diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 81b747b..1b25999 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -52,6 +52,26 @@ jobs:
           echo "Index size: $size bytes"
           [ "$size" -ge 102400 ] || { echo "FAIL: index too small"; exit 1; }
 
+      # Callers that run commands through /bin/sh and still pass the `index`
+      # argument accepted by releases up to v0.0.5.
+      - name: Index target via /bin/sh and `scip-rust index`
+        run: |
+          rm target/index.scip
+          docker run --rm --entrypoint /bin/sh -v "$PWD/target:/work" \
+            scip-rust:latest -c 'scip-rust index'
+
+      - name: Check index size
+        run: |
+          size=$(stat --format='%s' target/index.scip)
+          echo "Index size: $size bytes"
+          [ "$size" -ge 102400 ] || { echo "FAIL: index too small"; exit 1; }
+
+      # BusyBox wget and ssl_client do not verify TLS certificates.
+      - name: Check the image has no BusyBox TLS clients
+        run: |
+          docker run --rm --entrypoint /bin/sh scip-rust:latest \
+            -c '! command -v wget && ! command -v ssl_client'
+
   index:
     strategy:
       fail-fast: false
diff --git a/flake.nix b/flake.nix
index ba2fe1c..ecac3e8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,6 +23,29 @@
           };
           text = builtins.readFile ./scip-rust;
         };
+        # Distrust the roots behind the compromised eMudhra intermediate CAs
+        # (https://emudhra.we-have-a-problem.com/). The pinned cacert (3.123)
+        # already distrusts Comodo AAA Services root for TLS; it is listed as
+        # defence in depth. cacert 3.131.1 drops emSign ECC Root CA - G3, so
+        # this override fails the build after a nixpkgs bump to it; remove it
+        # then.
+        dockerTools = pkgs.dockerTools.override {
+          cacert = pkgs.cacert.override {
+            blacklist = [
+              "Comodo AAA Services root"
+              "emSign ECC Root CA - G3"
+            ];
+          };
+        };
+        # Provides /bin/sh for callers that run commands in the container
+        # through a shell. wget and ssl_client are left out: BusyBox does
+        # not verify TLS certificates.
+        busybox = pkgs.busybox.override {
+          extraConfig = ''
+            CONFIG_WGET n
+            CONFIG_SSL_CLIENT n
+          '';
+        };
       in
       {
         packages = {
@@ -30,12 +53,13 @@
           default = scip-rust;
         }
         // pkgs.lib.optionalAttrs pkgs.stdenv.isLinux {
-          docker = pkgs.dockerTools.buildLayeredImage {
+          docker = dockerTools.buildLayeredImage {
             name = "scip-rust";
             tag = "latest";
             contents = [
               scip-rust
-              pkgs.dockerTools.caCertificates
+              busybox
+              dockerTools.caCertificates
               pkgs.git
             ];
             fakeRootCommands = "mkdir -p /work /tmp";
diff --git a/scip-rust b/scip-rust
index b213f50..1394f85 100755
--- a/scip-rust
+++ b/scip-rust
@@ -22,6 +22,14 @@ for tool in cargo rust-analyzer rustc; do
     fi
 done
 
+# Drop a leading `index` argument. Releases up to v0.0.5 ignored their
+# arguments, and existing callers (such as auto-indexing jobs) still run
+# `scip-rust index`; without this, rust-analyzer would treat `index` as the
+# project path. To index a directory named `index`, pass `./index`.
+if [ "${1:-}" = "index" ]; then
+    shift
+fi
+
 # Forward any extra args (e.g. `--output PATH`) to rust-analyzer; default
 # to indexing the current directory if no path is given.
 if [ $# -eq 0 ]; then