diff --git a/apps/workflows/.dockerignore b/apps/workflows/.dockerignore
index 5e73b32b..6ae67222 100644
--- a/apps/workflows/.dockerignore
+++ b/apps/workflows/.dockerignore
@@ -1,4 +1,4 @@
-# This file is generated by Dofigen v2.6.0
+# This file is generated by Dofigen v2.8.0
 # See https://github.com/lenra-io/dofigen
 
 node_modules
diff --git a/apps/workflows/Dockerfile b/apps/workflows/Dockerfile
index 5bef03d4..bcc0a326 100644
--- a/apps/workflows/Dockerfile
+++ b/apps/workflows/Dockerfile
@@ -1,14 +1,7 @@
 # syntax=docker/dockerfile:1.19.0
-# This file is generated by Dofigen v2.6.0
+# This file is generated by Dofigen v2.8.0
 # See https://github.com/lenra-io/dofigen
 
-# ca-certs
-FROM debian@sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734 AS ca-certs
-LABEL \
-    org.opencontainers.image.base.digest="sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734" \
-    org.opencontainers.image.base.name="docker.io/debian:bullseye-slim"
-RUN apt update && apt install -y ca-certificates curl && update-ca-certificates
-
 # docker
 FROM oven/bun@sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a AS docker
 LABEL \
@@ -88,7 +81,7 @@ RUN bun install
 # runtime
 FROM debian@sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734 AS runtime
 LABEL \
-    io.dofigen.version="2.6.0" \
+    io.dofigen.version="2.8.0" \
     org.opencontainers.image.authors="OpenStatus Team" \
     org.opencontainers.image.base.digest="sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734" \
     org.opencontainers.image.base.name="docker.io/debian:bullseye-slim" \
@@ -113,16 +106,8 @@ COPY \
     --chown=1000:1000 \
     --link \
     "/app/node_modules" "/app/node_modules"
-COPY \
-    --from=ca-certs \
-    --chown=1000:1000 \
-    --link \
-    "/etc/ssl/certs/ca-certificates.crt" "/etc/ssl/certs/"
-COPY \
-    --from=ca-certs \
-    --chown=1000:1000 \
-    --link \
-    "/usr/bin/curl" "/usr/bin/curl"
+USER 0:0
+RUN apt-get update -q && apt-get install -y -q --no-install-recommends ca-certificates curl && update-ca-certificates && rm -rf /var/lib/apt/lists/*
 USER 1000:1000
 EXPOSE 3000
 ENTRYPOINT ["/app/apps/workflows/app"]
diff --git a/apps/workflows/dofigen.lock b/apps/workflows/dofigen.lock
index 557b847b..04e307c2 100644
--- a/apps/workflows/dofigen.lock
+++ b/apps/workflows/dofigen.lock
@@ -38,9 +38,9 @@ effective: |
         path: oven/bun
         digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
       label:
-        org.opencontainers.image.base.digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
         org.opencontainers.image.base.name: docker.io/oven/bun:1.3.6
         org.opencontainers.image.stage: install
+        org.opencontainers.image.base.digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
       workdir: /app/
       run:
       - bun install --production  --frozen-lockfile --verbose
@@ -97,15 +97,6 @@ effective: |
         source: packages/upstash/package.json
       - target: packages/theme-store/package.json
         source: packages/theme-store/package.json
-    ca-certs:
-      fromImage:
-        path: debian
-        digest: sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734
-      label:
-        org.opencontainers.image.base.digest: sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734
-        org.opencontainers.image.base.name: docker.io/debian:bullseye-slim
-      run:
-      - apt update && apt install -y ca-certificates curl && update-ca-certificates
     docker:
       fromImage:
         path: oven/bun
@@ -139,14 +130,14 @@ effective: |
     path: debian
     digest: sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734
   label:
+    org.opencontainers.image.description: Background job processing and probe scheduling for OpenStatus
     org.opencontainers.image.base.digest: sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734
-    org.opencontainers.image.authors: OpenStatus Team
-    io.dofigen.version: 2.6.0
     org.opencontainers.image.source: https://github.com/openstatusHQ/openstatus
+    org.opencontainers.image.title: OpenStatus Workflows
+    org.opencontainers.image.authors: OpenStatus Team
     org.opencontainers.image.base.name: docker.io/debian:bullseye-slim
     org.opencontainers.image.vendor: OpenStatus
-    org.opencontainers.image.title: OpenStatus Workflows
-    org.opencontainers.image.description: Background job processing and probe scheduling for OpenStatus
+    io.dofigen.version: 2.8.0
   workdir: /app/
   copy:
   - fromBuilder: build
@@ -162,31 +153,26 @@ effective: |
     paths:
     - /app/node_modules
     target: /app/node_modules
-  - fromBuilder: ca-certs
-    paths:
-    - /etc/ssl/certs/ca-certificates.crt
-    target: /etc/ssl/certs/
-  - fromBuilder: ca-certs
-    paths:
-    - /usr/bin/curl
-    target: /usr/bin/curl
+  root:
+    run:
+    - apt-get update -q && apt-get install -y -q --no-install-recommends ca-certificates curl && update-ca-certificates && rm -rf /var/lib/apt/lists/*
   entrypoint:
   - /app/apps/workflows/app
   expose:
   - port: 3000
 images:
   docker.io:
-    oven:
-      bun:
-        1.3.6:
-          digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
     library:
       debian:
         bullseye-slim:
           digest: sha256:b32674fb57780ad57d7b0749242d3f585f462f4ec4a60ae0adacd945f9cb9734
+    oven:
+      bun:
+        1.3.6:
+          digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
 resources:
   dofigen.yml:
-    hash: 74add186097db908927534a6891f49e5f44fb056578c631c1afa534123c95769
+    hash: 20ce6210844fca7742f132334c868c8c35f23e8e7d20b62c5769c3dd6ac371cf
     content: |
       ignore:
         - node_modules
@@ -270,12 +256,10 @@ resources:
               target: /app/package.json
           run: bun install
 
-        ca-certs:
-          fromImage: debian:bullseye-slim
-          run: apt update && apt install -y ca-certificates curl && update-ca-certificates
-
       fromImage: debian:bullseye-slim
       workdir: /app/
+      root:
+        run: apt-get update -q && apt-get install -y -q --no-install-recommends ca-certificates curl && update-ca-certificates && rm -rf /var/lib/apt/lists/*
 
       # Metadata labels
       labels:
@@ -297,12 +281,6 @@ resources:
         - fromBuilder: libsql
           source: /app/node_modules
           target: /app/node_modules
-        - fromBuilder: ca-certs
-          source: /etc/ssl/certs/ca-certificates.crt
-          target: /etc/ssl/certs/
-        - fromBuilder: ca-certs
-          source: /usr/bin/curl
-          target: /usr/bin/curl
       expose: "3000"
 
       entrypoint: /app/apps/workflows/app
diff --git a/apps/workflows/dofigen.yml b/apps/workflows/dofigen.yml
index d330aaa2..1a4d803c 100644
--- a/apps/workflows/dofigen.yml
+++ b/apps/workflows/dofigen.yml
@@ -80,12 +80,10 @@ builders:
         target: /app/package.json
     run: bun install
 
-  ca-certs:
-    fromImage: debian:bullseye-slim
-    run: apt update && apt install -y ca-certificates curl && update-ca-certificates
-
 fromImage: debian:bullseye-slim
 workdir: /app/
+root:
+  run: apt-get update -q && apt-get install -y -q --no-install-recommends ca-certificates curl && update-ca-certificates && rm -rf /var/lib/apt/lists/*
 
 # Metadata labels
 labels:
@@ -107,12 +105,6 @@ copy:
   - fromBuilder: libsql
     source: /app/node_modules
     target: /app/node_modules
-  - fromBuilder: ca-certs
-    source: /etc/ssl/certs/ca-certificates.crt
-    target: /etc/ssl/certs/
-  - fromBuilder: ca-certs
-    source: /usr/bin/curl
-    target: /usr/bin/curl
 expose: "3000"
 
 entrypoint: /app/apps/workflows/app