diff --git a/ci-conda.Dockerfile b/ci-conda.Dockerfile
index c33a1db..03d2023 100644
--- a/ci-conda.Dockerfile
+++ b/ci-conda.Dockerfile
@@ -113,17 +113,20 @@ case "${LINUX_VER}" in
     apt-get update
     apt-get upgrade -y
     apt-get install -y --no-install-recommends \
+      ca-certificates \
       curl \
       file \
       unzip \
       wget \
       gcc \
       g++
-    rm -rf "/var/lib/apt/lists/*"
+    update-ca-certificates
+    rm -rf /var/cache/apt/archives /var/lib/apt/lists/*
     ;;
   "rockylinux"*)
     yum -y update
     yum -y install --setopt=install_weak_deps=False \
+      ca-certificates \
       file \
       unzip \
       wget \
@@ -131,6 +134,7 @@ case "${LINUX_VER}" in
       yum-utils \
       gcc \
       gcc-c++
+    update-ca-trust extract
     yum clean all
     ;;
   *)
@@ -162,7 +166,7 @@ case "${CUDA_VER}" in
         # apt will not work correctly if it thinks it needs the build-essential dependency
         # so we patch it out with a sed command
         sed -i 's/, build-essential//g' /var/lib/dpkg/status
-        rm -rf "/var/lib/apt/lists/*"
+        rm -rf /var/cache/apt/archives /var/lib/apt/lists/*
         ;;
       "rockylinux"*)
         yum -y update
@@ -209,6 +213,8 @@ RUN <<EOF
 rapids-mamba-retry install -y \
   anaconda-client \
   boa \
+  ca-certificates \
+  certifi \
   conda-package-handling \
   dunamai \
   git \
diff --git a/ci-wheel.Dockerfile b/ci-wheel.Dockerfile
index fbc5dd5..8b30496 100644
--- a/ci-wheel.Dockerfile
+++ b/ci-wheel.Dockerfile
@@ -34,11 +34,37 @@ case "${LINUX_VER}" in
     echo 'APT::Update::Error-Mode "any";' > /etc/apt/apt.conf.d/warnings-as-errors
     apt update -y
     apt install -y \
-      debianutils build-essential software-properties-common \
-      jq wget gcc zlib1g-dev libbz2-dev \
-      libssl-dev libreadline-dev libsqlite3-dev libffi-dev curl git libncurses5-dev \
-      libnuma-dev openssh-client libcudnn8-dev zip libopenblas-dev liblapack-dev \
-      protobuf-compiler autoconf automake libtool cmake yasm libopenslide-dev libcurl4-openssl-dev
+      autoconf \
+      automake \
+      build-essential \
+      ca-certificates \
+      cmake \
+      curl \
+      debianutils \
+      gcc \
+      git \
+      jq \
+      libbz2-dev \
+      libcudnn8-dev \
+      libcurl4-openssl-dev \
+      libffi-dev \
+      liblapack-dev \
+      libncurses5-dev \
+      libnuma-dev \
+      libopenblas-dev \
+      libopenslide-dev \
+      libreadline-dev \
+      libsqlite3-dev \
+      libssl-dev \
+      libtool \
+      openssh-client \
+      protobuf-compiler \
+      software-properties-common \
+      wget \
+      yasm \
+      zip \
+      zlib1g-dev
+    update-ca-certificates
     add-apt-repository ppa:git-core/ppa
     add-apt-repository ppa:ubuntu-toolchain-r/test
     apt update -y
@@ -46,17 +72,44 @@ case "${LINUX_VER}" in
     add-apt-repository -r ppa:git-core/ppa
     add-apt-repository -r ppa:ubuntu-toolchain-r/test
     update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-9 90 --slave /usr/bin/g++ g++ /usr/bin/g++-9 --slave /usr/bin/gcov gcov /usr/bin/gcov-9
-    rm -rf /var/lib/apt/lists/*
+    rm -rf /var/cache/apt/archives /var/lib/apt/lists/*
     ;;
   "rockylinux"*)
     dnf update -y
     dnf install -y epel-release
     dnf update -y
     dnf install -y \
-      which wget gcc zlib-devel bzip2 bzip2-devel readline-devel sqlite \
-      sqlite-devel xz xz-devel libffi-devel curl git ncurses-devel numactl \
-      numactl-devel openssh-clients libcudnn8-devel zip jq openslide-devel \
-      protobuf-compiler autoconf automake libtool dnf-plugins-core cmake libcurl-devel
+      autoconf \
+      automake \
+      bzip2 \
+      bzip2-devel \
+      ca-certificates \
+      cmake \
+      curl \
+      dnf-plugins-core \
+      gcc \
+      git \
+      jq \
+      libcudnn8-devel \
+      libcurl-devel \
+      libffi-devel \
+      libtool \
+      ncurses-devel \
+      numactl \
+      numactl-devel \
+      openslide-devel \
+      openssh-clients \
+      protobuf-compiler \
+      readline-devel \
+      sqlite \
+      sqlite-devel \
+      wget \
+      which \
+      xz \
+      xz-devel \
+      zip \
+      zlib-devel
+    update-ca-trust extract
     dnf config-manager --set-enabled powertools
     dnf install -y blas-devel lapack-devel
     dnf -y install gcc-toolset-11-gcc gcc-toolset-11-gcc-c++
@@ -134,6 +187,7 @@ pyenv global ${PYTHON_VER}
 python -m pip install --upgrade pip
 python -m pip install \
   auditwheel \
+  certifi \
   conda-package-handling \
   dunamai \
   patchelf \
diff --git a/citestwheel.Dockerfile b/citestwheel.Dockerfile
index becac73..02f1327 100644
--- a/citestwheel.Dockerfile
+++ b/citestwheel.Dockerfile
@@ -46,12 +46,30 @@ case "${LINUX_VER}" in
     fi
 
     apt-get install -y --no-install-recommends \
-      wget curl git jq ssh \
-      make build-essential libssl-dev zlib1g-dev \
-      libbz2-dev libreadline-dev libsqlite3-dev wget \
-      curl llvm libncursesw5-dev xz-utils tk-dev unzip \
-      libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev \
-      "${tzdata_pkgs[@]}"
+      "${tzdata_pkgs[@]}" \
+      build-essential \
+      ca-certificates \
+      curl \
+      git \
+      jq \
+      libbz2-dev \
+      libffi-dev \
+      liblzma-dev \
+      libncursesw5-dev \
+      libreadline-dev \
+      libsqlite3-dev \
+      libssl-dev \
+      libxml2-dev \
+      libxmlsec1-dev \
+      llvm \
+      make \
+      ssh \
+      tk-dev \
+      unzip \
+      wget \
+      xz-utils \
+      zlib1g-dev
+    update-ca-certificates
     rm -rf /var/cache/apt/archives /var/lib/apt/lists/*
     ;;
   "rockylinux"*)
@@ -59,9 +77,25 @@ case "${LINUX_VER}" in
     dnf install -y epel-release
     dnf update -y
     dnf install -y \
-      which wget gcc zlib-devel bzip2 bzip2-devel readline-devel sqlite \
-      sqlite-devel xz xz-devel libffi-devel curl git ncurses-devel \
-      jq dnf-plugins-core
+      bzip2 \
+      bzip2-devel \
+      ca-certificates \
+      curl \
+      dnf-plugins-core \
+      gcc \
+      git \
+      jq \
+      libffi-devel \
+      ncurses-devel \
+      readline-devel \
+      sqlite \
+      sqlite-devel \
+      wget \
+      which \
+      xz \
+      xz-devel \
+      zlib-devel
+    update-ca-trust extract
     dnf clean all
     pushd tmp
     wget https://www.openssl.org/source/openssl-1.1.1k.tar.gz
@@ -99,7 +133,9 @@ COPY --from=aws-cli /usr/local/bin/ /usr/local/bin/
 RUN <<EOF
 pyenv global ${PYTHON_VER}
 python -m pip install --upgrade pip
-python -m pip install "rapids-dependency-file-generator==1.*"
+python -m pip install \
+  certifi \
+  'rapids-dependency-file-generator==1.*'
 pyenv rehash
 EOF