diff --git a/Dockerfile.base b/Dockerfile.base
index 1b471c1..bba3987 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -211,14 +211,29 @@ RUN pip-env.sh pip list --format freeze \
 RUN libpython="${PYTHON_SITE_PACKAGES%/*}" ; \
     rm -rfv \
       /usr/local/bin/idle* \
+      /usr/local/bin/pydoc* \
       "${libpython}/ensurepip/_bundled" \
       "${libpython}/idlelib" \
+      "${libpython}/pydoc.py" \
+      "${libpython}/pydoc_data" \
       "${libpython}/tkinter" \
       "${libpython}/turtle.py" \
       "${libpython}/turtledemo" \
     ; \
+    rm -rfv \
+      "${PYTHON_SITE_PACKAGES}/pkg_resources/tests" \
+      "${PYTHON_SITE_PACKAGES}/setuptools/tests" \
+      "${PYTHON_SITE_PACKAGES}/setuptools/_distutils/tests" \
+      "${PYTHON_SITE_PACKAGES}/setuptools/_vendor/importlib_resources/tests" \
+    ; \
+    find "${PYTHON_SITE_PACKAGES}/" -iname '*.exe' -ls -delete ; \
     python-rm-cache.sh /usr/local
 
+## adjust pip/certifi
+RUN certifi_pem="${PYTHON_SITE_PACKAGES}/pip/_vendor/certifi/cacert.pem" ; \
+    rm -f "${certifi_pem}" ; \
+    ln -s /etc/ssl/certs/ca-certificates.crt "${certifi_pem}"
+
 RUN find /usr/local/sbin/ ! -type d -ls -delete ; \
     find /run/ -mindepth 1 -ls -delete || : ; \
     install -d -m 01777 /run/lock
diff --git a/Dockerfile.deps b/Dockerfile.deps
index 72db77f..0c6fbef 100644
--- a/Dockerfile.deps
+++ b/Dockerfile.deps
@@ -41,12 +41,19 @@ RUN w=$(mktemp -d) ; : "${w:?}" ; \
     echo ; \
     find "${PYTHON_SITE_PACKAGES}/" -type f -name '*.so*' -printf '%p\0' \
     | sed -zE '/rust/d' \
-    | xargs -0r strip --verbose --strip-debug ; \
+    | xargs -0r strip --verbose --strip-debug --strip-unneeded ; \
     echo ; \
     find "${PYTHON_SITE_PACKAGES}/" -type f -name '*.so*' -exec ls -l {} + ; \
     apt-remove.sh build-essential ; \
     apt-clean.sh
 
+## avoid changing already present packages
+RUN find "${PYTHON_SITE_PACKAGES}/" -mindepth 1 -maxdepth 1 -printf '%P\0' \
+    | sed -zEn \
+      -e '/^((pip|setuptools|wheel)-.+\.dist-info|distutils-precedence\.pth|_distutils_hack|pip|pkg_resources|setuptools|wheel)$/p' \
+    | env -C "${PYTHON_SITE_PACKAGES}" xargs -0r \
+      rm -rf
+
 ## ---
 
 FROM base AS deps