diff --git a/ci/codecov/build.Dockerfile b/ci/codecov/build.Dockerfile
index fa5b1129695a4ce7ec6cad279c738155b2098f1f..b5e9d5a818425c1da769d9f21a0101fb418fd505 100644
--- a/ci/codecov/build.Dockerfile
+++ b/ci/codecov/build.Dockerfile
@@ -20,26 +20,36 @@ RUN apt-get update -qq && apt-get install -qq -y --no-install-recommends \
     update-alternatives --config gcc && \
     rm -rf /var/lib/apt/lists/*
 
+RUN cd /usr/local/bin && \
+    curl -Ls https://codecov.io/bash > codecov.sh && \
+    echo "89c658e261d5f25533598a222fd96cf17a5fa0eb3772f2defac754d9970b2ec8 codecov.sh" | sha256sum --check --quiet && \
+    chmod +x codecov.sh
+
 RUN wget -q "https://github.com/linux-test-project/lcov/archive/v1.15.tar.gz" && \
+    echo "d88b0718f59815862785ac379aed56974b9edd8037567347ae70081cd4a3542a v1.15.tar.gz" | sha256sum --check --quiet && \
     tar -xzf v1.15.tar.gz && \
     cd lcov-1.15 && \
     make install -j$(nproc) && \
     rm -rf lcov-1.15 v1.15.tar.gz
 
 # Install MPICH ABI compatible with Cray's lib on Piz Daint
-RUN wget -q https://www.mpich.org/static/downloads/${MPICH_VERSION}/mpich-${MPICH_VERSION}.tar.gz && \
-    tar -xzf mpich-${MPICH_VERSION}.tar.gz && \
+RUN wget -q https://www.mpich.org/static/downloads/${MPICH_VERSION}/mpich-${MPICH_VERSION}.tar.gz -O mpich.tar.gz && \
+    echo "4bfaf8837a54771d3e4922c84071ef80ffebddbb6971a006038d91ee7ef959b9 mpich.tar.gz" | sha256sum --check --quiet && \
+    tar -xzf mpich.tar.gz && \
     cd mpich-${MPICH_VERSION} && \
     ./configure --disable-fortran && \
     make install -j$(nproc) && \
-    rm -rf mpich-${MPICH_VERSION}.tar.gz mpich-${MPICH_VERSION}
-
+    rm -rf mpich.tar.gz mpich-${MPICH_VERSION}
 
 # Install cmake
-RUN wget -qO- "https://github.com/Kitware/CMake/releases/download/v3.12.4/cmake-3.12.4-Linux-x86_64.tar.gz" | tar --strip-components=1 -xz -C /usr/local
+RUN wget -q "https://github.com/Kitware/CMake/releases/download/v3.12.4/cmake-3.12.4-Linux-x86_64.tar.gz" -O cmake.tar.gz && \
+    echo "486edd6710b5250946b4b199406ccbf8f567ef0e23cfe38f7938b8c78a2ffa5f cmake.tar.gz" | sha256sum --check --quiet && \
+    tar --strip-components=1 -xzf cmake.tar.gz -C /usr/local && \
+    rm -rf cmake.tar.gz
 
 # Install bundle tooling for creating small Docker images
 RUN wget -q https://github.com/haampie/libtree/releases/download/v1.2.0/libtree_x86_64.tar.gz && \
+    echo "4316a52aed7c8d2f7d2736c935bbda952204be92e56948110a143283764c427c libtree_x86_64.tar.gz" | sha256sum --check --quiet && \
     tar -xzf libtree_x86_64.tar.gz && \
     rm libtree_x86_64.tar.gz && \
     ln -s /root/libtree/libtree /usr/local/bin/libtree
diff --git a/ci/codecov/deploy.Dockerfile b/ci/codecov/deploy.Dockerfile
index 1c091ab0afb2f7025add4f1ca49a9d4aef0cf0c0..caf6a6e1ef421bc7900e2f298fe3587ad827fab1 100644
--- a/ci/codecov/deploy.Dockerfile
+++ b/ci/codecov/deploy.Dockerfile
@@ -43,7 +43,8 @@ RUN mkdir ${BUILD_DIR} && cd ${BUILD_DIR} && \
 # Install some code cov related executables
 RUN libtree -d ${BUNDLE_DIR} $(which gcov) && \
     cp -L ${SOURCE_DIR}/ci/codecov_pre ${SOURCE_DIR}/ci/codecov_post ${SOURCE_DIR}/ci/upload_codecov ${BUNDLE_DIR}/usr/bin && \
-    cp -L $(which lcov geninfo) ${BUNDLE_DIR}/usr/bin
+    cp -L $(which lcov geninfo) ${BUNDLE_DIR}/usr/bin && \
+    cp -L /usr/local/bin/codecov.sh ${BUNDLE_DIR}/usr/bin
 
 # In the build dir, remove everything except for gcno coverage files
 RUN mv ${BUILD_DIR} ${BUILD_DIR}-tmp && \
diff --git a/ci/release/build.Dockerfile b/ci/release/build.Dockerfile
index e28015a5c71614e3e3448c32faa1c0eb9478d72f..fd67d5ce7418d07a5cc9cfb3874486b8a4b82787 100644
--- a/ci/release/build.Dockerfile
+++ b/ci/release/build.Dockerfile
@@ -20,18 +20,23 @@ RUN apt-get update -qq && apt-get install -qq -y --no-install-recommends \
     rm -rf /var/lib/apt/lists/*
 
 # Install cmake
-RUN wget -qO- "https://github.com/Kitware/CMake/releases/download/v3.12.4/cmake-3.12.4-Linux-x86_64.tar.gz" | tar --strip-components=1 -xz -C /usr/local
+RUN wget -q "https://github.com/Kitware/CMake/releases/download/v3.12.4/cmake-3.12.4-Linux-x86_64.tar.gz" -O cmake.tar.gz && \
+    echo "486edd6710b5250946b4b199406ccbf8f567ef0e23cfe38f7938b8c78a2ffa5f cmake.tar.gz" | sha256sum --check --quiet && \
+    tar --strip-components=1 -xzf cmake.tar.gz -C /usr/local && \
+    rm -rf cmake.tar.gz
 
 # Install MPICH ABI compatible with Cray's lib on Piz Daint
-RUN wget -q https://www.mpich.org/static/downloads/${MPICH_VERSION}/mpich-${MPICH_VERSION}.tar.gz && \
-    tar -xzf mpich-${MPICH_VERSION}.tar.gz && \
+RUN wget -q https://www.mpich.org/static/downloads/${MPICH_VERSION}/mpich-${MPICH_VERSION}.tar.gz -O mpich.tar.gz && \
+    echo "4bfaf8837a54771d3e4922c84071ef80ffebddbb6971a006038d91ee7ef959b9 mpich.tar.gz" | sha256sum --check --quiet && \
+    tar -xzf mpich.tar.gz && \
     cd mpich-${MPICH_VERSION} && \
     ./configure --disable-fortran && \
     make install -j$(nproc) && \
-    rm -rf mpich-${MPICH_VERSION}.tar.gz mpich-${MPICH_VERSION}
+    rm -rf mpich.tar.gz mpich-${MPICH_VERSION}
 
 # Install bundle tooling for creating small Docker images
 RUN wget -q https://github.com/haampie/libtree/releases/download/v1.2.0/libtree_x86_64.tar.gz && \
+    echo "4316a52aed7c8d2f7d2736c935bbda952204be92e56948110a143283764c427c libtree_x86_64.tar.gz" | sha256sum --check --quiet && \
     tar -xzf libtree_x86_64.tar.gz && \
     rm libtree_x86_64.tar.gz && \
     ln -s /root/libtree/libtree /usr/local/bin/libtree
diff --git a/ci/upload_codecov b/ci/upload_codecov
index 080d06e2916cf13d0e370ac546f4c9debbf85101..343f157de8f1c9b9b0e5437662a1095b0617a086 100755
--- a/ci/upload_codecov
+++ b/ci/upload_codecov
@@ -6,6 +6,6 @@ TRACE_FILES_ARGS=`find "$SHARED_REPORTS" -type f -iname '*.info' -exec sh -c "ec
 lcov ${TRACE_FILES_ARGS} --output-file "$SHARED_REPORTS/combined.info"
 
 pushd $SOURCE_DIR
-bash <(curl -s https://codecov.io/bash) -f "$SHARED_REPORTS/combined.info" -t $CODECOV_TOKEN_GITHUB
-bash <(curl -s https://codecov.io/bash) -f "$SHARED_REPORTS/combined.info" -t $CODECOV_TOKEN_GITLAB
+codecov.sh -f "$SHARED_REPORTS/combined.info" -t $CODECOV_TOKEN_GITHUB
+codecov.sh -f "$SHARED_REPORTS/combined.info" -t $CODECOV_TOKEN_GITLAB
 popd
\ No newline at end of file