340d7bfd 100644
--- a/8/jre/windows/nanoserver-ltsc2022/Dockerfile
+++ b/8/jre/windows/nanoserver-ltsc2022/Dockerfile
@@ -33,6 +33,6 @@ USER ContainerUser
 
 COPY --from=eclipse-temurin:8u392-b08-jre-windowsservercore-ltsc2022 $JAVA_HOME $JAVA_HOME
 
-RUN echo Verifying install ... \
-    && echo java -version && java -version \
-    && echo Complete.
+RUN echo "Verifying install ..."; \
+    echo "java -version"; java -version; \
+    echo "Complete."
diff --git a/docker_templates/alpine-linux.Dockerfile.j2 b/docker_templates/alpine-linux.Dockerfile.j2
index 8c751be21..eeffbc49a 100644
--- a/docker_templates/alpine-linux.Dockerfile.j2
+++ b/docker_templates/alpine-linux.Dockerfile.j2
@@ -4,11 +4,12 @@ FROM {{ base_image }}
 
 {% include 'partials/nix-env.j2' %}
 
-# fontconfig and ttf-dejavu added to support serverside image generation by Java programs
-# java-cacerts added to support adding CA certificates to the Java keystore
-# bash is required for the entrypoint script (s. https://github.com/adoptium/containers/issues/415)
-RUN apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib \
-    && rm -rf /var/cache/apk/*
+RUN set -eux; \
+    # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+    # java-cacerts added to support adding CA certificates to the Java keystore
+    # bash is required for the entrypoint script (see https://github.com/adoptium/containers/issues/415)
+    apk add --no-cache fontconfig java-cacerts bash libretls musl-locales musl-locales-lang ttf-dejavu tzdata zlib; \
+    rm -rf /var/cache/apk/*
 
 ENV JAVA_VERSION {{ java_version }}
 
diff --git a/docker_templates/centos.Dockerfile.j2 b/docker_templates/centos.Dockerfile.j2
index 5fb0d7d4f..f28e53fb7 100644
--- a/docker_templates/centos.Dockerfile.j2
+++ b/docker_templates/centos.Dockerfile.j2
@@ -4,8 +4,28 @@ FROM {{ base_image }}
 
 {% include 'partials/nix-env.j2' %}
 
-RUN yum install -y tzdata openssl curl wget ca-certificates fontconfig gzip tar {% if version|int >= 13 %}binutils {% endif %}\
-    && yum clean all
+RUN set -eux; \
+    yum install -y \
+    gzip \
+    tar \
+    {% if version|int < 22 -%}
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    {% endif -%}
+    wget \
+    tzdata \
+    openssl \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates \
+    fontconfig \
+    {% if version|int >= 13 -%}
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    {% endif -%}
+    ; \
+    rm -rf /var/cache/yum
 
 ENV JAVA_VERSION {{ java_version }}
 
diff --git a/docker_templates/partials/multi-arch-install.j2 b/docker_templates/partials/multi-arch-install.j2
index 7af8485f9..b315f1358 100644
--- a/docker_templates/partials/multi-arch-install.j2
+++ b/docker_templates/partials/multi-arch-install.j2
@@ -16,7 +16,7 @@
          exit 1; \
          ;; \
     esac; \
-    wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    wget {% if os != "alpine-linux" %}--progress=dot:giga {% endif %}-O /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
     mkdir -p "$JAVA_HOME"; \
     tar --extract \
diff --git a/docker_templates/partials/version-check.j2 b/docker_templates/partials/version-check.j2
index 7913d2691..5ed2fe14a 100644
--- a/docker_templates/partials/version-check.j2
+++ b/docker_templates/partials/version-check.j2
@@ -1,19 +1,10 @@
-RUN {% if version|int >= 11 -%}
-    {% if os_family != "windows" -%}
-    set -eux; \
-    && echo Verifying install ... \
-    && fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java \
-    {% else -%}
-    echo Verifying install ... \
+RUN {% if os_family != "windows" %}set -eux; \
+    {% else %}{% endif %}echo "Verifying install ..."; \
+    {% if os_family != "windows" and image_type == "jdk" and version|int >= 11 -%}
+    fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
     {% endif -%}
     {% if image_type == "jdk" -%}
-    && echo javac --version && javac --version \
+    echo "javac {% if version|int >= 11 %}--{% else %}-{% endif %}version"; javac {% if version|int >= 11 %}--{% else %}-{% endif %}version; \
     {% endif -%}
-    && echo java --version && java --version \
-    {% else -%}
-    {% if image_type == "jdk" -%}
-    && echo javac -version && javac -version \
-    {% endif -%}
-    && echo java -version && java -version \
-    {% endif -%}
-    && echo Complete.
\ No newline at end of file
+    echo "java {% if version|int >= 11 %}--{% else %}-{% endif %}version"; java {% if version|int >= 11 %}--{% else %}-{% endif %}version; \
+    echo "Complete."
\ No newline at end of file
diff --git a/docker_templates/ubi9-minimal.Dockerfile.j2 b/docker_templates/ubi9-minimal.Dockerfile.j2
index 083d16d19..9a2ebbfa3 100644
--- a/docker_templates/ubi9-minimal.Dockerfile.j2
+++ b/docker_templates/ubi9-minimal.Dockerfile.j2
@@ -4,8 +4,9 @@ FROM {{ base_image }}
 
 {% include 'partials/nix-env.j2' %}
 
-RUN microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar \
-    && microdnf clean all
+RUN set -eux; \
+    microdnf install -y binutils tzdata openssl wget ca-certificates fontconfig glibc-langpack-en gzip tar; \
+    microdnf clean all
 
 ENV JAVA_VERSION {{ java_version }}
 
diff --git a/docker_templates/ubuntu.Dockerfile.j2 b/docker_templates/ubuntu.Dockerfile.j2
index ff5b6e8c5..8991dc917 100644
--- a/docker_templates/ubuntu.Dockerfile.j2
+++ b/docker_templates/ubuntu.Dockerfile.j2
@@ -4,11 +4,30 @@ FROM {{ base_image }}
 
 {% include 'partials/nix-env.j2' %}
 
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata curl wget ca-certificates fontconfig locales p11-kit {% if version|int >= 13 %}binutils {% endif %}\
-    && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
-    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    {% if version|int < 22 -%}
+    # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
+    curl \
+    {% endif -%}
+    wget \
+    fontconfig \
+    # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
+    # https://github.com/adoptium/containers/issues/293
+    ca-certificates p11-kit \
+    {% if version|int >= 13 -%}
+    # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+    # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+    binutils \
+    {% endif -%}
+    tzdata \
+    # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
+    locales \
+    ; \
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+    locale-gen en_US.UTF-8; \
+    rm -rf /var/lib/apt/lists/*
 
 ENV JAVA_VERSION {{ java_version }}
 
diff --git a/test_generate_dockerfiles.py b/test_generate_dockerfiles.py
index 7828d2bad..dac37b92c 100644
--- a/test_generate_dockerfiles.py
+++ b/test_generate_dockerfiles.py
@@ -56,8 +56,8 @@ def test_version_checker(self):
             rendered_template = template.render(**context)
 
             # Expected string/partial in the rendered output
-            expected_string = "&& echo javac --version && javac --version"
-            self.assertIn(expected_string, rendered_template)
+            self.assertIn("javac --version", rendered_template)
+            self.assertIn("java --version", rendered_template)
 
         with self.subTest():
             # The context/variables to render the template
@@ -65,8 +65,8 @@ def test_version_checker(self):
             rendered_template = template.render(**context)
 
             # Expected string/partial in the rendered output
-            expected_string = "&& echo javac -version && javac -version"
-            self.assertIn(expected_string, rendered_template)
+            self.assertIn("javac -version", rendered_template)
+            self.assertIn("java -version", rendered_template)
 
         with self.subTest():
             # The context/variables to render the template
@@ -74,8 +74,8 @@ def test_version_checker(self):
             rendered_template = template.render(**context)
 
             # Expected string/partial in the rendered output
-            expected_string = "&& echo javac --version && javac --version"
-            self.assertNotIn(expected_string, rendered_template)
+            self.assertNotIn("javac --version", rendered_template)
+            self.assertIn("java --version", rendered_template)
 
         with self.subTest():
             # The context/variables to render the template
@@ -83,8 +83,8 @@ def test_version_checker(self):
             rendered_template = template.render(**context)
 
             # Expected string/partial in the rendered output
-            expected_string = "&& echo javac -version && javac -version"
-            self.assertNotIn(expected_string, rendered_template)
+            self.assertNotIn("javac -version", rendered_template)
+            self.assertIn("java -version", rendered_template)
 
     def test_version_checker_windows(self):
         template_name = "partials/version-check-windows.j2"