diff --git a/metadata_test.go b/metadata_test.go
index 3ed7c660..e310b5f4 100644
--- a/metadata_test.go
+++ b/metadata_test.go
@@ -212,7 +212,7 @@ func testMetadata(t *testing.T, context spec.G, it spec.S) {
 
 			Expect(image).To(SatisfyAll(
 				HaveFileWithContent("/etc/group", ContainSubstring("cnb:x:1000:")),
-				HaveFileWithContent("/etc/passwd", ContainSubstring("cnb:x:1002:1000::/home/cnb:/sbin/nologin")),
+				HaveFileWithContent("/etc/passwd", ContainSubstring("cnb:x:1002:1000::/home/cnb:/bin/sh")),
 				HaveDirectory("/home/cnb"),
 			))
 
@@ -253,6 +253,22 @@ func testMetadata(t *testing.T, context spec.G, it spec.S) {
 
 			Expect(image).To(HaveFile("/var/lib/dpkg/status.d/ca-certificates.md5sums"))
 
+			Expect(image).To(HaveFileWithContent("/var/lib/dpkg/status.d/dash", SatisfyAll(
+				ContainSubstring("Package: dash"),
+				MatchRegexp("Version: [a-z0-9\\.\\-\\+]+"),
+				SatisfyAny(
+					ContainSubstring("Architecture: amd64"),
+					ContainSubstring("Architecture: arm64"),
+					ContainSubstring("Architecture: s390x"),
+					ContainSubstring("Architecture: ppc64le")),
+			)))
+
+			Expect(image).To(HaveFileWithContent("/var/lib/dpkg/info/dash.list", SatisfyAll(
+				ContainSubstring("/."),
+			)))
+
+			Expect(image).To(HaveFile("/var/lib/dpkg/status.d/dash.md5sums"))
+
 			Expect(image).To(HaveFileWithContent("/var/lib/dpkg/status.d/libc6", SatisfyAll(
 				ContainSubstring("Package: libc6"),
 				MatchRegexp("Version: [0-9\\.\\-]+ubuntu[0-9\\.]+"),
diff --git a/stack/stack.toml b/stack/stack.toml
index c534c9d9..1168f885 100644
--- a/stack/stack.toml
+++ b/stack/stack.toml
@@ -69,7 +69,7 @@ platforms = ["linux/amd64", "linux/arm64", "linux/s390x", "linux/ppc64le"]
   description = "distroless-like jammy"
   dockerfile = "./run/run.Dockerfile"
   gid = 1000
-  shell = "/sbin/nologin"
+  shell = "/bin/sh"
   uid = 1002
 
   [run.args]
@@ -78,6 +78,7 @@ platforms = ["linux/amd64", "linux/arm64", "linux/s390x", "linux/ppc64le"]
     packages = """\
     base-files \
     ca-certificates \
+    dash \
     libc6 \
     libssl3 \
     netbase \