diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fae7222..0e8dd01 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,6 +16,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.5.0
         with:
           dockerfile: Containerfile
diff --git a/.hadolint.yaml b/.hadolint.yaml
index f9123de..f47e444 100644
--- a/.hadolint.yaml
+++ b/.hadolint.yaml
@@ -3,3 +3,4 @@ ignored:
   - DL3041 # hardcoding version of rpms is not how this should work
   - DL3022 # COPY --from can work from another image, not needed to be a layer
   - DL3033 # hardcoding version of rpms is not how this should work
+  - DL3066 # builder stage uses 'adm' from a controlled base image; literal name is intentional
diff --git a/Containerfile b/Containerfile
index 80a04d7..fcb9657 100644
--- a/Containerfile
+++ b/Containerfile
@@ -46,7 +46,7 @@ RUN rpmbuild -bb rpmbuild/SPECS/manticore-tzdata.spec
 
 # Download boost RPMs for runtime
 WORKDIR /tmp/boost_rpms
-RUN dnf download --arch `uname -m` $DEPS_NON_UBI_RUNTIME
+RUN dnf download --arch "$(uname -m)" $DEPS_NON_UBI_RUNTIME
 
 # it is ok not to tag ubi image as it is stable enough
 # hadolint ignore=DL3006