diff --git a/Makefile b/Makefile
index 1134b8c..a2ca6e8 100644
--- a/Makefile
+++ b/Makefile
@@ -55,9 +55,9 @@ enclave: $(godeps) $(image_eif) terminate
 		--enclave-name veil \
 		--eif-path $(image_eif) \
 		--cpu-count 2 \
-		--memory 3850
+		--memory 4096
 
-$(image_test_tar): $(godeps) $(image_test_dockerfile)
+$(image_test_tar): $(godeps) $(image_test_dockerfile) docker/run-unit-tests.sh
 	@echo "Building $(image_test_tar)..."
 	@docker run --volume $(PWD):/workspace \
 		gcr.io/kaniko-project/executor:v1.9.2 \
@@ -84,7 +84,7 @@ enclave-test: $(godeps) $(image_test_eif) terminate
 		--eif-path $(image_test_eif) \
 		--attach-console \
 		--cpu-count 2 \
-		--memory 3850
+		--memory 4096
 
 .PHONY: terminate
 terminate:
diff --git a/docker/Dockerfile-unit-test b/docker/Dockerfile-unit-test
index 76f627c..da48be6 100644
--- a/docker/Dockerfile-unit-test
+++ b/docker/Dockerfile-unit-test
@@ -7,18 +7,8 @@ COPY cmd/ ./cmd/
 COPY internal/ ./internal/
 COPY vendor/ ./vendor/
 COPY Makefile go.mod go.sum ./
-RUN cat > ./run-unit-tests.sh <<EOF
-#!/usr/bin/env bash
-cd /app
-# Needed for Go's build cache.
-export HOME=/app
-# Needed because otherwise we're getting:
-# fork/exec /tmp/go-build1885828642/b001/cmd.test: permission denied
-mkdir -p /app/tmp
-export TMPDIR=/app/tmp
-echo "Running Go unit tests..."
-$(which go) test -cover ./...
-EOF
+COPY docker/run-unit-tests.sh ./run-unit-tests.sh
+RUN chmod +x ./run-unit-tests.sh
 
 RUN go mod download
 
diff --git a/docker/run-unit-tests.sh b/docker/run-unit-tests.sh
new file mode 100644
index 0000000..6da8fa2
--- /dev/null
+++ b/docker/run-unit-tests.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+cd /app
+# Needed for Go's build cache.
+export HOME=/app
+# Needed because otherwise we're getting:
+# fork/exec /tmp/go-build1885828642/b001/cmd.test: permission denied
+mkdir -p /app/tmp
+export TMPDIR=/app/tmp
+echo "Running Go unit tests..."
+$(which go) test -cover ./...