diff --git a/Makefile b/Makefile
index f1a0495..a03e7a1 100644
--- a/Makefile
+++ b/Makefile
@@ -28,23 +28,27 @@ ifeq ("$(IN_DOCKER)","TRUE")
 	DOCKER_INTERACTIVE_SHELL:=
 else
     ifeq ($(DOCKER_AVAILABLE),0)
-        DOCKER_COMMON_OPS:=-v "`pwd`:`pwd`" -w "`pwd`" -v "${COMPOSER_CACHE_DIR}:${COMPOSER_CONTAINER_CACHE_DIR}"  -e OTEL_PHP_FIBERS_ENABLED="${OTEL_PHP_FIBERS_ENABLED}" --ulimit nofile=1000000
+        DOCKER_DEFAULT_SECURITY_OPS=--cap-drop=ALL --security-opt="no-new-privileges=true" --user="`id -u`:`id -g`"
+        DOCKER_COMMON_OPS:=-v "`pwd`:`pwd`" -w "`pwd`" -v "`pwd`/.git:`pwd`/.git:ro" -v "${COMPOSER_CACHE_DIR}:${COMPOSER_CONTAINER_CACHE_DIR}"  -e OTEL_PHP_FIBERS_ENABLED="${OTEL_PHP_FIBERS_ENABLED}" --ulimit nofile=1000000
         ifeq ("$(NEEDS_DOCKER_SOCKET)","TRUE")
             ifneq ("$(wildcard /var/run/docker.sock)","")
+                DOCKER_SECURITY_OPS:=
                 DOCKER_SOCKET_OPS:=-v "/var/run/docker.sock:/var/run/docker.sock"
                 DOCKER_SOCKET_CONTAINER_NAME_SUFFIX:=-root
             else
+                DOCKER_SECURITY_OPS:=${DOCKER_DEFAULT_SECURITY_OPS}
                 DOCKER_SOCKET_OPS:=
                 DOCKER_SOCKET_CONTAINER_NAME_SUFFIX:=
             endif
         else
+            DOCKER_SECURITY_OPS:=${DOCKER_DEFAULT_SECURITY_OPS}
             DOCKER_SOCKET_OPS:=
             DOCKER_SOCKET_CONTAINER_NAME_SUFFIX:=
         endif
-        DOCKER_RUN:=docker run --rm -i ${DOCKER_COMMON_OPS} "${CONTAINER_NAME}"
-        DOCKER_RUN_WITH_SOCKET:=docker run --rm -i ${DOCKER_COMMON_OPS} ${DOCKER_SOCKET_OPS} "${CONTAINER_NAME}${DOCKER_SOCKET_CONTAINER_NAME_SUFFIX}"
-        DOCKER_SHELL:=docker run --rm -it ${DOCKER_COMMON_OPS} "${CONTAINER_NAME}"
-        DOCKER_INTERACTIVE_SHELL:=docker run --rm -it ${DOCKER_COMMON_OPS} "${CONTAINER_NAME_INTERACTIVE_SHELL}"
+        DOCKER_RUN:=docker run --rm -i ${DOCKER_SECURITY_OPS} ${DOCKER_COMMON_OPS} "${CONTAINER_NAME}"
+        DOCKER_RUN_WITH_SOCKET:=docker run --rm -i ${DOCKER_SECURITY_OPS} ${DOCKER_COMMON_OPS} ${DOCKER_SOCKET_OPS} "${CONTAINER_NAME}${DOCKER_SOCKET_CONTAINER_NAME_SUFFIX}"
+        DOCKER_SHELL:=docker run --rm -it ${DOCKER_SECURITY_OPS} ${DOCKER_COMMON_OPS} "${CONTAINER_NAME}"
+        DOCKER_INTERACTIVE_SHELL:=docker run --rm -it ${DOCKER_SECURITY_OPS} ${DOCKER_COMMON_OPS} "${CONTAINER_NAME_INTERACTIVE_SHELL}"
     else
         DOCKER_RUN:=
         DOCKER_RUN_WITH_SOCKET:=
@@ -408,6 +412,9 @@ install: ### Install dependencies ####
 composer-require: ### Require passed dependencies ####
 	$(DOCKER_INTERACTIVE_SHELL) composer require -W $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
 
+composer-why: ### Show why a specific dependency is loaded ####
+	$(DOCKER_INTERACTIVE_SHELL) composer why $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
+
 update: ### Update dependencies ####
 	$(DOCKER_SHELL) composer update -W
 
diff --git a/composer.json b/composer.json
index 680b2d9..7dc903d 100644
--- a/composer.json
+++ b/composer.json
@@ -20,7 +20,7 @@
   },
   "require-dev": {
     "wyrihaximus/async-test-utilities": "^13.2.0",
-    "wyrihaximus/makefiles": "^0.11.1"
+    "wyrihaximus/makefiles": "^0.12.0"
   },
   "autoload": {
     "psr-4": {
diff --git a/composer.lock b/composer.lock
index fbb2801..4931ffe 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "9c417c6b7d9bdec79ef37545e312fd50",
+    "content-hash": "1453f8457d4c08822ff11a0a028fc6ad",
     "packages": [
         {
             "name": "evenement/evenement",
@@ -9843,16 +9843,16 @@
         },
         {
             "name": "wyrihaximus/makefiles",
-            "version": "0.11.1",
+            "version": "0.12.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/WyriHaximus/Makefiles.git",
-                "reference": "3db0bb5263c42f0484b031cbe43add3755baeb4e"
+                "reference": "facf64a0f6a4192108d513e7dcf0f2772778e274"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/WyriHaximus/Makefiles/zipball/3db0bb5263c42f0484b031cbe43add3755baeb4e",
-                "reference": "3db0bb5263c42f0484b031cbe43add3755baeb4e",
+                "url": "https://api.github.com/repos/WyriHaximus/Makefiles/zipball/facf64a0f6a4192108d513e7dcf0f2772778e274",
+                "reference": "facf64a0f6a4192108d513e7dcf0f2772778e274",
                 "shasum": ""
             },
             "require": {
@@ -9864,7 +9864,7 @@
                 "infection/infection": "<0.32.0"
             },
             "require-dev": {
-                "wyrihaximus/test-utilities": "^13.1.0"
+                "wyrihaximus/test-utilities": "^13.2.0"
             },
             "type": "composer-plugin",
             "extra": {
@@ -9893,7 +9893,7 @@
             "description": "🧱 Makefile building blocks",
             "support": {
                 "issues": "https://github.com/WyriHaximus/Makefiles/issues",
-                "source": "https://github.com/WyriHaximus/Makefiles/tree/0.11.1"
+                "source": "https://github.com/WyriHaximus/Makefiles/tree/0.12.0"
             },
             "funding": [
                 {
@@ -9901,7 +9901,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-06-13T01:23:07+00:00"
+            "time": "2026-06-22T18:50:10+00:00"
         },
         {
             "name": "wyrihaximus/phpstan-no-safe",