diff --git a/Dockerfile b/Dockerfile
index a773e1a..ec74770 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,7 @@ FROM ${BASE_IMAGE} AS build
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=UTC
 ARG PHP_VER=8.2
-ARG SQLCIPHER_VERSION=4.17.0
+ARG SQLCIPHER_VERSION=4.16.0
 ARG BUILD_ID=
 
 ENV TZ=${TZ} PHP_VER=${PHP_VER} SQLCIPHER_VERSION=${SQLCIPHER_VERSION} BUILD_ID=${BUILD_ID}
diff --git a/scripts/setup-php-sources.sh b/scripts/setup-php-sources.sh
index 7a9e794..b670df6 100755
--- a/scripts/setup-php-sources.sh
+++ b/scripts/setup-php-sources.sh
@@ -3,17 +3,30 @@
 set -euo pipefail
 
 . /etc/os-release
-curl -fsSL -o /tmp/debsuryorg-archive-keyring.deb \
-https://packages.sury.org/debsuryorg-archive-keyring.deb
-# SHA256SUM matches what https://mirrors.dotsrc.org/deb.sury.org/bind-dev/dists/bullseye/main/binary-amd64/Packages shows
-echo "7511384559c9ddf1d5ce5f60be429ae9d4e7d01d9480d6f1b7a30c0810cf8b60 /tmp/debsuryorg-archive-keyring.deb" | sha256sum -c -
-dpkg -i /tmp/debsuryorg-archive-keyring.deb
+case "${ID}" in
+  ubuntu)
+    apt-get update
+    apt-get install -y --no-install-recommends software-properties-common
+    # Adds both deb and deb-src for Ondřej’s PPA
+    add-apt-repository -y -s ppa:ondrej/php
+    ;;
+  debian)
+    # Official way per deb.sury.org README
+    curl -fsSL -o /tmp/debsuryorg-archive-keyring.deb \
+      https://packages.sury.org/debsuryorg-archive-keyring.deb
+    # SHA256SUM matches what https://mirrors.dotsrc.org/deb.sury.org/bind-dev/dists/bullseye/main/binary-amd64/Packages shows
+    echo "7511384559c9ddf1d5ce5f60be429ae9d4e7d01d9480d6f1b7a30c0810cf8b60 /tmp/debsuryorg-archive-keyring.deb" | sha256sum -c -
+    dpkg -i /tmp/debsuryorg-archive-keyring.deb
 
-codename="$(lsb_release -sc)"
-cat >/etc/apt/sources.list.d/php.list <<EOF
+    codename="$(lsb_release -sc)"
+    cat >/etc/apt/sources.list.d/php.list <<EOF
 deb     [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ ${codename} main
 deb-src [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ ${codename} main
 EOF
+    ;;
+  *)
+    echo "Unsupported distro ID=${ID}" >&2; exit 2;;
+esac
 
 apt-get update;
 apt-get install -y --no-install-recommends php${PHP_VER}-dev