diff --git a/ci-conda.Dockerfile b/ci-conda.Dockerfile
index 766733c..da00a44 100644
--- a/ci-conda.Dockerfile
+++ b/ci-conda.Dockerfile
@@ -113,6 +113,7 @@ case "${LINUX_VER}" in
     apt-get update
     apt-get upgrade -y
     apt-get install -y --no-install-recommends \
+      ca-certificates \
       curl \
       file \
       unzip \
@@ -124,6 +125,7 @@ case "${LINUX_VER}" in
   "rockylinux"*)
     yum -y update
     yum -y install --setopt=install_weak_deps=False \
+      ca-certificates \
       file \
       unzip \
       wget \
@@ -209,6 +211,7 @@ RUN <<EOF
 rapids-mamba-retry install -y \
   anaconda-client \
   boa \
+  ca-certificates \
   certifi \
   conda-package-handling \
   dunamai \
diff --git a/ci-wheel.Dockerfile b/ci-wheel.Dockerfile
index 37b5c05..3d32be7 100644
--- a/ci-wheel.Dockerfile
+++ b/ci-wheel.Dockerfile
@@ -34,11 +34,36 @@ case "${LINUX_VER}" in
     echo 'APT::Update::Error-Mode "any";' > /etc/apt/apt.conf.d/warnings-as-errors
     apt update -y
     apt install -y \
-      debianutils build-essential software-properties-common \
-      jq wget gcc zlib1g-dev libbz2-dev \
-      libssl-dev libreadline-dev libsqlite3-dev libffi-dev curl git libncurses5-dev \
-      libnuma-dev openssh-client libcudnn8-dev zip libopenblas-dev liblapack-dev \
-      protobuf-compiler autoconf automake libtool cmake yasm libopenslide-dev libcurl4-openssl-dev
+      autoconf \
+      automake \
+      build-essential \
+      ca-certificates \
+      cmake \
+      curl \
+      debianutils \
+      gcc \
+      git \
+      jq \
+      libbz2-dev \
+      libcudnn8-dev \
+      libcurl4-openssl-dev \
+      libffi-dev \
+      liblapack-dev \
+      libncurses5-dev \
+      libnuma-dev \
+      libopenblas-dev \
+      libopenslide-dev \
+      libreadline-dev \
+      libsqlite3-dev \
+      libssl-dev \
+      libtool \
+      openssh-client \
+      protobuf-compiler \
+      software-properties-common \
+      wget \
+      yasm \
+      zip \
+      zlib1g-dev
     add-apt-repository ppa:git-core/ppa
     add-apt-repository ppa:ubuntu-toolchain-r/test
     apt update -y
@@ -53,10 +78,35 @@ case "${LINUX_VER}" in
     dnf install -y epel-release
     dnf update -y
     dnf install -y \
-      which wget gcc zlib-devel bzip2 bzip2-devel readline-devel sqlite \
-      sqlite-devel xz xz-devel libffi-devel curl git ncurses-devel numactl \
-      numactl-devel openssh-clients libcudnn8-devel zip jq openslide-devel \
-      protobuf-compiler autoconf automake libtool dnf-plugins-core cmake libcurl-devel
+      autoconf \
+      automake \
+      bzip2 \
+      bzip2-devel \
+      cmake \
+      curl \
+      dnf-plugins-core \
+      gcc \
+      git \
+      jq \
+      libcudnn8-devel \
+      libcurl-devel \
+      libffi-devel \
+      libtool \
+      ncurses-devel \
+      numactl \
+      numactl-devel \
+      openslide-devel \
+      openssh-clients \
+      protobuf-compiler \
+      readline-devel \
+      sqlite \
+      sqlite-devel \
+      wget \
+      which \
+      xz \
+      xz-devel \
+      zip \
+      zlib-devel
     dnf config-manager --set-enabled powertools
     dnf install -y blas-devel lapack-devel
     dnf -y install gcc-toolset-11-gcc gcc-toolset-11-gcc-c++
diff --git a/citestwheel.Dockerfile b/citestwheel.Dockerfile
index 958110b..773fa39 100644
--- a/citestwheel.Dockerfile
+++ b/citestwheel.Dockerfile
@@ -46,12 +46,29 @@ case "${LINUX_VER}" in
     fi
 
     apt-get install -y --no-install-recommends \
-      wget curl git jq ssh \
-      make build-essential libssl-dev zlib1g-dev \
-      libbz2-dev libreadline-dev libsqlite3-dev wget \
-      curl llvm libncursesw5-dev xz-utils tk-dev unzip \
-      libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev \
-      "${tzdata_pkgs[@]}"
+      "${tzdata_pkgs[@]}" \
+      build-essential \
+      ca-certificates \
+      curl \
+      git \
+      jq \
+      libbz2-dev \
+      libffi-dev \
+      liblzma-dev \
+      libncursesw5-dev \
+      libreadline-dev \
+      libsqlite3-dev \
+      libssl-dev \
+      libxml2-dev \
+      libxmlsec1-dev \
+      llvm \
+      make \
+      ssh \
+      tk-dev \
+      unzip \
+      wget \
+      xz-utils \
+      zlib1g-dev
     rm -rf /var/cache/apt/archives /var/lib/apt/lists/*
     ;;
   "rockylinux"*)
@@ -59,9 +76,24 @@ case "${LINUX_VER}" in
     dnf install -y epel-release
     dnf update -y
     dnf install -y \
-      which wget gcc zlib-devel bzip2 bzip2-devel readline-devel sqlite \
-      sqlite-devel xz xz-devel libffi-devel curl git ncurses-devel \
-      jq dnf-plugins-core
+      bzip2 \
+      bzip2-devel \
+      ca-certificates \
+      curl \
+      dnf-plugins-core \
+      gcc \
+      git \
+      jq \
+      libffi-devel \
+      ncurses-devel \
+      readline-devel \
+      sqlite \
+      sqlite-devel \
+      wget \
+      which \
+      xz \
+      xz-devel \
+      zlib-devel
     dnf clean all
     pushd tmp
     wget https://www.openssl.org/source/openssl-1.1.1k.tar.gz