diff --git a/.docker/cli.dockerfile b/.docker/cli.dockerfile
index bcd7d30f2d..bada8f9188 100644
--- a/.docker/cli.dockerfile
+++ b/.docker/cli.dockerfile
@@ -1,7 +1,12 @@
+# check=skip=SecretsUsedInArgOrEnv
 # CLI container.
 #
 # All CLI operations performed in this container.
 #
+# The `PACKAGE_TOKEN` argument below is flagged by name by the
+# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
+# secret and never written to an image layer, so that check is skipped.
+#
 # hadolint global ignore=DL3018,SC2174
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
@@ -42,8 +47,11 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_CACHE_DIR=/tmp/.composer/cache
 
 # Allow custom PHP runtime configuration for Drush CLI commands.
-# The leading colon appends to the default scan directories.
+# The argument is declared so the reference resolves cleanly; when the base
+# image does not set it, the value stays empty and the leading colon appends
+# to the default scan directories.
 # @see https://github.com/drevops/vortex/issues/1913
+ARG PHP_INI_SCAN_DIR=""
 ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 
 # Starting from this line, Docker adds the result of each command as a
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
index 97e2f240ea..7181ff576e 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
@@ -1,7 +1,12 @@
+# check=skip=SecretsUsedInArgOrEnv
 # CLI container.
 #
 # All CLI operations performed in this container.
 #
+# The `PACKAGE_TOKEN` argument below is flagged by name by the
+# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
+# secret and never written to an image layer, so that check is skipped.
+#
 # hadolint global ignore=DL3018,SC2174
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
@@ -42,8 +47,11 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_CACHE_DIR=/tmp/.composer/cache
 
 # Allow custom PHP runtime configuration for Drush CLI commands.
-# The leading colon appends to the default scan directories.
+# The argument is declared so the reference resolves cleanly; when the base
+# image does not set it, the value stays empty and the leading colon appends
+# to the default scan directories.
 # @see https://github.com/drevops/vortex/issues/1913
+ARG PHP_INI_SCAN_DIR=""
 ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 
 # Starting from this line, Docker adds the result of each command as a
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
index 399d0eee7a..a39f0f4343 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -16,7 +16,7 @@
+@@ -21,7 +21,7 @@
  ARG LAGOON_PR_HEAD_SHA=""
  ENV LAGOON_PR_HEAD_SHA=${LAGOON_PR_HEAD_SHA}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
index 399d0eee7a..a39f0f4343 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -16,7 +16,7 @@
+@@ -21,7 +21,7 @@
  ARG LAGOON_PR_HEAD_SHA=""
  ENV LAGOON_PR_HEAD_SHA=${LAGOON_PR_HEAD_SHA}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
index 83d2a9130a..20c5a59d5b 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
index f6f4d14f97..cf9161fb91 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
index c7e9c2daa9..c6e5e90e00 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"