diff --git a/apps/bitwarden-cli/Dockerfile b/apps/bitwarden-cli/Dockerfile
index d3d1f34..b3e8e50 100644
--- a/apps/bitwarden-cli/Dockerfile
+++ b/apps/bitwarden-cli/Dockerfile
@@ -1,7 +1,6 @@
 FROM node:21.6-bookworm as build
 
-# renovate: datasource=npm depName=@bitwarden/cli versioning=npm
-ARG BW_VERSION=2024.1.0
+ARG VERSION
 
 ARG TARGETPLATFORM
 ARG TARGETARCH
@@ -14,7 +13,7 @@ LABEL org.opencontainers.image.source="https://github.com/bitwarden/clients"
 
 WORKDIR /usr/local/bin
 
-RUN npm i -g @bitwarden/cli@${BW_VERSION}
+RUN npm i -g @bitwarden/cli@${VERSION}
 
 COPY ./entrypoint.sh /entrypoint.sh
 CMD ["/entrypoint.sh"]
diff --git a/apps/tf-runner-bitwarden/Dockerfile b/apps/tf-runner-bitwarden/Dockerfile
index ce21f81..486932b 100644
--- a/apps/tf-runner-bitwarden/Dockerfile
+++ b/apps/tf-runner-bitwarden/Dockerfile
@@ -1,8 +1,9 @@
-# renovate: datasource=github-releases depName=weaveworks/tf-runner versioning=docker
-ARG VERSION=0.15.1
-
-FROM ghcr.io/weaveworks/tf-runner:v${VERSION} as runner
+ARG VERSION
+FROM node:21.6-bookworm as build
 
+# renovate: datasource=npm depName=@bitwarden/cli versioning=npm
+ARG BW_VERSION=2024.1.0
+ARG VERSION
 ARG TARGETPLATFORM
 ARG TARGETARCH
 ARG TARGETOS
@@ -10,13 +11,25 @@ ARG TARGETOS
 LABEL dev.LilDrunkenSmurf.image.target_platform=$TARGETPLATFORM
 LABEL dev.LilDrunkenSmurf.image.target_architecture=$TARGETARCH
 LABEL dev.LilDrunkenSmurf.image.target_os=$TARGETOS
+LABEL org.opencontainers.image.source="https://github.com/bitwarden/clients"
+LABEL org.opencontainers.image.source="https://github.com/hashicorp/terraform"
 LABEL org.opencontainers.image.source="https://github.com/weaveworks/tf-controller"
 
-# renovate: datasource=npm depName=@bitwarden/cli versioning=npm
-ARG BW_VERSION=2024.1.0
+WORKDIR /usr/local/bin
+
+RUN npm i -g @bitwarden/cli@${BW_VERSION}
+
+# renovate: datasource=github-releases depName=hashicorp/terraform versioning=docker
+FROM hashicorp/terraform:1.7.1 as terraform
+ARG VERSION
+
+FROM ghcr.io/weaveworks/tf-runner:v${VERSION} as runner
+ARG VERSION
 
 USER root
 
-RUN apk add --no-cache npm && npm i -g @bitwarden/cli@${BW_CLI_VERSION}
+RUN apk add --no-cache npm
+COPY --from=build /usr/local/bin/bw /usr/local/bin/bw
+COPY --from=terraform --chown=65532:65532 /bin/terraform /usr/local/bin/terraform
 
 USER 65532:65532
diff --git a/apps/tf-runner-bitwarden/Dockerfile.old b/apps/tf-runner-bitwarden/Dockerfile.working
similarity index 70%
rename from apps/tf-runner-bitwarden/Dockerfile.old
rename to apps/tf-runner-bitwarden/Dockerfile.working
index f626c82..ce21f81 100644
--- a/apps/tf-runner-bitwarden/Dockerfile.old
+++ b/apps/tf-runner-bitwarden/Dockerfile.working
@@ -1,8 +1,7 @@
-ARG VERSION
+# renovate: datasource=github-releases depName=weaveworks/tf-runner versioning=docker
+ARG VERSION=0.15.1
 
-FROM node:21.6-bookworm as build
-# renovate: datasource=npm depName=@bitwarden/cli versioning=npm
-ARG BW_VERSION=2024.1.0
+FROM ghcr.io/weaveworks/tf-runner:v${VERSION} as runner
 
 ARG TARGETPLATFORM
 ARG TARGETARCH
@@ -11,19 +10,13 @@ ARG TARGETOS
 LABEL dev.LilDrunkenSmurf.image.target_platform=$TARGETPLATFORM
 LABEL dev.LilDrunkenSmurf.image.target_architecture=$TARGETARCH
 LABEL dev.LilDrunkenSmurf.image.target_os=$TARGETOS
-LABEL org.opencontainers.image.source="https://github.com/bitwarden/clients"
 LABEL org.opencontainers.image.source="https://github.com/weaveworks/tf-controller"
 
-WORKDIR /usr/local/bin
-
-RUN npm i -g @bitwarden/cli@${BW_VERSION}
-
-# renovate: datasource=github-releases depName=weaveworks/tf-runner versioning=docker
-
-FROM ghcr.io/weaveworks/tf-runner:v${VERSION} as runner
+# renovate: datasource=npm depName=@bitwarden/cli versioning=npm
+ARG BW_VERSION=2024.1.0
 
 USER root
 
-COPY --from=build /usr/local/bin/bw /usr/local/bin/bw
+RUN apk add --no-cache npm && npm i -g @bitwarden/cli@${BW_CLI_VERSION}
 
 USER 65532:65532
diff --git a/apps/tf-runner-bitwarden/ci/goss.yaml b/apps/tf-runner-bitwarden/ci/goss.yaml
index 7a95f4b..f8428fd 100644
--- a/apps/tf-runner-bitwarden/ci/goss.yaml
+++ b/apps/tf-runner-bitwarden/ci/goss.yaml
@@ -3,3 +3,6 @@
 file:
   /usr/local/bin/terraform:
     exists: true
+file:
+  /usr/local/bin/bw:
+    exists: true
diff --git a/apps/tf-runner-bitwarden/metadata.yaml b/apps/tf-runner-bitwarden/metadata.yaml
index c6c9db4..ace4dcb 100644
--- a/apps/tf-runner-bitwarden/metadata.yaml
+++ b/apps/tf-runner-bitwarden/metadata.yaml
@@ -4,7 +4,7 @@ base: false
 semantic_versioning: false
 channels:
   - name: stable
-    platforms: ["linux/amd64"] # ["linux/amd64", "linux/arm64"] arm64 is failing right now
+    platforms: ["linux/amd64", "linux/arm64"] # ["linux/amd64", "linux/arm64"] arm64 is failing right now
     stable: true
     tests:
       enabled: false