diff --git a/Dockerfile b/Dockerfile
index e1078a6..71ff5ec 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ ARG UBUNTU_VERSION=26.04
 FROM ubuntu:${UBUNTU_VERSION}
 
 ARG NODE_VERSION=24.21.0
-ARG OPENCODE_VERSION=2.0.3
+ARG OPENCODE_VERSION=2.0.22
 
 ARG EXTRA_APT_PACKAGES=""
 
diff --git a/README.md b/README.md
index ff1d258..2702fa1 100644
--- a/README.md
+++ b/README.md
@@ -17,9 +17,9 @@ The host project directory and selected development caches/configuration directo
 ## Files
 
 * `Dockerfile` — builds the development image.
-* `build.sh` — builds or updates the image.
-* `dev.sh` — starts the development container.
-* `entrypoint.sh` — initializes the runtime environment.
+* `build.sh` — builds, updates, removes, or prunes the image.
+* `run.sh` — starts the development container.
+* `certs/README.md` — rules for custom CA certificates.
 
 ## Build the image
 
@@ -49,12 +49,37 @@ The build uses the current host UID and GID for the `dev` user, so files created
 ./build.sh --update
 ```
 
+This is equivalent to `--no-cache --pull=newer`, so the Ubuntu base image is refreshed and every package layer is reinstalled.
+
 ### Show the build command without running it
 
 ```bash
 ./build.sh --dry-run
 ```
 
+### Remove or prune images
+
+```bash
+./build.sh --remove   # delete the development image
+./build.sh --prune    # delete dangling images left by previous builds
+```
+
+Both options exit immediately without building, and can be combined.
+
+### Install extra system packages
+
+```bash
+./build.sh --apt-packages="libpq-dev postgresql-client"
+```
+
+The list is forwarded to the image build as `EXTRA_APT_PACKAGES` and installed with `apt-get install --no-install-recommends`.
+
+### Show usage
+
+```bash
+./build.sh --help
+```
+
 ## Build arguments
 
 The following environment variables can be used to customize the image:
@@ -62,21 +87,28 @@ The following environment variables can be used to customize the image:
 ```bash
 UBUNTU_VERSION=26.04
 NODE_VERSION=24.21.0
-OPENCODE_VERSION=2.0.3
+OPENCODE_VERSION=2.0.22
 IMAGE_REPO=localhost/opencode-dev
 ```
 
 For example:
 
 ```bash
-NODE_VERSION=24.21.0 OPENCODE_VERSION=2.0.3 ./build.sh --no-cache
+NODE_VERSION=24.21.0 OPENCODE_VERSION=2.0.22 ./build.sh --no-cache
 ```
 
+`build.sh` passes the versions above to `podman build` as `--build-arg`. The same values are declared as `ARG` defaults at the top of the `Dockerfile`, so keep both in sync when changing a version.
+
+Two more build arguments are set automatically:
+
+* `DEV_UID` / `DEV_GID` — taken from `id -u` / `id -g` on the host.
+* `EXTRA_APT_PACKAGES` — taken from the `--apt-packages` option.
+
 ## Custom CA certificates
 
 Custom CA certificates must be placed in the repository `certs/` directory before building the image. See [`certs/README.md`](certs/README.md) for accepted formats and rules.
 
-This directory is kept in git through a placeholder file, so a fresh clone builds without creating it first.
+Git cannot track empty directories, so `certs/README.md` itself is the placeholder that keeps `certs/` present in a fresh clone, and the build does not fail on a missing directory. That placeholder is listed in `.dockerignore`, so only real certificate files are copied into the image.
 
 The Dockerfile copies this directory to:
 
@@ -105,7 +137,7 @@ This allows both system tools and Node.js applications to trust the additional c
 Run:
 
 ```bash
-./dev.sh
+./run.sh
 ```
 
 By default, the host directory is:
@@ -120,21 +152,9 @@ and projects are stored in:
 $HOME/opencode-dev/projects
 ```
 
-The container starts in `/workspace`.
+`run.sh` creates every directory it mounts, so it can be run on a clean checkout. If the image does not exist yet, the script exits with an error asking you to build it first.
 
-To start in a specific project:
-
-```bash
-./dev.sh my-project
-```
-
-or:
-
-```bash
-./dev.sh /path/to/opencode-dev/projects/my-project
-```
-
-Absolute paths outside the projects directory are not accepted as the initial working directory.
+The container starts in `/workspace`, which is the mounted `projects/` directory. Open the project you want to work on inside the shell, or mount additional host directories with `--mount`.
 
 ## Mounted directories
 
@@ -149,10 +169,9 @@ The following host directories are mounted into the container:
 | `m2/`              | `/home/dev/.m2`                   | Maven cache                      |
 | `npm-cache/`       | `/home/dev/.npm`                  | npm cache                        |
 | `pip-cache/`       | `/home/dev/.cache/pip`            | pip cache                        |
-| `bash/`            | `/host-bash`                      | Host-provided Bash configuration |
 | `$HOME/.gitconfig` | `/home/dev/.gitconfig`            | Git configuration                |
 
-All standard development directories are created automatically by `dev.sh`.
+All mounted development directories are created automatically by `run.sh`.
 
 ## Additional mounts
 
@@ -161,23 +180,25 @@ Additional host directories can be mounted with `--mount`.
 Example:
 
 ```bash
-./dev.sh my-project --mount "$HOME/other:/extra"
+./run.sh --mount "$HOME/other:/extra"
 ```
 
 Read-only mounts are also supported:
 
 ```bash
-./dev.sh my-project --mount "$HOME/data:/data:ro"
+./run.sh --mount "$HOME/data:/data:ro"
 ```
 
 Multiple mounts can be specified:
 
 ```bash
-./dev.sh my-project \
+./run.sh \
   --mount "$HOME/data:/data:ro" \
   --mount "$HOME/tools:/tools:rw"
 ```
 
+`--mount` is the only option accepted by `run.sh`; any other argument stops the script with an error.
+
 ## Environment variables
 
 The main runtime paths can be customized:
@@ -191,14 +212,15 @@ OPENCODE_CACHE
 M2_FOLDER
 NPM_CACHE
 PIP_CACHE
-BASH_FOLDER
 IMAGE_REPO
 ```
 
+`IMAGE_REPO` is read by both scripts, so it selects the same image for `build.sh` and `run.sh`.
+
 Example:
 
 ```bash
-OPENCODE_DEV_HOME="$HOME/my-opencode" ./dev.sh
+OPENCODE_DEV_HOME="$HOME/my-opencode" ./run.sh
 ```
 
 ## Git configuration
@@ -211,38 +233,35 @@ $HOME/.gitconfig -> /home/dev/.gitconfig
 
 If the file does not exist, the script prints a warning and Git uses the container defaults.
 
-SSH configuration and SSH agent forwarding are currently disabled in the script. They can be enabled by uncommenting the corresponding sections in `dev.sh`.
+SSH configuration and SSH agent forwarding are not mounted. If they are needed, pass them explicitly:
+
+```bash
+./run.sh --mount "$HOME/.ssh:/home/dev/.ssh:ro"
+```
 
 ## Security
 
 The container runs with several restrictions:
 
-* Runs as the `dev` user.
-* Uses the host UID/GID.
-* Drops all Linux capabilities.
+* Runs as the `dev` user with host UID/GID (`--user dev --userns=keep-id`).
+* Drops all Linux capabilities (`--cap-drop=ALL`).
 * Uses `no-new-privileges`.
-* Uses a temporary container (`--rm`).
+* Uses the host timezone (`--tz=local`).
+* Uses a temporary, named container (`--name opencode-dev --rm`).
 * Does not run as root.
 * Uses the default Podman network.
 
-The project directory is mounted read/write because the AI agent needs to create and modify source files.
+The project directory is mounted read/write because the AI agent needs to create and modify source files. The host Git configuration is mounted read-only.
 
 ## Locale
 
-The host locale is passed to the container through:
+The image generates the `en_US.UTF-8` locale during the build:
 
-```text
-HOST_LANG
-HOST_LC_ALL
+```dockerfile
+echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen && locale-gen
 ```
 
-The entrypoint generates the requested UTF-8 locale when necessary.
-
-For example, the host locale is automatically passed when running:
-
-```bash
-./dev.sh
-```
+The host timezone is applied at runtime through `--tz=local`. The host `LANG`/`LC_ALL` values are not forwarded; export them inside the container if a different locale is needed.
 
 ## Typical workflow
 
@@ -255,22 +274,16 @@ Build the image:
 Start the development environment:
 
 ```bash
-./dev.sh
+./run.sh
 ```
 
-Or start directly in a project:
-
-```bash
-./dev.sh my-project
-```
-
-Inside the container, the project is available under:
+Inside the container, the projects directory is available under:
 
 ```bash
 /workspace
 ```
 
-OpenCode can then be started normally:
+Move into the project you want to work on, then start OpenCode normally:
 
 ```bash
 opencode
@@ -280,14 +293,14 @@ The container is removed when the shell exits, while source code, OpenCode data,
 
 ## Customization
 
-Most image versions are defined at the top of the `Dockerfile`:
+Image versions are defined at the top of the `Dockerfile`:
 
 ```dockerfile
 ARG UBUNTU_VERSION=26.04
 ARG NODE_VERSION=24.21.0
-ARG OPENCODE_VERSION=2.0.3
+ARG OPENCODE_VERSION=2.0.22
 ```
 
-Runtime paths and container options are defined in `dev.sh`.
+Runtime paths, mounts, and container options are defined in `run.sh`, while `build.sh` controls how the image is built and maintained.
 
 This separation allows the image to contain the stable development environment while projects, configuration, caches, and other working data remain outside the container.
diff --git a/certs/README.md b/certs/README.md
index 2aadefb..a853af0 100644
--- a/certs/README.md
+++ b/certs/README.md
@@ -5,7 +5,6 @@ in this directory, as PEM files with a `.crt` or `.pem` extension:
 
 ```text
 certs/
-├── .gitignore
 ├── README.md
 ├── company-root.crt
 └── company-intermediate.crt
diff --git a/run.sh b/run.sh
index 066f901..0e94781 100755
--- a/run.sh
+++ b/run.sh
@@ -56,7 +56,7 @@ else
 fi
 
 # Additional bind mounts:
-# ./dev.sh --mount "$HOME/other:/extra"
+# ./run.sh --mount "$HOME/other:/extra"
 while (($#)); do
   case "$1" in
     --mount)