diff --git a/2/Dockerfile b/2/Dockerfile
index cc88224..b893699 100644
--- a/2/Dockerfile
+++ b/2/Dockerfile
@@ -1,21 +1,41 @@
 FROM buildpack-deps:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
 ENV LANG C.UTF-8
 
-ENV PYPY_VERSION 5.4.1
+# runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+		tcl \
+		tk \
+	&& rm -rf /var/lib/apt/lists/*
 
-RUN set -x \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1
+ENV PYPY_VERSION 5.4.1
+ENV PYPY_SHA256SUM 9c85319778224d7fb0c348f55fe3fada15bb579c5f3870a13ad63b42a737dd72
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
-RUN curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION
+
+RUN set -ex \
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
+	\
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& rm -rf ~/.cache
 
 CMD ["pypy"]
diff --git a/2/slim/Dockerfile b/2/slim/Dockerfile
index 3d9f7f6..62796b7 100644
--- a/2/slim/Dockerfile
+++ b/2/slim/Dockerfile
@@ -1,7 +1,7 @@
 FROM debian:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
@@ -10,19 +10,40 @@ ENV LANG C.UTF-8
 RUN apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
 		libexpat1 \
+		libffi6 \
 		libsqlite3-0 \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.4.1
+ENV PYPY_SHA256SUM 9c85319778224d7fb0c348f55fe3fada15bb579c5f3870a13ad63b42a737dd72
+
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
-RUN set -x \
-	&& apt-get update && apt-get install -y bzip2 curl --no-install-recommends && rm -rf /var/lib/apt/lists/* \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1 \
-	&& curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION \
-	&& apt-get purge -y --auto-remove bzip2 curl
+RUN set -ex \
+	&& fetchDeps=' \
+		bzip2 \
+		wget \
+	' \
+	&& apt-get update && apt-get install -y $fetchDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
+	\
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
+	\
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& apt-get purge -y --auto-remove $fetchDeps \
+	&& rm -rf ~/.cache
 
 CMD ["pypy"]
diff --git a/3/Dockerfile b/3/Dockerfile
index fd5c4ed..969518d 100644
--- a/3/Dockerfile
+++ b/3/Dockerfile
@@ -1,21 +1,44 @@
 FROM buildpack-deps:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
 ENV LANG C.UTF-8
 
-ENV PYPY_VERSION 5.2.0-alpha1
+# runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+		tcl \
+		tk \
+	&& rm -rf /var/lib/apt/lists/*
 
-RUN set -x \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1
+ENV PYPY_VERSION 5.2.0-alpha1
+ENV PYPY_SHA256SUM f5e66ab24267d6ddf662d07c512d06c10ebc732ae62093dabbd775ac63b9060a
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
-RUN curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy3 \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION
+
+RUN set -ex \
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
+	\
+# explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
+	&& if [ ! -e /usr/local/bin/pip3 ]; then : \
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy3 /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+	; fi \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip3 install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& rm -rf ~/.cache
 
 CMD ["pypy3"]
diff --git a/3/slim/Dockerfile b/3/slim/Dockerfile
index 0cd4156..f9c8d5a 100644
--- a/3/slim/Dockerfile
+++ b/3/slim/Dockerfile
@@ -1,7 +1,7 @@
 FROM debian:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
@@ -10,19 +10,43 @@ ENV LANG C.UTF-8
 RUN apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
 		libexpat1 \
+		libffi6 \
 		libsqlite3-0 \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.2.0-alpha1
+ENV PYPY_SHA256SUM f5e66ab24267d6ddf662d07c512d06c10ebc732ae62093dabbd775ac63b9060a
+
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
-RUN set -x \
-	&& apt-get update && apt-get install -y bzip2 curl --no-install-recommends && rm -rf /var/lib/apt/lists/* \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1 \
-	&& curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy3 \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION \
-	&& apt-get purge -y --auto-remove bzip2 curl
+RUN set -ex \
+	&& fetchDeps=' \
+		bzip2 \
+		wget \
+	' \
+	&& apt-get update && apt-get install -y $fetchDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
+	\
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
+	\
+# explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
+	&& if [ ! -e /usr/local/bin/pip3 ]; then : \
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy3 /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+	; fi \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip3 install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& apt-get purge -y --auto-remove $fetchDeps \
+	&& rm -rf ~/.cache
 
 CMD ["pypy3"]
diff --git a/update.sh b/update.sh
index e2df8af..60eefa2 100755
--- a/update.sh
+++ b/update.sh
@@ -21,10 +21,19 @@ for version in "${versions[@]}"; do
 	# <td class="name"><a class="execute" href="/pypy/pypy/downloads/pypy3-2.4.0-linux64.tar.bz2">pypy3-2.4.0-linux64.tar.bz2</a></td>
 	fullVersion="$(curl -sSL 'https://bitbucket.org/pypy/pypy/downloads' | grep -E "$pypy"'-v([0-9.]+(-alpha[0-9]*)?)-linux64.tar.bz2' | sed -r 's/^.*'"$pypy"'-v([0-9.]+(-alpha[0-9]*)?)-linux64.tar.bz2.*$/\1/' | sort -V | tail -1)"
 
+	# <p>pypy2.7-5.4.0 sha256:</p>
+	# <pre class="literal-block">
+	# ...
+	# bdfea513d59dcd580970cb6f79f3a250d00191fd46b68133d5327e924ca845f8  pypy2-v5.4.0-linux64.tar.bz2
+	# ...
+	# </pre>
+	sha256sum="$(curl -sSL 'http://pypy.org/download.html' | grep -m1 -E '[a-f0-9]{64}  '"$pypy-v$fullVersion"'-linux64.tar.bz2' | cut -d' ' -f1)"
+
 	(
 		set -x
 		sed -ri '
 			s/^(ENV PYPY_VERSION) .*/\1 '"$fullVersion"'/;
+			s/^(ENV PYPY_SHA256SUM) .*/\1 '"$sha256sum"'/;
 			s/^(ENV PYTHON_PIP_VERSION) .*/\1 '"$pipVersion"'/;
 		' "$version"{,/slim}/Dockerfile
 		sed -ri 's/^(FROM pypy):.*/\1:'"$version"'/' "$version/onbuild/Dockerfile"