diff --git a/support/deployment/Dockerfile b/support/deployment/Dockerfile
index 4d64d54c..6ec78e40 100644
--- a/support/deployment/Dockerfile
+++ b/support/deployment/Dockerfile
@@ -9,7 +9,7 @@
 # correct versions inserted into it.  See the documentation for further
 # details on how this deployment mechanism works.
 
-FROM ubuntu:18.04
+FROM docker.io/ubuntu:20.04
 
 # These environment variables will be set using the release script.  It will
 # copy the correct values from the poms into these variables so that the right
@@ -48,15 +48,16 @@ ADD ${HVIF2PNG_VERSION}.tgz ${INSTALL_ROOT}
 ADD ${PG_DOWNLOAD_URL} ${INSTALL_ROOT}/${PG_JAR}
 ADD ${HDS_WAR_DOWNLOAD_URL} ${INSTALL_ROOT}/${HDS_WAR}
 
-RUN echo "HDS_ROOT=${INSTALL_ROOT}" > ${INSTALL_ROOT}/launchenv.sh
-RUN echo "JAVA_BIN=${JAVA_BIN}" >> ${INSTALL_ROOT}/launchenv.sh
-RUN echo "HDS_HVIF2PNG_PATH=${INSTALL_HVIF2PNG_PATH}" >> ${INSTALL_ROOT}/launchenv.sh
-RUN echo "HDS_PORT=${HDS_PORT}" >> ${INSTALL_ROOT}/launchenv.sh
-RUN echo "HDS_WAR=${HDS_WAR}" >> ${INSTALL_ROOT}/launchenv.sh
-RUN echo "JETTY_JAR=${JETTY_JAR}" >> ${INSTALL_ROOT}/launchenv.sh
-RUN echo "PG_JAR=${PG_JAR}" >> ${INSTALL_ROOT}/launchenv.sh
+RUN chmod 755 ${INSTALL_ROOT}/launch.sh && \
+	echo "HDS_ROOT=${INSTALL_ROOT}" > ${INSTALL_ROOT}/launchenv.sh && \
+	echo "JAVA_BIN=${JAVA_BIN}" >> ${INSTALL_ROOT}/launchenv.sh && \
+	echo "HDS_HVIF2PNG_PATH=${INSTALL_HVIF2PNG_PATH}" >> ${INSTALL_ROOT}/launchenv.sh && \
+	echo "HDS_PORT=${HDS_PORT}" >> ${INSTALL_ROOT}/launchenv.sh && \
+	echo "HDS_WAR=${HDS_WAR}" >> ${INSTALL_ROOT}/launchenv.sh && \
+	echo "JETTY_JAR=${JETTY_JAR}" >> ${INSTALL_ROOT}/launchenv.sh && \
+	echo "PG_JAR=${PG_JAR}" >> ${INSTALL_ROOT}/launchenv.sh
 
-CMD [ "sh", "/opt/haikudepotserver/launch.sh" ]
+CMD [ "/opt/haikudepotserver/launch.sh" ]
 
 HEALTHCHECK --interval=30s --timeout=10s CMD curl -f http://localhost:8080/__metric/healthcheck
 EXPOSE ${HDS_PORT}
diff --git a/support/deployment/launch.sh b/support/deployment/launch.sh
index b025607e..c8e63939 100644
--- a/support/deployment/launch.sh
+++ b/support/deployment/launch.sh
@@ -1,7 +1,13 @@
-# launch file for the haikudepotserver system.
+#!/bin/bash
 
+# launch file for the haikudepotserver system.
 . "$(dirname $0)/launchenv.sh"
-. "/secrets/hds_secrets"
+
+# source secrets file if provided, otherwise from env
+if [ -f "/secrets/hds_secrets" ]; then
+	echo "Sourcing secrets from /secrets/hds_secrets..."
+	. "/secrets/hds_secrets"
+fi
 
 "${JAVA_BIN}" \
 "-Dfile.encoding=UTF-8" \