diff --git a/docker/build_scripts/finalize-one.sh b/docker/build_scripts/finalize-one.sh
index f4dad651..02b9b10a 100755
--- a/docker/build_scripts/finalize-one.sh
+++ b/docker/build_scripts/finalize-one.sh
@@ -17,6 +17,11 @@ PY_VER=$(${PREFIX}/bin/python -c "import sys; print('.'.join(str(v) for v in sys
 PY_IMPL=$(${PREFIX}/bin/python -c "import sys; print(sys.implementation.name)")
 PY_GIL=$(${PREFIX}/bin/python -c "import sysconfig; print('t' if sysconfig.get_config_vars().get('Py_GIL_DISABLED', 0) else '')")
 
+# disable some pip warnings
+export PIP_ROOT_USER_ACTION=ignore
+export PIP_DISABLE_PIP_VERSION_CHECK=1
+export PIP_NO_WARN_SCRIPT_LOCATION=0
+
 # Install pinned packages for this python version.
 # Use the already intsalled cpython pip to bootstrap pip if available
 if [ -f /usr/local/bin/python${PY_VER} ]; then
diff --git a/docker/build_scripts/finalize.sh b/docker/build_scripts/finalize.sh
index 1ba737a9..df050989 100755
--- a/docker/build_scripts/finalize.sh
+++ b/docker/build_scripts/finalize.sh
@@ -16,6 +16,13 @@ XZ_OPT=-9e tar -cJf static-libs-for-embedding-only.tar.xz cpython-*/lib/libpytho
 popd
 find /opt/_internal -name '*.a' -print0 | xargs -0 rm -f
 
+# disable some pip warnings
+export PIP_ROOT_USER_ACTION=ignore
+export PIP_DISABLE_PIP_VERSION_CHECK=1
+export PIP_NO_WARN_SCRIPT_LOCATION=0
+# all cache goes to /tmp
+export PIP_CACHE_DIR=/tmp/pip_cache
+
 # update package, create symlinks for each python
 mkdir /opt/python
 for PREFIX in $(find /opt/_internal/ -mindepth 1 -maxdepth 1 \( -name 'cpython*' -o -name 'pypy*' \)); do
@@ -51,6 +58,7 @@ set -euo pipefail
 if [ \$(id -u) -eq 0 ]; then
 	export PIPX_HOME=/opt/_internal/pipx
 	export PIPX_BIN_DIR=/usr/local/bin
+	export PIPX_MAN_DIR=/usr/local/share/man
 fi
 ${TOOLS_PATH}/bin/pipx "\$@"
 EOF
@@ -64,19 +72,20 @@ ln -s $(${TOOLS_PATH}/bin/python -c 'import certifi; print(certifi.where())') /o
 # If you modify this line you also have to modify the versions in the Dockerfiles:
 export SSL_CERT_FILE=/opt/_internal/certs.pem
 
+# initialize shared library, pip is not pinned in pipx
+pipx install pip
+pipx uninstall pip
+
 # install other tools with pipx
-pushd $MY_DIR/requirements-tools
-for TOOL_PATH in $(find . -type f); do
+for TOOL_PATH in $(find ${MY_DIR}/requirements-tools -type f); do
 	TOOL=$(basename ${TOOL_PATH})
-	pipx install --pip-args="--require-hashes -r" ${TOOL}
+	pipx install --pip-args="--require-hashes -r ${TOOL_PATH} --only-binary" ${TOOL}
 done
-popd
 
 # We do not need the precompiled .pyc and .pyo files.
 clean_pyc /opt/_internal
 
 # remove cache
-rm -rf /root/.cache
 rm -rf /tmp/* || true
 
 hardlink -cv /opt/_internal
diff --git a/docker/build_scripts/requirements-base-tools.txt b/docker/build_scripts/requirements-base-tools.txt
index 2faabb7e..a8fd246d 100644
--- a/docker/build_scripts/requirements-base-tools.txt
+++ b/docker/build_scripts/requirements-base-tools.txt
@@ -15,9 +15,9 @@ packaging==24.0 \
     --hash=sha256:2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5 \
     --hash=sha256:eb82c5e3e56209074766e6885bb04b8c38a0c015d0a30036ebe7ece34c9989e9
     # via pipx
-pipx==1.4.3 \
-    --hash=sha256:aa25c7a7d455daed7597bb88c259389176680e2e7446fbdb6e6696cdd3a5090b \
-    --hash=sha256:d214512bccc601b575de096ee84fde8797323717a20752c48f7a55cc1bf062fe
+pipx==1.5.0 \
+    --hash=sha256:2371af2b772954cdb5c1dbfa0170219e3d2c09d9ff9b18e975f65562eeb7ab0a \
+    --hash=sha256:801a55a9d58004bb18a464f668508e79fbffc22deb6f07982832d3ce3ff3756d
 platformdirs==4.2.1 \
     --hash=sha256:031cd18d4ec63ec53e82dceaac0417d218a6863f7745dfcc9efe7793b7039bdf \
     --hash=sha256:17d5a1161b3fd67b390023cb2d3b026bbd40abde6fdb052dfbd3a29c3ba22ee1
diff --git a/requirements-base-tools.in b/requirements-base-tools.in
index 97c6351d..569cc4c7 100644
--- a/requirements-base-tools.in
+++ b/requirements-base-tools.in
@@ -1,2 +1,2 @@
 certifi
-pipx<1.5.0
+pipx