diff --git a/containers/dockerfile/Dockerfile.clang_tidy b/containers/dockerfile/Dockerfile.clang_tidy
index 90282c6..c353bf7 100644
--- a/containers/dockerfile/Dockerfile.clang_tidy
+++ b/containers/dockerfile/Dockerfile.clang_tidy
@@ -5,6 +5,8 @@ ARG CUDA_VERSION
 ENV DEBIAN_FRONTEND=noninteractive
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 RUN \
     apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/3bf863cc.pub && \
     apt-get update && \
@@ -29,10 +31,7 @@ RUN update-alternatives --install /usr/bin/clang-tidy clang-tidy /usr/bin/clang-
 RUN pip3 install cmake
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.cpu b/containers/dockerfile/Dockerfile.cpu
index 15fc560..626828b 100644
--- a/containers/dockerfile/Dockerfile.cpu
+++ b/containers/dockerfile/Dockerfile.cpu
@@ -12,6 +12,8 @@ ENV CPP=cpp-10
 ENV GOSU_VERSION=1.10
 ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64/
 
+COPY scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN \
     sed -i 's/ports.ubuntu.com/mirrors.ocf.berkeley.edu/g' /etc/apt/sources.list && \
@@ -47,11 +49,7 @@ RUN mamba create -n linux_cpu_test && \
     mamba clean --all --yes
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    { [ $ARCH = "aarch64" ] && export GOSU_ARCH="arm64" || export GOSU_ARCH="amd64"; } && \
-    wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-${GOSU_ARCH}" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.cpu_build_r_doc b/containers/dockerfile/Dockerfile.cpu_build_r_doc
index 7d808fc..718216e 100644
--- a/containers/dockerfile/Dockerfile.cpu_build_r_doc
+++ b/containers/dockerfile/Dockerfile.cpu_build_r_doc
@@ -27,11 +27,10 @@ RUN \
 
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.gpu b/containers/dockerfile/Dockerfile.gpu
index 2f770fa..75fb92a 100644
--- a/containers/dockerfile/Dockerfile.gpu
+++ b/containers/dockerfile/Dockerfile.gpu
@@ -15,6 +15,8 @@ ENV PATH=/opt/miniforge/bin:$PATH
 ENV GOSU_VERSION=1.10
 ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64/
 
+COPY scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN \
     { [ $ARCH = "aarch64" ] && export CUDA_REPO_ARCH="sbsa" || export CUDA_REPO_ARCH="x86_64"; } && \
@@ -48,11 +50,7 @@ RUN \
     mamba clean --all --yes
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    { [ $ARCH = "aarch64" ] && export GOSU_ARCH="arm64" || export GOSU_ARCH="amd64"; } && \
-    wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-${GOSU_ARCH}" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.gpu_build_cuda13_rockylinux8 b/containers/dockerfile/Dockerfile.gpu_build_cuda13_rockylinux8
index dfe863c..055ded3 100644
--- a/containers/dockerfile/Dockerfile.gpu_build_cuda13_rockylinux8
+++ b/containers/dockerfile/Dockerfile.gpu_build_cuda13_rockylinux8
@@ -15,14 +15,11 @@ ENV CPP=/opt/rh/gcc-toolset-10/root/usr/bin/cpp
 ENV CUDAHOSTCXX=/opt/rh/gcc-toolset-10/root/usr/bin/c++
 ENV GOSU_VERSION=1.10
 
+COPY scripts/setup_cuda_rockylinux.sh scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN \
-    { [ $ARCH = "aarch64" ] && export CUDA_REPO_ARCH="sbsa" || export CUDA_REPO_ARCH="x86_64"; } && \
-    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel8/${CUDA_REPO_ARCH}/D42D0685.pub | sed '/^Version/d' \
-        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
-    dnf -y update && \
-    dnf -y install dnf-plugins-core && \
-    dnf config-manager --set-enabled powertools && \
+    bash /scripts/setup_cuda_rockylinux.sh && \
     dnf install -y tar unzip wget xz git which ninja-build gcc-toolset-10-gcc gcc-toolset-10-binutils gcc-toolset-10-gcc-c++ && \
     # Miniforge
     wget -nv -O conda.sh https://github.com/conda-forge/miniforge/releases/download/$MINIFORGE_VERSION/Miniforge3-$MINIFORGE_VERSION-Linux-${ARCH}.sh && \
@@ -42,11 +39,7 @@ RUN \
     dnf install -y libnccl-${NCCL_VERSION}+cuda13.1 libnccl-devel-${NCCL_VERSION}+cuda13.1 libnccl-static-${NCCL_VERSION}+cuda13.1
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    { [ $ARCH = "aarch64" ] && export GOSU_ARCH="arm64" || export GOSU_ARCH="amd64"; } && \
-    wget -nv -nc -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-${GOSU_ARCH}" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.gpu_build_r_rockylinux8 b/containers/dockerfile/Dockerfile.gpu_build_r_rockylinux8
index cf8ee59..58cdc79 100644
--- a/containers/dockerfile/Dockerfile.gpu_build_r_rockylinux8
+++ b/containers/dockerfile/Dockerfile.gpu_build_r_rockylinux8
@@ -16,13 +16,11 @@ ENV F77=/opt/rh/gcc-toolset-10/root/usr/bin/gfortran
 ENV FC=/opt/rh/gcc-toolset-10/root/usr/bin/gfortran
 ENV GOSU_VERSION=1.10
 
+COPY scripts/setup_cuda_rockylinux.sh scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN \
-    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel8/x86_64/D42D0685.pub | sed '/^Version/d' \
-        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
-    dnf -y update && \
-    dnf -y install dnf-plugins-core && \
-    dnf config-manager --set-enabled powertools && \
+    bash /scripts/setup_cuda_rockylinux.sh && \
     dnf install -y tar unzip wget xz git which ninja-build readline-devel libX11-devel libXt-devel \
                    xorg-x11-server-devel openssl-devel zlib-devel bzip2-devel xz-devel \
                    pcre2-devel libcurl-devel texlive-* \
@@ -47,10 +45,7 @@ RUN \
 ENV PATH=/opt/miniforge/bin:$PATH
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    wget -nv -nc -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.gpu_build_rockylinux8 b/containers/dockerfile/Dockerfile.gpu_build_rockylinux8
index 3e8f77d..bb5f17c 100644
--- a/containers/dockerfile/Dockerfile.gpu_build_rockylinux8
+++ b/containers/dockerfile/Dockerfile.gpu_build_rockylinux8
@@ -16,14 +16,11 @@ ENV CPP=/opt/rh/gcc-toolset-10/root/usr/bin/cpp
 ENV CUDAHOSTCXX=/opt/rh/gcc-toolset-10/root/usr/bin/c++
 ENV GOSU_VERSION=1.10
 
+COPY scripts/setup_cuda_rockylinux.sh scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN \
-    { [ $ARCH = "aarch64" ] && export CUDA_REPO_ARCH="sbsa" || export CUDA_REPO_ARCH="x86_64"; } && \
-    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel8/${CUDA_REPO_ARCH}/D42D0685.pub | sed '/^Version/d' \
-        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
-    dnf -y update && \
-    dnf -y install dnf-plugins-core && \
-    dnf config-manager --set-enabled powertools && \
+    bash /scripts/setup_cuda_rockylinux.sh && \
     dnf install -y tar unzip wget xz git which ninja-build gcc-toolset-10-gcc gcc-toolset-10-binutils gcc-toolset-10-gcc-c++ && \
     # Miniforge
     wget -nv -O conda.sh https://github.com/conda-forge/miniforge/releases/download/$MINIFORGE_VERSION/Miniforge3-$MINIFORGE_VERSION-Linux-${ARCH}.sh && \
@@ -70,11 +67,7 @@ RUN git clone -b v${RAPIDS_VERSION}.00 https://github.com/rapidsai/rmm.git --rec
     rm -rf rmm
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    { [ $ARCH = "aarch64" ] && export GOSU_ARCH="arm64" || export GOSU_ARCH="amd64"; } && \
-    wget -nv -nc -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-${GOSU_ARCH}" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.i386 b/containers/dockerfile/Dockerfile.i386
index 5643e17..0051509 100644
--- a/containers/dockerfile/Dockerfile.i386
+++ b/containers/dockerfile/Dockerfile.i386
@@ -5,14 +5,13 @@ SHELL ["/bin/bash", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 RUN apt-get update && apt-get upgrade -y  && \
     apt-get install -y tar unzip wget git build-essential ninja-build cmake curl ca-certificates
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    curl -o /usr/local/bin/gosu -L "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-i386" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.jvm b/containers/dockerfile/Dockerfile.jvm
index c3234a8..85392e5 100644
--- a/containers/dockerfile/Dockerfile.jvm
+++ b/containers/dockerfile/Dockerfile.jvm
@@ -1,7 +1,7 @@
 FROM rockylinux:8
 ARG MINIFORGE_VERSION=24.9.2-0
 ARG CMAKE_VERSION=3.31.2
-ARG MAVEN_VERSION=3.9.15
+ARG MAVEN_VERSION=3.9.16
 
 SHELL ["/bin/bash", "-c"]
 
@@ -11,6 +11,8 @@ ENV CXX=/opt/rh/gcc-toolset-10/root/usr/bin/c++
 ENV CPP=/opt/rh/gcc-toolset-10/root/usr/bin/cpp
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN dnf -y update && \
     dnf -y install dnf-plugins-core && \
@@ -33,10 +35,7 @@ RUN dnf -y update && \
 RUN pip install numpy pytest scipy scikit-learn wheel kubernetes awscli
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    wget -nv -nc -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.jvm_gpu_build b/containers/dockerfile/Dockerfile.jvm_gpu_build
index 7bc35e2..b6ff0e5 100644
--- a/containers/dockerfile/Dockerfile.jvm_gpu_build
+++ b/containers/dockerfile/Dockerfile.jvm_gpu_build
@@ -4,7 +4,7 @@ ARG CUDA_VERSION
 ARG NCCL_VERSION
 ARG MINIFORGE_VERSION=24.9.2-0
 ARG CMAKE_VERSION=3.31.2
-ARG MAVEN_VERSION=3.9.15
+ARG MAVEN_VERSION=3.9.16
 
 SHELL ["/bin/bash", "-c"]
 
@@ -14,13 +14,11 @@ ENV CXX=/opt/rh/gcc-toolset-10/root/usr/bin/c++
 ENV CPP=/opt/rh/gcc-toolset-10/root/usr/bin/cpp
 ENV GOSU_VERSION=1.10
 
+COPY scripts/setup_cuda_rockylinux.sh scripts/install_gosu.sh /scripts/
+
 # Install all basic requirements
 RUN \
-    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel8/x86_64/D42D0685.pub | sed '/^Version/d' \
-        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
-    dnf -y update && \
-    dnf -y install dnf-plugins-core && \
-    dnf config-manager --set-enabled powertools && \
+    bash /scripts/setup_cuda_rockylinux.sh && \
     dnf install -y tar unzip wget xz git which ninja-build java-17-openjdk-devel gcc-toolset-10-gcc gcc-toolset-10-binutils gcc-toolset-10-gcc-c++ && \
     # Miniforge
     wget -nv -O conda.sh https://github.com/conda-forge/miniforge/releases/download/$MINIFORGE_VERSION/Miniforge3-$MINIFORGE_VERSION-Linux-x86_64.sh && \
@@ -45,10 +43,7 @@ RUN \
 RUN pip install numpy pytest scipy scikit-learn wheel kubernetes awscli
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    wget -nv -nc -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.manylinux2014_aarch64 b/containers/dockerfile/Dockerfile.manylinux2014_aarch64
index 9b789ad..5f93f4f 100644
--- a/containers/dockerfile/Dockerfile.manylinux2014_aarch64
+++ b/containers/dockerfile/Dockerfile.manylinux2014_aarch64
@@ -4,13 +4,12 @@ SHELL ["/bin/bash", "-c"]
 
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 RUN yum update -y && yum install -y java-1.8.0-openjdk-devel
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    curl -o /usr/local/bin/gosu -L "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-arm64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.manylinux2014_x86_64 b/containers/dockerfile/Dockerfile.manylinux2014_x86_64
index acabee3..3801f9e 100644
--- a/containers/dockerfile/Dockerfile.manylinux2014_x86_64
+++ b/containers/dockerfile/Dockerfile.manylinux2014_x86_64
@@ -4,13 +4,12 @@ SHELL ["/bin/bash", "-c"]
 
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 RUN yum update -y && yum install -y java-1.8.0-openjdk-devel
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    curl -o /usr/local/bin/gosu -L "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.manylinux_2_28_aarch64 b/containers/dockerfile/Dockerfile.manylinux_2_28_aarch64
index 51384a8..0a490fb 100644
--- a/containers/dockerfile/Dockerfile.manylinux_2_28_aarch64
+++ b/containers/dockerfile/Dockerfile.manylinux_2_28_aarch64
@@ -9,6 +9,8 @@ ENV CXX=/opt/rh/gcc-toolset-10/root/usr/bin/c++
 ENV CPP=/opt/rh/gcc-toolset-10/root/usr/bin/cpp
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 RUN \
     dnf -y update && \
     dnf -y install dnf-plugins-core && \
@@ -25,10 +27,7 @@ RUN mamba create -n aarch64_test && \
     mamba clean --all --yes
 
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-arm64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/dockerfile/Dockerfile.manylinux_2_28_x86_64 b/containers/dockerfile/Dockerfile.manylinux_2_28_x86_64
index 1337020..e890840 100644
--- a/containers/dockerfile/Dockerfile.manylinux_2_28_x86_64
+++ b/containers/dockerfile/Dockerfile.manylinux_2_28_x86_64
@@ -4,11 +4,10 @@ SHELL ["/bin/bash", "-c"]
 
 ENV GOSU_VERSION=1.10
 
+COPY scripts/install_gosu.sh /scripts/
+
 # Install lightweight sudo (not bound to TTY)
-RUN set -ex; \
-    curl -o /usr/local/bin/gosu -L "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
-    chmod +x /usr/local/bin/gosu && \
-    gosu nobody true
+RUN sh /scripts/install_gosu.sh
 
 # Default entry-point to use if running locally
 # It will preserve attributes of created files
diff --git a/containers/scripts/install_gosu.sh b/containers/scripts/install_gosu.sh
new file mode 100644
index 0000000..7327041
--- /dev/null
+++ b/containers/scripts/install_gosu.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ -z "${GOSU_VERSION:-}" ]; then
+  echo "GOSU_VERSION must be set" >&2
+  exit 1
+fi
+
+arch="${1:-${GOSU_ARCH:-${ARCH:-$(uname -m)}}}"
+case "${arch}" in
+  x86_64 | amd64)
+    gosu_arch="amd64"
+    ;;
+  aarch64 | arm64)
+    gosu_arch="arm64"
+    ;;
+  i386 | i686)
+    gosu_arch="i386"
+    ;;
+  *)
+    echo "Unsupported gosu architecture: ${arch}" >&2
+    exit 1
+    ;;
+esac
+
+gosu_url="https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${gosu_arch}"
+
+case "${GOSU_VERSION}:${gosu_arch}" in
+  1.10:amd64)
+    gosu_sha256="5b3b03713a888cee84ecbf4582b21ac9fd46c3d935ff2d7ea25dd5055d302d3c"
+    ;;
+  1.10:arm64)
+    gosu_sha256="3ebbff47692c3d9f0c3b6500727e277cb23d621feebcac0cc3d9e382d62d1acb"
+    ;;
+  1.10:i386)
+    gosu_sha256="2dfac0dd8830ebccea486d90472b48e68de5a543d9fb50bea933bbe6a9c8d610"
+    ;;
+  *)
+    echo "Unsupported gosu version/architecture for checksum verification: ${GOSU_VERSION}/${gosu_arch}" >&2
+    exit 1
+    ;;
+esac
+
+if command -v wget >/dev/null 2>&1; then
+  wget -nv -O /usr/local/bin/gosu "${gosu_url}"
+elif command -v curl >/dev/null 2>&1; then
+  curl -fsSL -o /usr/local/bin/gosu "${gosu_url}"
+else
+  echo "Either wget or curl is required to install gosu" >&2
+  exit 1
+fi
+
+printf '%s  %s\n' "${gosu_sha256}" /usr/local/bin/gosu | sha256sum -c -
+chmod +x /usr/local/bin/gosu
+gosu nobody true
diff --git a/containers/scripts/setup_cuda_rockylinux.sh b/containers/scripts/setup_cuda_rockylinux.sh
new file mode 100644
index 0000000..c64301e
--- /dev/null
+++ b/containers/scripts/setup_cuda_rockylinux.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ -z "${CUDA_VERSION:-}" ]]; then
+  echo "CUDA_VERSION must be set" >&2
+  exit 1
+fi
+
+if [[ -z "${CUDA_REPO_ARCH:-}" ]]; then
+  case "${ARCH:-$(uname -m)}" in
+    aarch64 | arm64)
+      CUDA_REPO_ARCH="sbsa"
+      ;;
+    x86_64 | amd64)
+      CUDA_REPO_ARCH="x86_64"
+      ;;
+    *)
+      echo "Unsupported CUDA repository architecture: ${ARCH:-$(uname -m)}" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+curl -fsSL "https://developer.download.nvidia.com/compute/cuda/repos/rhel8/${CUDA_REPO_ARCH}/D42D0685.pub" \
+  | sed '/^Version/d' > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA
+
+dnf -y install dnf-plugins-core python3-dnf-plugin-versionlock
+
+CUDA_SHORT_DASHED=$(echo "${CUDA_VERSION}" | grep -o -E '[0-9]+\.[0-9]' | tr . -)
+mapfile -t CUDA_LOCK_PACKAGES < <(rpm -qa --qf '%{NAME}\n' | sed -n "/-${CUDA_SHORT_DASHED}$/p")
+
+if [[ ${#CUDA_LOCK_PACKAGES[@]} -eq 0 ]]; then
+  echo "No installed CUDA packages matched CUDA_VERSION=${CUDA_VERSION}" >&2
+  exit 1
+fi
+
+dnf versionlock add "${CUDA_LOCK_PACKAGES[@]}"
+dnf -y update
+dnf config-manager --set-enabled powertools