diff --git a/buildenv/Dockerfile b/buildenv/Dockerfile
index 20c0458..1d6d1fa 100644
--- a/buildenv/Dockerfile
+++ b/buildenv/Dockerfile
@@ -8,7 +8,14 @@ RUN mkdir /buildenv
 
 WORKDIR /buildenv
 
-RUN curl -JO 'https://developer.apple.com/file/?file=security&agree=Yes' -H 'Referer: https://developer.apple.com/security/' && unzip corecrypto.zip
+RUN curl -JO 'https://developer.apple.com/file/?file=security&agree=Yes' -H 'Referer: https://developer.apple.com/security/' && unzip corecrypto.zip && rm -rf __MACOSX && (test -d corecrypto || mv corecrypto-*/ corecrypto)
+# Apple's zip references scripts/code-coverage.cmake but doesn't ship it - it's an
+# external helper from https://github.com/StableCoder/cmake-scripts that CMakeLists.txt
+# assumes is present (normally added via a submodule/build step not included in the zip).
+RUN mkdir -p /buildenv/corecrypto/scripts && curl -sL -o /buildenv/corecrypto/scripts/code-coverage.cmake "https://raw.githubusercontent.com/StableCoder/cmake-scripts/main/code-coverage.cmake"
+# CoreCryptoSources.cmake references "corecrypto_static/ccrng_static.c" but the public zip
+# ships the file flat at the top level - symlink it into place under the expected path.
+RUN mkdir -p /buildenv/corecrypto/corecrypto_static && ln -s ../ccrng_static.c /buildenv/corecrypto/corecrypto_static/ccrng_static.c
 WORKDIR /buildenv/corecrypto
 RUN mkdir build; cd build; CC=clang CXX=clang++ cmake ..;
 WORKDIR /buildenv/corecrypto/build