diff --git a/tool/actions-plan-preview/Dockerfile b/tool/actions-plan-preview/Dockerfile
index 3a9232494a..0db20b1875 100644
--- a/tool/actions-plan-preview/Dockerfile
+++ b/tool/actions-plan-preview/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.22.4-alpine3.20 as builder
+FROM golang:1.22.4-alpine3.20 AS builder
 WORKDIR /app
 COPY go.mod go.sum  ./
 RUN go mod download
@@ -7,6 +7,6 @@ RUN go build -o /plan-preview .
 
 FROM ghcr.io/pipe-cd/pipectl:v0.43.1
 COPY --from=builder /plan-preview /
-ENV PATH $PATH:/app/cmd/pipectl
+ENV PATH=$PATH:/app/cmd/pipectl
 RUN chmod +x /plan-preview
 ENTRYPOINT ["/plan-preview"]
diff --git a/tool/codegen/Dockerfile b/tool/codegen/Dockerfile
index 992d7328f9..958043aa15 100644
--- a/tool/codegen/Dockerfile
+++ b/tool/codegen/Dockerfile
@@ -1,5 +1,5 @@
 # Builder image to build go program.
-FROM golang:1.23 as BUILDER
+FROM golang:1.23 AS builder
 
 COPY protoc-gen-auth /protoc-gen-auth
 RUN cd /protoc-gen-auth \
@@ -50,10 +50,10 @@ RUN for target in x86_64 aarch_64; do \
   && chmod +x bin/protoc-gen-js \
   && rm -rf protobuf-javascript-${PROTOC_GEN_JS_VER}-linux-${target}.tar.gz; \
   done && \
-  mv /protoc-gen-js-aarch_64/ /protoc-gen-js-aarch64/ 
+  mv /protoc-gen-js-aarch_64/ /protoc-gen-js-aarch64/
 
 # protoc-gen-auth
-COPY --from=BUILDER /usr/local/bin/protoc-gen-auth /usr/local/bin/
+COPY --from=builder /usr/local/bin/protoc-gen-auth /usr/local/bin/
 
 # gomock
 RUN go install github.com/golang/mock/mockgen@v${GOMOCK_VER}
diff --git a/tool/firestore-emulator/Dockerfile b/tool/firestore-emulator/Dockerfile
index f3741a9883..1e29e7ea89 100644
--- a/tool/firestore-emulator/Dockerfile
+++ b/tool/firestore-emulator/Dockerfile
@@ -4,10 +4,11 @@ FROM google/cloud-sdk:$GOOGLE_CLOUD_SDK_VERSION
 
 RUN apk add --update --no-cache openjdk11-jre-headless
 
-ENV FIRESTORE_PROJECT_ID "pipecd-test"
+ENV FIRESTORE_PROJECT_ID="pipecd-test"
 RUN gcloud config set project $FIRESTORE_PROJECT_ID && gcloud components install cloud-firestore-emulator beta --quiet
 
-ENV PORT 8080
+ENV PORT=8080
 EXPOSE "$PORT"
 
+SHELL ["/bin/sh", "-c"]
 ENTRYPOINT gcloud beta emulators firestore start --host-port="0.0.0.0:${PORT}"
diff --git a/tool/piped-base-okd/Dockerfile b/tool/piped-base-okd/Dockerfile
index 2f40117827..5676bcbe79 100644
--- a/tool/piped-base-okd/Dockerfile
+++ b/tool/piped-base-okd/Dockerfile
@@ -1,3 +1,4 @@
+# check=skip=SecretsUsedInArgOrEnv
 # https://github.com/pipe-cd/pipecd/pkgs/container/piped-base/103341355?tag=v0.44.0-alpha-52-ge881cac
 FROM ghcr.io/pipe-cd/piped-base@sha256:18a5a6af6507c8c70c5442d19651a2000672c78fc5dd91cfd3c0af26c899c1d3
 
@@ -18,12 +19,10 @@ RUN \
         make \
         jq \
         cmake && \
-
     # Install glibc to be used for building nss_wrapper.
     wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \
     wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.33-r0/glibc-2.33-r0.apk && \
     apk add glibc-2.33-r0.apk && \
-
     # Install nss_wrapper to add an random UID to "passwd" at runtime without having to directly modify /etc/passwd.
     /installer/install-nss-wrapper.sh && \
     # Remove what were used for installation.