diff --git a/8.2-prod/Dockerfile b/8.2-prod/Dockerfile
index 8572ca0..d049977 100644
--- a/8.2-prod/Dockerfile
+++ b/8.2-prod/Dockerfile
@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.2/Dockerfile b/8.2/Dockerfile
index dc8136a..3c4a94f 100644
--- a/8.2/Dockerfile
+++ b/8.2/Dockerfile
@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.3-prod/Dockerfile b/8.3-prod/Dockerfile
index 6ba96cf..77ffba5 100644
--- a/8.3-prod/Dockerfile
+++ b/8.3-prod/Dockerfile
@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.3/Dockerfile b/8.3/Dockerfile
index 4d12e85..5d174b2 100644
--- a/8.3/Dockerfile
+++ b/8.3/Dockerfile
@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.4-debian-prod/Dockerfile b/8.4-debian-prod/Dockerfile
index aeb8927..a7f7d4f 100644
--- a/8.4-debian-prod/Dockerfile
+++ b/8.4-debian-prod/Dockerfile
@@ -21,8 +21,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \
diff --git a/8.4-debian/Dockerfile b/8.4-debian/Dockerfile
index 5dd3753..a07626d 100644
--- a/8.4-debian/Dockerfile
+++ b/8.4-debian/Dockerfile
@@ -22,8 +22,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \
diff --git a/8.4-prod/Dockerfile b/8.4-prod/Dockerfile
index 6713397..4ef85ee 100644
--- a/8.4-prod/Dockerfile
+++ b/8.4-prod/Dockerfile
@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.4/Dockerfile b/8.4/Dockerfile
index c6afb44..1a0741e 100644
--- a/8.4/Dockerfile
+++ b/8.4/Dockerfile
@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.5-debian-prod/Dockerfile b/8.5-debian-prod/Dockerfile
index e2370ac..48c51cf 100644
--- a/8.5-debian-prod/Dockerfile
+++ b/8.5-debian-prod/Dockerfile
@@ -21,8 +21,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \
diff --git a/8.5-debian/Dockerfile b/8.5-debian/Dockerfile
index 9f708b1..5dd60f2 100644
--- a/8.5-debian/Dockerfile
+++ b/8.5-debian/Dockerfile
@@ -22,8 +22,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \
diff --git a/8.5-prod/Dockerfile b/8.5-prod/Dockerfile
index 5efe2f2..d52ab45 100644
--- a/8.5-prod/Dockerfile
+++ b/8.5-prod/Dockerfile
@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/8.5/Dockerfile b/8.5/Dockerfile
index 1e55645..7c69a3b 100644
--- a/8.5/Dockerfile
+++ b/8.5/Dockerfile
@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \
diff --git a/scripts/test-image.sh b/scripts/test-image.sh
index aca9c1e..3a71451 100644
--- a/scripts/test-image.sh
+++ b/scripts/test-image.sh
@@ -18,6 +18,10 @@ test "$(docker run --rm -e ASUSER=1000 "$image" id -u)" = 1000
 
 run dockerize --version
 run sh -c 'echo "{{ .Env.TEST_VAR }}" > /tmp/test.tmpl; TEST_VAR=hello dockerize -template /tmp/test.tmpl:/tmp/test.out; test "$(cat /tmp/test.out)" = hello'
+# The entrypoint runs dockerize as root, so only root may own it; and the
+# release tarball's LICENSE/README.md must not be left behind in /app.
+test "$(run stat -c %u:%g /usr/local/bin/dockerize)" = 0:0
+run sh -c 'test ! -e /app/LICENSE && test ! -e /app/README.md'
 
 # Read the module list once, and match whole names (e.g. zip, not gzip).
 modules=$(run php -m)
diff --git a/template/Dockerfile-debian.blade.php b/template/Dockerfile-debian.blade.php
index 8f1203b..fcd8275 100644
--- a/template/Dockerfile-debian.blade.php
+++ b/template/Dockerfile-debian.blade.php
@@ -24,8 +24,7 @@
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \
diff --git a/template/Dockerfile.blade.php b/template/Dockerfile.blade.php
index 9875109..7fb55de 100644
--- a/template/Dockerfile.blade.php
+++ b/template/Dockerfile.blade.php
@@ -24,8 +24,7 @@
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \