diff --git a/.gitignore b/.gitignore
index 9417ee4db..87f36fc86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,5 +5,7 @@ sdks/**/examples
 sdks/**/test_fixtures
 sdks/**/vendor
 vendor
+.composer
+.docker
 .idea
 .gradle
\ No newline at end of file
diff --git a/bin/docker-run b/bin/docker-run
new file mode 100755
index 000000000..8b824bd53
--- /dev/null
+++ b/bin/docker-run
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+# SDK builds bind-mount the checkout. The user flag comes from docker-user-args
+# so rootful Docker does not leave root-owned files behind.
+
+set -euo pipefail
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+mapfile -t DOCKER_USER_ARGS < <("${DIR}/docker-user-args")
+
+exec docker run --rm "${DOCKER_USER_ARGS[@]}" "$@"
diff --git a/bin/docker-user-args b/bin/docker-user-args
new file mode 100755
index 000000000..9a84f8674
--- /dev/null
+++ b/bin/docker-user-args
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Prints docker run arguments so a bind-mounted repo is not owned by root.
+# Rootless Docker already maps container root to the host user, so it keeps
+# --user root:root. Rootful Docker does not, and that is what leaves SDK files
+# that a later git checkout cannot replace. Set DOCKER_RUN_AS_ROOT=1 to force
+# the old behavior.
+
+set -euo pipefail
+
+if [[ "${DOCKER_RUN_AS_ROOT:-}" == "1" ]]; then
+  printf '%s\n' --user root:root
+  exit 0
+fi
+
+security="$(docker info --format '{{range .SecurityOptions}}{{println .}}{{end}}' 2>/dev/null || true)"
+if grep -q rootless <<<"${security}"; then
+  printf '%s\n' --user root:root
+  exit 0
+fi
+
+printf '%s\n' --user "$(id -u):$(id -g)"
diff --git a/bin/normalize-sdk-modes b/bin/normalize-sdk-modes
new file mode 100755
index 000000000..62fbaef77
--- /dev/null
+++ b/bin/normalize-sdk-modes
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# openapi-generator's umask marks some generated sources executable. The SDK
+# trees keep those files at 644. GitHub Actions owns the workspace already.
+
+set -euo pipefail
+
+if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
+  exit 0
+fi
+
+for path in "$@"; do
+  if [[ -f "${path}" ]]; then
+    chmod 644 "${path}"
+  elif [[ -d "${path}" ]]; then
+    find "${path}" -type f -exec chmod 644 {} \;
+  fi
+done
diff --git a/bin/php b/bin/php
index 3db44cde0..603e5eda0 100755
--- a/bin/php
+++ b/bin/php
@@ -1,21 +1,13 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/openapi"
 
-if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
+if [[ -n "${GITHUB_ACTIONS:-}" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/php-in-docker" /app/openapi "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/bin/php-in-docker b/bin/php-in-docker
new file mode 100755
index 000000000..5bbe90912
--- /dev/null
+++ b/bin/php-in-docker
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+# Composer writes both the SDK tree and its cache. The cache lives on the host
+# so the user selected by docker-run can write it. Set PHP_DOCKER_PLATFORM to
+# pass --platform (the PHP SDK images are amd64).
+
+set -euo pipefail
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+WORKING_DIR="$1"
+ROOT_DIR="$2"
+IMAGE="$3"
+shift 3
+
+mkdir -p "${ROOT_DIR}/.docker/composer"
+
+platform=()
+if [[ -n "${PHP_DOCKER_PLATFORM:-}" ]]; then
+  platform=(--platform "${PHP_DOCKER_PLATFORM}")
+fi
+
+exec "${DIR}/docker-run" \
+  "${platform[@]}" \
+  -v "${ROOT_DIR}:${WORKING_DIR}" \
+  -v "${ROOT_DIR}/.docker/composer:/tmp/composer" \
+  -e COMPOSER_HOME=/tmp/composer \
+  -w "${WORKING_DIR}" \
+  "${IMAGE}" \
+  "$@"
diff --git a/bin/sandbox-dotnet b/bin/sandbox-dotnet
index c74759887..d5b207095 100755
--- a/bin/sandbox-dotnet
+++ b/bin/sandbox-dotnet
@@ -1,29 +1,35 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/dotnet"
 TARGET_DIR="${DIR}/../sandbox/dotnet"
 ARTIFACTS_DIR="${DIR}/../sandbox/dotnet/artifacts"
 
-mkdir -p "${ARTIFACTS_DIR}"
+mkdir -p "${ARTIFACTS_DIR}" "${SDK_DIR}/.docker/nuget" "${SDK_DIR}/.docker/home"
 rm -f "${ARTIFACTS_DIR}/*.nupkg"
 rm -f "${TARGET_DIR}/src/Dropbox.SignSandbox/*.cs"
 cp "${SDK_DIR}/templates/Entry.cs" "${TARGET_DIR}/src/Dropbox.SignSandbox/Entry.cs"
 
-docker run --rm -it \
+"${DIR}/docker-run" -it \
   -v "${SDK_DIR}:${WORKING_DIR}" \
   -v "${ARTIFACTS_DIR}:/artifacts" \
   -v "${TARGET_DIR}:/target" \
+  -v "${SDK_DIR}/.docker/home:/tmp/home" \
+  -v "${SDK_DIR}/.docker/nuget:/tmp/nuget" \
+  -e HOME=/tmp/home \
+  -e NUGET_PACKAGES=/tmp/nuget \
   -w "${WORKING_DIR}" \
-  -u root:root \
   mcr.microsoft.com/dotnet/sdk:9.0 dotnet pack -o /artifacts
 
-docker run --rm -it \
+"${DIR}/docker-run" -it \
   -v "${TARGET_DIR}:${WORKING_DIR}" \
+  -v "${SDK_DIR}/.docker/home:/tmp/home" \
+  -v "${SDK_DIR}/.docker/nuget:/tmp/nuget" \
+  -e HOME=/tmp/home \
+  -e NUGET_PACKAGES=/tmp/nuget \
   -w "${WORKING_DIR}" \
-  -u root:root \
   mcr.microsoft.com/dotnet/sdk:9.0 dotnet build
diff --git a/bin/sandbox-java b/bin/sandbox-java
index 6f86eb5ac..bb7c39809 100755
--- a/bin/sandbox-java
+++ b/bin/sandbox-java
@@ -1,24 +1,25 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/java-v2"
 TARGET_DIR="${DIR}/../sandbox/java"
 ARTIFACTS_DIR="${DIR}/../sandbox/java/artifacts"
 
-mkdir -p "${ARTIFACTS_DIR}"
+mkdir -p "${ARTIFACTS_DIR}" "${SDK_DIR}/.docker/gradle"
 rm -f "${ARTIFACTS_DIR}/*.jar"
 rm -f "${TARGET_DIR}/src/main/java/com/dropbox/sign_sandbox/*.java"
 cp "${SDK_DIR}/templates/Main.java" "${TARGET_DIR}/src/main/java/com/dropbox/sign_sandbox/Main.java"
 
-docker run --rm -it \
+"${DIR}/docker-run" -it \
   -v "${SDK_DIR}:${WORKING_DIR}" \
   -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-gradle-cache:/home/gradle/.gradle" \
-  -v "dropbox-sign-sdk-maven-cache:/root/.m2" \
+  -v "${SDK_DIR}/.docker/gradle:/tmp/gradle-user-home" \
+  -e GRADLE_USER_HOME=/tmp/gradle-user-home \
+  -e HOME=/tmp/gradle-user-home \
   -w "${WORKING_DIR}" \
   -e GEN_DIR=/app \
   gradle:7.6.1-jdk11 ./gradlew clean fatJar
diff --git a/bin/sandbox-node b/bin/sandbox-node
index 60da86c08..c3a3274b3 100755
--- a/bin/sandbox-node
+++ b/bin/sandbox-node
@@ -1,40 +1,35 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/node"
 TARGET_DIR="${DIR}/../sandbox/node"
 ARTIFACTS_DIR="${DIR}/../sandbox/node/artifacts"
 
-mkdir -p "${ARTIFACTS_DIR}"
+mkdir -p "${ARTIFACTS_DIR}" "${SDK_DIR}/.docker/npm" "${SDK_DIR}/.docker/home"
 rm -f "${ARTIFACTS_DIR}/*.tgz"
 rm -f "${TARGET_DIR}/src/*.ts"
 rm -f "${TARGET_DIR}/src/*.js"
 rm -f "${TARGET_DIR}/package-lock.json"
 rm -rf "${TARGET_DIR}/node_modules"
 
-docker run -it --rm \
-  -v "${SDK_DIR}:${WORKING_DIR}" \
-  -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -w "${WORKING_DIR}" \
-  node:22 npm install
-
-docker run -it --rm \
-  -v "${SDK_DIR}:${WORKING_DIR}" \
-  -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -w "${WORKING_DIR}" \
-  node:22 npm run build
-
-docker run -it --rm \
-  -v "${SDK_DIR}:${WORKING_DIR}" \
-  -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -w "${WORKING_DIR}" \
-  node:22 npm pack --pack-destination /artifacts
+node_run() {
+  "${DIR}/docker-run" -it \
+    -v "${SDK_DIR}:${WORKING_DIR}" \
+    -v "${ARTIFACTS_DIR}:/artifacts" \
+    -v "${SDK_DIR}/.docker/npm:/tmp/npm-cache" \
+    -v "${SDK_DIR}/.docker/home:/tmp/home" \
+    -e HOME=/tmp/home \
+    -e npm_config_cache=/tmp/npm-cache \
+    -w "${WORKING_DIR}" \
+    node:22 "$@"
+}
+
+node_run npm install
+node_run npm run build
+node_run npm pack --pack-destination /artifacts
 
 mv "${ARTIFACTS_DIR}/"*.tgz "${ARTIFACTS_DIR}/dropbox-sign-sdk.tgz"
diff --git a/bin/sandbox-ruby b/bin/sandbox-ruby
index 8abb45aa6..ddc43c659 100755
--- a/bin/sandbox-ruby
+++ b/bin/sandbox-ruby
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/ruby"
@@ -10,23 +10,25 @@ TARGET_DIR="${DIR}/../sandbox/ruby"
 ARTIFACTS_DIR="${DIR}/../sandbox/ruby/artifacts"
 
 rm -rf "${ARTIFACTS_DIR}"
-mkdir -p "${ARTIFACTS_DIR}/gems"
+mkdir -p "${ARTIFACTS_DIR}/gems" "${SDK_DIR}/.docker/gem" "${SDK_DIR}/.docker/bundle"
 
-docker run --rm \
-  -e GEM_HOME="/.gem-cache" \
-  -e BUNDLE_PATH="/.bundle-cache" \
+"${DIR}/docker-run" \
+  -e GEM_HOME=/tmp/gem \
+  -e BUNDLE_PATH=/tmp/bundle \
+  -e HOME=/tmp/gem \
   -v "${SDK_DIR}:${WORKING_DIR}" \
   -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-gem-cache:/.gem-cache" \
-  -v "dropbox-sign-sdk-bundle-cache:/.bundle-cache" \
+  -v "${SDK_DIR}/.docker/gem:/tmp/gem" \
+  -v "${SDK_DIR}/.docker/bundle:/tmp/bundle" \
   -w "${WORKING_DIR}" \
   ruby:3.4 gem build dropbox-sign.gemspec -o /artifacts/gems/dropbox-sign.gem
 
-docker run --rm \
-  -e GEM_HOME="/.gem-cache" \
-  -e BUNDLE_PATH="/.bundle-cache" \
+"${DIR}/docker-run" \
+  -e GEM_HOME=/tmp/gem \
+  -e BUNDLE_PATH=/tmp/bundle \
+  -e HOME=/tmp/gem \
   -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-gem-cache:/.gem-cache" \
-  -v "dropbox-sign-sdk-bundle-cache:/.bundle-cache" \
+  -v "${SDK_DIR}/.docker/gem:/tmp/gem" \
+  -v "${SDK_DIR}/.docker/bundle:/tmp/bundle" \
   -w "/artifacts" \
   ruby:3.4 gem generate_index
diff --git a/sdks/dotnet/bin/dotnet b/sdks/dotnet/bin/dotnet
index b3e5c445d..7ff9c3ab3 100755
--- a/sdks/dotnet/bin/dotnet
+++ b/sdks/dotnet/bin/dotnet
@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/dotnet"
 
-docker run --rm \
+mkdir -p "${ROOT_DIR}/.docker/nuget" "${ROOT_DIR}/.docker/home"
+
+exec "${DIR}/../../../bin/docker-run" \
   -v "${ROOT_DIR}:${WORKING_DIR}" \
+  -v "${ROOT_DIR}/.docker/home:/tmp/home" \
+  -v "${ROOT_DIR}/.docker/nuget:/tmp/nuget" \
+  -e HOME=/tmp/home \
+  -e NUGET_PACKAGES=/tmp/nuget \
   -w "${WORKING_DIR}" \
-  -u root:root \
   mcr.microsoft.com/dotnet/sdk:8.0 "$@"
diff --git a/sdks/dotnet/bin/php b/sdks/dotnet/bin/php
index 806c7318f..ac7bf48e2 100755
--- a/sdks/dotnet/bin/php
+++ b/sdks/dotnet/bin/php
@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/dotnet"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/dotnet "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/sdks/dotnet/run-build b/sdks/dotnet/run-build
index c4dff86f5..423af2086 100755
--- a/sdks/dotnet/run-build
+++ b/sdks/dotnet/run-build
@@ -16,7 +16,7 @@ fi
 rm -f "${DIR}/src/Dropbox.Sign/Api/"*.cs
 rm -f "${DIR}/src/Dropbox.Sign/Model/"*.cs
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
@@ -35,13 +35,13 @@ printf "Adding examples to Docs ...\n"
 bash "${DIR}/bin/php" ./bin/generate-examples.php
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
@@ -49,14 +49,12 @@ docker run --rm \
 printf "Adding old-style constant names ...\n"
 bash "${DIR}/bin/php" ./bin/copy-constants.php
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/src/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/src"
 
 printf "Running tests ...\n"
 bash "${DIR}/bin/dotnet" dotnet test src/Dropbox.Sign.Test/
diff --git a/sdks/java-v1/bin/gradle b/sdks/java-v1/bin/gradle
index 33882f688..3d127add3 100755
--- a/sdks/java-v1/bin/gradle
+++ b/sdks/java-v1/bin/gradle
@@ -2,16 +2,19 @@
 
 # You probably want to run ./bin/gradle ./gradlew clean build
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/java"
 
-docker run --rm \
+mkdir -p "${ROOT_DIR}/.docker/gradle"
+
+exec "${DIR}/../../../bin/docker-run" \
   -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-v1-gradle-cache:/home/gradle/.gradle" \
-  -v "dropbox-sign-sdk-v1-maven-cache:/root/.m2" \
-  -w "${WORKING_DIR}" \
+  -v "${ROOT_DIR}/.docker/gradle:/tmp/gradle-user-home" \
+  -e GRADLE_USER_HOME=/tmp/gradle-user-home \
+  -e HOME=/tmp/gradle-user-home \
   -e GEN_DIR=/app \
+  -w "${WORKING_DIR}" \
   gradle:7.6.1-jdk11 "$@"
diff --git a/sdks/java-v1/bin/php b/sdks/java-v1/bin/php
index 5785068b7..e75161bbe 100755
--- a/sdks/java-v1/bin/php
+++ b/sdks/java-v1/bin/php
@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/java"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/java "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/sdks/java-v1/run-build b/sdks/java-v1/run-build
index 2262ad532..280346bf9 100755
--- a/sdks/java-v1/run-build
+++ b/sdks/java-v1/run-build
@@ -16,7 +16,7 @@ fi
 rm -f "${DIR}/src/main/java/com/dropbox/sign/api/"*.java
 rm -f "${DIR}/src/main/java/com/dropbox/sign/model/"*.java
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
@@ -33,7 +33,7 @@ printf "Adding examples to Docs ...\n"
 bash "${DIR}/bin/php" ./bin/generate-examples.php
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
@@ -42,7 +42,7 @@ printf "Generating method overloads ...\n"
 bash "${DIR}/bin/php" ./bin/generate-overload-methods.php
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
@@ -50,14 +50,12 @@ docker run --rm \
 printf "Adding old-style constant names ...\n"
 bash "${DIR}/bin/php" ./bin/copy-constants.php
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/src/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/src"
 
 # Remove empty directory
 rm -rf "${DIR}/api"
diff --git a/sdks/java-v2/bin/gradle b/sdks/java-v2/bin/gradle
index 98ba3ac9e..3d127add3 100755
--- a/sdks/java-v2/bin/gradle
+++ b/sdks/java-v2/bin/gradle
@@ -2,16 +2,19 @@
 
 # You probably want to run ./bin/gradle ./gradlew clean build
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/java"
 
-docker run --rm \
+mkdir -p "${ROOT_DIR}/.docker/gradle"
+
+exec "${DIR}/../../../bin/docker-run" \
   -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-v2-gradle-cache:/home/gradle/.gradle" \
-  -v "dropbox-sign-sdk-v2-maven-cache:/root/.m2" \
-  -w "${WORKING_DIR}" \
+  -v "${ROOT_DIR}/.docker/gradle:/tmp/gradle-user-home" \
+  -e GRADLE_USER_HOME=/tmp/gradle-user-home \
+  -e HOME=/tmp/gradle-user-home \
   -e GEN_DIR=/app \
+  -w "${WORKING_DIR}" \
   gradle:7.6.1-jdk11 "$@"
diff --git a/sdks/java-v2/bin/php b/sdks/java-v2/bin/php
index 5785068b7..e75161bbe 100755
--- a/sdks/java-v2/bin/php
+++ b/sdks/java-v2/bin/php
@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/java"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/java "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/sdks/java-v2/run-build b/sdks/java-v2/run-build
index aae70c35a..9ec6fe17b 100755
--- a/sdks/java-v2/run-build
+++ b/sdks/java-v2/run-build
@@ -16,7 +16,7 @@ fi
 rm -f "${DIR}/src/main/java/com/dropbox/sign/api/"*.java
 rm -f "${DIR}/src/main/java/com/dropbox/sign/model/"*.java
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
@@ -33,7 +33,7 @@ printf "Adding examples to Docs ...\n"
 bash "${DIR}/bin/php" ./bin/generate-examples.php
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
@@ -42,7 +42,7 @@ printf "Generating method overloads ...\n"
 bash "${DIR}/bin/php" ./bin/generate-overload-methods.php
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
@@ -50,14 +50,12 @@ docker run --rm \
 printf "Adding old-style constant names ...\n"
 bash "${DIR}/bin/php" ./bin/copy-constants.php
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/src/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/src"
 
 # Remove empty directory
 rm -rf "${DIR}/api"
diff --git a/sdks/node/bin/node b/sdks/node/bin/node
index 6badd28c3..fb44e24ca 100755
--- a/sdks/node/bin/node
+++ b/sdks/node/bin/node
@@ -1,13 +1,18 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 
-docker run --rm \
+mkdir -p "${ROOT_DIR}/.docker/npm" "${ROOT_DIR}/.docker/home" "${ROOT_DIR}/node_modules"
+
+exec "${DIR}/../../../bin/docker-run" \
   -v "${ROOT_DIR}:/app" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -v "dropbox-sign-sdk-node-modules:/app/node_modules" \
+  -v "${ROOT_DIR}/node_modules:/app/node_modules" \
+  -v "${ROOT_DIR}/.docker/npm:/tmp/npm-cache" \
+  -v "${ROOT_DIR}/.docker/home:/tmp/home" \
+  -e HOME=/tmp/home \
+  -e npm_config_cache=/tmp/npm-cache \
   -w /app \
   node:18 "$@"
diff --git a/sdks/node/bin/php b/sdks/node/bin/php
index afb80b1cb..8451252e8 100755
--- a/sdks/node/bin/php
+++ b/sdks/node/bin/php
@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/javascript"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/javascript "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/sdks/node/run-build b/sdks/node/run-build
index 574cbc0da..c4d10ba21 100755
--- a/sdks/node/run-build
+++ b/sdks/node/run-build
@@ -19,9 +19,8 @@ rm -f "${DIR}/types/api/"*.ts
 rm -f "${DIR}/types/model/"*.ts
 
 # Generate code
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
-  --user "$(id -u):$(id -g)" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
     -c "/local/openapi-config.yaml" \
@@ -36,9 +35,8 @@ docker run --rm \
 rm -rf "${DIR}/docs/api" "${DIR}/tmp_docs"
 mkdir -p "${DIR}/docs/api"
 mkdir -p "${DIR}/tmp_docs"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
-  --user "$(id -u):$(id -g)" \
   openapitools/openapi-generator-cli:v7.8.0 generate \
     -i "/local/openapi-sdk.yaml" \
     -c "/local/openapi-config.yaml" \
@@ -57,9 +55,8 @@ mv "${DIR}/tmp_docs/"*.md "${DIR}/docs/api/"
 rm -rf "${DIR}/docs/model" "${DIR}/tmp_docs"
 mkdir -p "${DIR}/docs/model"
 mkdir -p "${DIR}/tmp_docs"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
-  --user "$(id -u):$(id -g)" \
   openapitools/openapi-generator-cli:v7.8.0 generate \
     -i "/local/openapi-sdk.yaml" \
     -c "/local/openapi-config.yaml" \
@@ -91,13 +88,13 @@ printf "Running prettier ...\n"
 bash "${DIR}/bin/node" npm run prettier
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
@@ -109,17 +106,15 @@ printf "Running build ...\n"
 bash "${DIR}/bin/node" npm run build
 bash "${DIR}/bin/node" npm run build-types
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/api/" -type f -exec chmod 644 {} \;
-  find "${DIR}/dist/" -type f -exec chmod 644 {} \;
-  find "${DIR}/model/" -type f -exec chmod 644 {} \;
-  find "${DIR}/types/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/api" \
+  "${DIR}/dist" \
+  "${DIR}/model" \
+  "${DIR}/types"
 
 printf "Running tests ...\n"
 bash "${DIR}/bin/node" npm run test
diff --git a/sdks/php/bin/php b/sdks/php/bin/php
index 9e31aee11..af16b6a73 100755
--- a/sdks/php/bin/php
+++ b/sdks/php/bin/php
@@ -1,25 +1,14 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/php"
-
-if [[ "$PHP_USE_NATIVE" -ne 1 ]]; then
-  docker run --rm \
-    --platform linux/amd64 \
-    -v "${ROOT_DIR}:${WORKING_DIR}" \
-    -v "dropbox-sign-sdk-composer-cache:/.composer" \
-    -w "${WORKING_DIR}" \
-    -u root:root \
-    jtreminio/php-cli:7.4 "$@"
 
-    exit 0
+if [[ "${PHP_USE_NATIVE:-0}" -ne 1 ]]; then
+  export PHP_DOCKER_PLATFORM=linux/amd64
+  exec "${DIR}/../../../bin/php-in-docker" /app/php "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
 fi
 
-pushd "${ROOT_DIR}"
+cd "${ROOT_DIR}"
 exec "$@"
-popd
diff --git a/sdks/php/bin/php-8 b/sdks/php/bin/php-8
index 147bb2b15..210061460 100755
--- a/sdks/php/bin/php-8
+++ b/sdks/php/bin/php-8
@@ -1,19 +1,9 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/php"
-
-docker run --rm \
-  --platform linux/amd64 \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php:8.1 "$@"
 
-  exit 0
+export PHP_DOCKER_PLATFORM=linux/amd64
+exec "${DIR}/../../../bin/php-in-docker" /app/php "${ROOT_DIR}" jtreminio/php:8.1 "$@"
diff --git a/sdks/php/run-build b/sdks/php/run-build
index dd69c1ae1..8b02e2d3a 100755
--- a/sdks/php/run-build
+++ b/sdks/php/run-build
@@ -17,7 +17,7 @@ rm -f "${DIR}/composer.lock"
 rm -f "${DIR}/src/Api/"*.php
 rm -f "${DIR}/src/Model/"*.php
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   -v "${DIR}/openapi-sdk.yaml:/local/openapi-sdk.yaml" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
@@ -38,13 +38,13 @@ printf "Running php-cs-fixer ...\n"
 bash "${DIR}/bin/php-8" ./vendor/bin/php-cs-fixer fix --verbose
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
@@ -52,14 +52,12 @@ docker run --rm \
 printf "Adding old-style constant names ...\n"
 bash "${DIR}/bin/php-8" ./bin/copy-constants.php
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/src/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/src"
 
 printf "Running unit tests ...\n"
 PHP_USE_NATIVE=0 bash "${DIR}/bin/php" ./vendor/bin/phpunit
diff --git a/sdks/python/bin/php b/sdks/python/bin/php
index f59f0a528..57baa541d 100755
--- a/sdks/python/bin/php
+++ b/sdks/python/bin/php
@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/python"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/python "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/sdks/python/bin/python b/sdks/python/bin/python
index 28cb66524..ffa2a282c 100755
--- a/sdks/python/bin/python
+++ b/sdks/python/bin/python
@@ -1,15 +1,21 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+# The old pip volume replaced /usr/local/lib/python3.10, which hid the
+# interpreter on a fresh mount and was owned by root. A virtualenv under
+# .docker is writable by the host user and leaves the image stdlib alone.
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/python"
 
-docker run --rm \
+mkdir -p "${ROOT_DIR}/.docker/venv"
+
+exec "${DIR}/../../../bin/docker-run" \
   -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-pip-cache:/usr/local/lib/python3.10" \
+  -v "${ROOT_DIR}/.docker/venv:/opt/venv" \
   -w "${WORKING_DIR}" \
-  python:3.10-buster "$@"
+  python:3.10-buster \
+  bash -c 'if [[ ! -x /opt/venv/bin/python ]]; then python -m venv /opt/venv; fi; export PATH="/opt/venv/bin:${PATH}"; exec "$@"' \
+  bash "$@"
diff --git a/sdks/python/run-build b/sdks/python/run-build
index 09284e82c..0d79dc5b1 100755
--- a/sdks/python/run-build
+++ b/sdks/python/run-build
@@ -16,7 +16,7 @@ fi
 rm -f "${DIR}/dropbox_sign/api/"*.py
 rm -f "${DIR}/dropbox_sign/models/"*.py
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
@@ -39,23 +39,21 @@ printf "\n"
 printf "Adding examples to Docs ...\n"
 bash "${DIR}/bin/php" ./bin/generate-examples.php
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/dropbox_sign/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/dropbox_sign"
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
diff --git a/sdks/ruby/bin/php b/sdks/ruby/bin/php
index 9aba93115..37850ffd5 100755
--- a/sdks/ruby/bin/php
+++ b/sdks/ruby/bin/php
@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/ruby"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/ruby "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"
diff --git a/sdks/ruby/bin/ruby b/sdks/ruby/bin/ruby
index 9e2e1c7bf..2503388d4 100755
--- a/sdks/ruby/bin/ruby
+++ b/sdks/ruby/bin/ruby
@@ -1,17 +1,20 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/ruby"
 
-docker run --rm \
-  -e GEM_HOME="/.gem-cache" \
-  -e BUNDLE_PATH="/.bundle-cache" \
-  -e RUBYGEMS_API_KEY=${RUBYGEMS_API_KEY-:''} \
+mkdir -p "${ROOT_DIR}/.docker/gem" "${ROOT_DIR}/.docker/bundle"
+
+exec "${DIR}/../../../bin/docker-run" \
+  -e GEM_HOME=/tmp/gem \
+  -e BUNDLE_PATH=/tmp/bundle \
+  -e HOME=/tmp/gem \
+  -e RUBYGEMS_API_KEY="${RUBYGEMS_API_KEY-:''}" \
   -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-gem-cache:/.gem-cache" \
-  -v "dropbox-sign-sdk-bundle-cache:/.bundle-cache" \
+  -v "${ROOT_DIR}/.docker/gem:/tmp/gem" \
+  -v "${ROOT_DIR}/.docker/bundle:/tmp/bundle" \
   -w "${WORKING_DIR}" \
   ruby:3.1 "$@"
diff --git a/sdks/ruby/run-build b/sdks/ruby/run-build
index cecea48f1..2e64adb97 100755
--- a/sdks/ruby/run-build
+++ b/sdks/ruby/run-build
@@ -16,7 +16,7 @@ fi
 rm -f "${DIR}/lib/dropbox-sign/api/"*.rb
 rm -f "${DIR}/lib/dropbox-sign/models/"*.rb
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
@@ -39,25 +39,23 @@ printf "Adding examples to Docs ...\n"
 bash "${DIR}/bin/php" ./bin/generate-examples.php
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/lib/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/lib"
 
 printf "Running tests ...\n"
 bash "${DIR}/bin/ruby" bundle exec rspec