diff --git a/bwa/Dockerfile_0.7.17 b/bwa/Dockerfile_0.7.17
index ebf6132..bbd84eb 100644
--- a/bwa/Dockerfile_0.7.17
+++ b/bwa/Dockerfile_0.7.17
@@ -1,41 +1,81 @@
-
-# Using the Ubuntu base image
-FROM ubuntu:noble-20241011
+# Use specific SHA for better reproducibility
+FROM ubuntu:noble-20241011@sha256:e6173d4dc55e76b87c4af8db8821b1feae4146dd47341e4d431118c7dd060a74
 
 # Adding labels for the GitHub Container Registry
-LABEL org.opencontainers.image.title="bwa"
-LABEL org.opencontainers.image.description="Docker image for the use of bwa in FH DaSL's WILDS"
-LABEL org.opencontainers.image.version="0.7.17"
-LABEL org.opencontainers.image.authors="wilds@fredhutch.org"
-LABEL org.opencontainers.image.url=https://hutchdatascience.org/
-LABEL org.opencontainers.image.documentation=https://getwilds.org/
-LABEL org.opencontainers.image.source=https://github.com/getwilds/wilds-docker-library
-LABEL org.opencontainers.image.licenses=MIT
-
-# Installing prerequisites
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends build-essential=12.10ubuntu1 wget=1.21.4-1ubuntu4.1 \
-  zlib1g-dev=1:1.3.dfsg-3.1ubuntu2.1 autoconf=2.71-3 automake=1:1.16.5-1.3ubuntu1 \
-  libncurses-dev=6.4+20240113-1ubuntu2 libbz2-dev=1.0.8-5.1build0.1 liblzma-dev=5.6.1+really5.4.5-1build0.1 \
-  libssl-dev=3.0.13-0ubuntu3.4 libcurl4-gnutls-dev=8.5.0-2ubuntu10.4 gnutls-bin=3.8.3-1.1ubuntu3.2 \
-  && rm -rf /var/lib/apt/lists/*
-
-# Pulling and extracting bwa source code
-RUN wget -q --no-check-certificate https://github.com/lh3/bwa/releases/download/v0.7.17/bwa-0.7.17.tar.bz2 && tar -jxf bwa-0.7.17.tar.bz2
-
-# Installing bwa
-WORKDIR /bwa-0.7.17
-RUN make CC='gcc -fcommon'
-WORKDIR /
-ENV PATH="${PATH}:/bwa-0.7.17"
-
-# Pulling and extracting Samtools source code
-RUN wget -q --no-check-certificate https://github.com/samtools/samtools/releases/download/1.11/samtools-1.11.tar.bz2 && tar -jxf samtools-1.11.tar.bz2
-
-# Installing Samtools
-WORKDIR /samtools-1.11
-RUN ./configure && make && make install
-WORKDIR /
-
-# Cleanup
-RUN rm -rf samtools-1.11 samtools-1.11.tar.bz2
+LABEL org.opencontainers.image.title="bwa" \
+      org.opencontainers.image.description="Docker image for the use of bwa in FH DaSL's WILDS" \
+      org.opencontainers.image.version="0.7.17" \
+      org.opencontainers.image.authors="wilds@fredhutch.org" \
+      org.opencontainers.image.url=https://hutchdatascience.org/ \
+      org.opencontainers.image.documentation=https://getwilds.org/ \
+      org.opencontainers.image.source=https://github.com/getwilds/wilds-docker-library \
+      org.opencontainers.image.licenses=MIT
+
+# Set environment variables for versions
+ENV BWA_VERSION=0.7.17 \
+    SAMTOOLS_VERSION=1.11
+
+# Set shell options
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Update system and install security patches
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    # Store current versions in variables
+    BUILD_ESSENTIAL_VERSION=$(apt-cache policy build-essential | grep Candidate | awk '{print $2}') && \
+    WGET_VERSION=$(apt-cache policy wget | grep Candidate | awk '{print $2}') && \
+    ZLIB_VERSION=$(apt-cache policy zlib1g-dev | grep Candidate | awk '{print $2}') && \
+    AUTOCONF_VERSION=$(apt-cache policy autoconf | grep Candidate | awk '{print $2}') && \
+    AUTOMAKE_VERSION=$(apt-cache policy automake | grep Candidate | awk '{print $2}') && \
+    LIBNCURSES_VERSION=$(apt-cache policy libncurses-dev | grep Candidate | awk '{print $2}') && \
+    LIBBZ2_VERSION=$(apt-cache policy libbz2-dev | grep Candidate | awk '{print $2}') && \
+    LIBLZMA_VERSION=$(apt-cache policy liblzma-dev | grep Candidate | awk '{print $2}') && \
+    LIBSSL_VERSION=$(apt-cache policy libssl-dev | grep Candidate | awk '{print $2}') && \
+    LIBCURL_VERSION=$(apt-cache policy libcurl4-gnutls-dev | grep Candidate | awk '{print $2}') && \
+    GNUTLS_VERSION=$(apt-cache policy gnutls-bin | grep Candidate | awk '{print $2}') && \
+    CA_CERTS_VERSION=$(apt-cache policy ca-certificates | grep Candidate | awk '{print $2}') && \
+    # Install packages with specific versions
+    apt-get install -y --no-install-recommends \
+    build-essential="${BUILD_ESSENTIAL_VERSION}" \
+    wget="${WGET_VERSION}" \
+    zlib1g-dev="${ZLIB_VERSION}" \
+    autoconf="${AUTOCONF_VERSION}" \
+    automake="${AUTOMAKE_VERSION}" \
+    libncurses-dev="${LIBNCURSES_VERSION}" \
+    libbz2-dev="${LIBBZ2_VERSION}" \
+    liblzma-dev="${LIBLZMA_VERSION}" \
+    libssl-dev="${LIBSSL_VERSION}" \
+    libcurl4-gnutls-dev="${LIBCURL_VERSION}" \
+    gnutls-bin="${GNUTLS_VERSION}" \
+    ca-certificates="${CA_CERTS_VERSION}" \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install BWA
+WORKDIR /tmp
+RUN wget -q https://github.com/lh3/bwa/releases/download/v${BWA_VERSION}/bwa-${BWA_VERSION}.tar.bz2 && \
+    tar -jxf bwa-${BWA_VERSION}.tar.bz2 && \
+    rm bwa-${BWA_VERSION}.tar.bz2
+
+WORKDIR /tmp/bwa-${BWA_VERSION}
+RUN make CC='gcc -fcommon' && \
+    mv bwa /usr/local/bin/ && \
+    rm -rf /tmp/bwa-${BWA_VERSION}
+
+# Install Samtools
+WORKDIR /tmp
+RUN wget -q https://github.com/samtools/samtools/releases/download/${SAMTOOLS_VERSION}/samtools-${SAMTOOLS_VERSION}.tar.bz2 && \
+    tar -jxf samtools-${SAMTOOLS_VERSION}.tar.bz2 && \
+    rm samtools-${SAMTOOLS_VERSION}.tar.bz2
+
+WORKDIR /tmp/samtools-${SAMTOOLS_VERSION}
+RUN ./configure && \
+    make && \
+    make install && \
+    rm -rf /tmp/samtools-${SAMTOOLS_VERSION}
+
+# Set working directory to a more appropriate location for workflow execution
+WORKDIR /data
+
+# Add healthcheck
+HEALTHCHECK CMD bwa 2>&1 | grep -q "Program: bwa" || exit 1
\ No newline at end of file
diff --git a/bwa/Dockerfile_latest b/bwa/Dockerfile_latest
index 857f3c9..1499209 100644
--- a/bwa/Dockerfile_latest
+++ b/bwa/Dockerfile_latest
@@ -1,41 +1,81 @@
-
-# Using the Ubuntu base image
-FROM ubuntu:noble-20241011
+# Use specific SHA for better reproducibility
+FROM ubuntu:noble-20241011@sha256:e6173d4dc55e76b87c4af8db8821b1feae4146dd47341e4d431118c7dd060a74
 
 # Adding labels for the GitHub Container Registry
-LABEL org.opencontainers.image.title="bwa"
-LABEL org.opencontainers.image.description="Docker image for the use of bwa in FH DaSL's WILDS"
-LABEL org.opencontainers.image.version="latest"
-LABEL org.opencontainers.image.authors="wilds@fredhutch.org"
-LABEL org.opencontainers.image.url=https://hutchdatascience.org/
-LABEL org.opencontainers.image.documentation=https://getwilds.org/
-LABEL org.opencontainers.image.source=https://github.com/getwilds/wilds-docker-library
-LABEL org.opencontainers.image.licenses=MIT
-
-# Installing prerequisites
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends build-essential=12.10ubuntu1 wget=1.21.4-1ubuntu4.1 \
-  zlib1g-dev=1:1.3.dfsg-3.1ubuntu2.1 autoconf=2.71-3 automake=1:1.16.5-1.3ubuntu1 \
-  libncurses-dev=6.4+20240113-1ubuntu2 libbz2-dev=1.0.8-5.1build0.1 liblzma-dev=5.6.1+really5.4.5-1build0.1 \
-  libssl-dev=3.0.13-0ubuntu3.4 libcurl4-gnutls-dev=8.5.0-2ubuntu10.4 gnutls-bin=3.8.3-1.1ubuntu3.2 \
-  && rm -rf /var/lib/apt/lists/*
-
-# Pulling and extracting bwa source code
-RUN wget -q --no-check-certificate https://github.com/lh3/bwa/releases/download/v0.7.17/bwa-0.7.17.tar.bz2 && tar -jxf bwa-0.7.17.tar.bz2
-
-# Installing bwa
-WORKDIR /bwa-0.7.17
-RUN make CC='gcc -fcommon'
-WORKDIR /
-ENV PATH="${PATH}:/bwa-0.7.17"
-
-# Pulling and extracting Samtools source code
-RUN wget -q --no-check-certificate https://github.com/samtools/samtools/releases/download/1.11/samtools-1.11.tar.bz2 && tar -jxf samtools-1.11.tar.bz2
-
-# Installing Samtools
-WORKDIR /samtools-1.11
-RUN ./configure && make && make install
-WORKDIR /
-
-# Cleanup
-RUN rm -rf samtools-1.11 samtools-1.11.tar.bz2
+LABEL org.opencontainers.image.title="bwa" \
+      org.opencontainers.image.description="Docker image for the use of bwa in FH DaSL's WILDS" \
+      org.opencontainers.image.version="latest" \
+      org.opencontainers.image.authors="wilds@fredhutch.org" \
+      org.opencontainers.image.url=https://hutchdatascience.org/ \
+      org.opencontainers.image.documentation=https://getwilds.org/ \
+      org.opencontainers.image.source=https://github.com/getwilds/wilds-docker-library \
+      org.opencontainers.image.licenses=MIT
+
+# Set environment variables for versions
+ENV BWA_VERSION=0.7.17 \
+    SAMTOOLS_VERSION=1.11
+
+# Set shell options
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Update system and install security patches
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    # Store current versions in variables
+    BUILD_ESSENTIAL_VERSION=$(apt-cache policy build-essential | grep Candidate | awk '{print $2}') && \
+    WGET_VERSION=$(apt-cache policy wget | grep Candidate | awk '{print $2}') && \
+    ZLIB_VERSION=$(apt-cache policy zlib1g-dev | grep Candidate | awk '{print $2}') && \
+    AUTOCONF_VERSION=$(apt-cache policy autoconf | grep Candidate | awk '{print $2}') && \
+    AUTOMAKE_VERSION=$(apt-cache policy automake | grep Candidate | awk '{print $2}') && \
+    LIBNCURSES_VERSION=$(apt-cache policy libncurses-dev | grep Candidate | awk '{print $2}') && \
+    LIBBZ2_VERSION=$(apt-cache policy libbz2-dev | grep Candidate | awk '{print $2}') && \
+    LIBLZMA_VERSION=$(apt-cache policy liblzma-dev | grep Candidate | awk '{print $2}') && \
+    LIBSSL_VERSION=$(apt-cache policy libssl-dev | grep Candidate | awk '{print $2}') && \
+    LIBCURL_VERSION=$(apt-cache policy libcurl4-gnutls-dev | grep Candidate | awk '{print $2}') && \
+    GNUTLS_VERSION=$(apt-cache policy gnutls-bin | grep Candidate | awk '{print $2}') && \
+    CA_CERTS_VERSION=$(apt-cache policy ca-certificates | grep Candidate | awk '{print $2}') && \
+    # Install packages with specific versions
+    apt-get install -y --no-install-recommends \
+    build-essential="${BUILD_ESSENTIAL_VERSION}" \
+    wget="${WGET_VERSION}" \
+    zlib1g-dev="${ZLIB_VERSION}" \
+    autoconf="${AUTOCONF_VERSION}" \
+    automake="${AUTOMAKE_VERSION}" \
+    libncurses-dev="${LIBNCURSES_VERSION}" \
+    libbz2-dev="${LIBBZ2_VERSION}" \
+    liblzma-dev="${LIBLZMA_VERSION}" \
+    libssl-dev="${LIBSSL_VERSION}" \
+    libcurl4-gnutls-dev="${LIBCURL_VERSION}" \
+    gnutls-bin="${GNUTLS_VERSION}" \
+    ca-certificates="${CA_CERTS_VERSION}" \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install BWA
+WORKDIR /tmp
+RUN wget -q https://github.com/lh3/bwa/releases/download/v${BWA_VERSION}/bwa-${BWA_VERSION}.tar.bz2 && \
+    tar -jxf bwa-${BWA_VERSION}.tar.bz2 && \
+    rm bwa-${BWA_VERSION}.tar.bz2
+
+WORKDIR /tmp/bwa-${BWA_VERSION}
+RUN make CC='gcc -fcommon' && \
+    mv bwa /usr/local/bin/ && \
+    rm -rf /tmp/bwa-${BWA_VERSION}
+
+# Install Samtools
+WORKDIR /tmp
+RUN wget -q https://github.com/samtools/samtools/releases/download/${SAMTOOLS_VERSION}/samtools-${SAMTOOLS_VERSION}.tar.bz2 && \
+    tar -jxf samtools-${SAMTOOLS_VERSION}.tar.bz2 && \
+    rm samtools-${SAMTOOLS_VERSION}.tar.bz2
+
+WORKDIR /tmp/samtools-${SAMTOOLS_VERSION}
+RUN ./configure && \
+    make && \
+    make install && \
+    rm -rf /tmp/samtools-${SAMTOOLS_VERSION}
+
+# Set working directory to a more appropriate location for workflow execution
+WORKDIR /data
+
+# Add healthcheck
+HEALTHCHECK CMD bwa 2>&1 | grep -q "Program: bwa" || exit 1
\ No newline at end of file