diff --git a/Dockerfile b/Dockerfile
index 0e60a78d94c..c02bb66c087 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,10 +4,11 @@ ARG DEBIAN_FRONTEND=noninteractive
 # WARNING: DON'T PUT A SPACE AFTER ANY BACKSLASH OR APT WILL BREAK
 # One -q produces output suitable for logging (mostly hides
 # progress indicators)
-RUN apt-get -yqq update && \
-    apt-get -yqq install \
+RUN apt-get install \
+      --no-install-recommends \
       -o Dpkg::Options::="--force-confdef" \
       -o Dpkg::Options::="--force-confold" \
+      -qqUy \
       cloc \
       curl \
       gcc \
diff --git a/entrypoint.sh b/entrypoint.sh
index 71ad543e960..eb22e6e75d7 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -4,4 +4,4 @@ set -eo pipefail -u
 
 chown -LR "$USER_ID" /var/run
 # Drop permissions of user to match those of the host system
-gosu "$USER_ID" python3 "${FWROOT}/toolset/run-tests.py" "$@"
+exec gosu "$USER_ID" python3 "${FWROOT}/toolset/run-tests.py" "$@"
diff --git a/toolset/__init__.py b/toolset/__init__.py
old mode 100755
new mode 100644
diff --git a/toolset/continuous/tfb-shutdown.sh b/toolset/continuous/tfb-shutdown.sh
old mode 100644
new mode 100755
diff --git a/toolset/continuous/tfb-startup.sh b/toolset/continuous/tfb-startup.sh
old mode 100644
new mode 100755
diff --git a/toolset/scaffolding/README.md b/toolset/scaffolding/README.md
old mode 100755
new mode 100644
diff --git a/toolset/scaffolding/benchmark_config.json b/toolset/scaffolding/benchmark_config.json
old mode 100755
new mode 100644
diff --git a/toolset/utils/__init__.py b/toolset/utils/__init__.py
old mode 100755
new mode 100644
diff --git a/toolset/utils/benchmark_config.py b/toolset/utils/benchmark_config.py
old mode 100755
new mode 100644
diff --git a/toolset/utils/output_helper.py b/toolset/utils/output_helper.py
old mode 100755
new mode 100644
diff --git a/toolset/utils/scaffolding.py b/toolset/utils/scaffolding.py
old mode 100755
new mode 100644
diff --git a/toolset/wrk/concurrency.sh b/toolset/wrk/concurrency.sh
old mode 100644
new mode 100755
diff --git a/toolset/wrk/pipeline.sh b/toolset/wrk/pipeline.sh
old mode 100644
new mode 100755
diff --git a/toolset/wrk/query.sh b/toolset/wrk/query.sh
old mode 100644
new mode 100755
diff --git a/toolset/wrk/wrk.dockerfile b/toolset/wrk/wrk.dockerfile
index 9bcf42f7b38..772fe3268fa 100644
--- a/toolset/wrk/wrk.dockerfile
+++ b/toolset/wrk/wrk.dockerfile
@@ -4,11 +4,7 @@ FROM ubuntu:24.04
 COPY concurrency.sh pipeline.lua pipeline.sh query.sh ./
 
 ARG DEBIAN_FRONTEND=noninteractive
-RUN apt-get -yqq update >/dev/null && \
-    apt-get -yqq install >/dev/null \
-      curl \
-      wrk && \
-    chmod 777 concurrency.sh pipeline.sh query.sh
+RUN apt-get install --no-install-recommends -qqUy curl wrk > /dev/null
 
 # Environment vars required by the wrk scripts with nonsense defaults
 ENV accept=accept \