diff --git a/.env b/.env
index e1a6f1a91..464f63cac 100644
--- a/.env
+++ b/.env
@@ -2,6 +2,8 @@
 
 # Environment variables shared between ci and DEV.
 
+# NOTE: If you change this value remember to produce a new image by running the "CQ image" workflow.
+# See https://github.com/guardian/service-catalogue/actions/workflows/cq-image.yml
 # See https://github.com/cloudquery/cloudquery/releases?q=cli
 CQ_CLI=6.15.0
 
diff --git a/containers/cloudquery/Dockerfile b/containers/cloudquery/Dockerfile
index 6ef294756..400b44d1e 100644
--- a/containers/cloudquery/Dockerfile
+++ b/containers/cloudquery/Dockerfile
@@ -4,4 +4,6 @@ FROM ghcr.io/cloudquery/cloudquery:${CQ_CLI}
 
 # Need to install RDS certs before running Cloudquery container due to
 # access to the root filesystem being restricted
-RUN wget -O /usr/local/share/ca-certificates/global-bundle.crt -q https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem && update-ca-certificates
+RUN apk add --no-cache ca-certificates
+RUN wget -O /usr/local/share/ca-certificates/global-bundle.crt -q https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
+RUN update-ca-certificates