diff --git a/.gitpod.yml b/.gitpod.yml
index d3b0d9a..9907f3b 100644
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -5,6 +5,7 @@ tasks:
   - init: |
       .gitpod/scripts/ddev-download-images.sh
       .gitpod/scripts/ddev-setup.sh
+      .gitpod/scripts/composer-setup.sh
       ddev drupal-install
     command: |
       .gitpod/scripts/ddev-setup.sh
diff --git a/.gitpod/Dockerfile b/.gitpod/Dockerfile
index 374de91..ededbfc 100644
--- a/.gitpod/Dockerfile
+++ b/.gitpod/Dockerfile
@@ -6,8 +6,3 @@ RUN sudo apt-get -qq update
 # Install ddev
 RUN brew update && brew install drud/ddev/ddev
 
-# Install latest composer
-RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
-RUN php -r "if (hash_file('sha384', 'composer-setup.php') === '906a84df04cea2aa72f40b5f787e49f22d4c2f19492ac310e8cba5b96ac8b64115ac402c8cd292b8a03482574915d1a8') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
-RUN sudo php composer-setup.php --install-dir /usr/bin --filename composer
-RUN php -r "unlink('composer-setup.php');"
diff --git a/.gitpod/scripts/composer-setup.sh b/.gitpod/scripts/composer-setup.sh
new file mode 100755
index 0000000..2a26fa0
--- /dev/null
+++ b/.gitpod/scripts/composer-setup.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+# This is the recommended way to automate Composer installation.
+# See: https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md
+
+EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
+php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
+ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
+
+if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
+then
+    >&2 echo 'ERROR: Invalid installer checksum'
+    rm composer-setup.php
+    exit 1
+fi
+
+php composer-setup.php --quiet
+RESULT=$?
+rm composer-setup.php
+exit $RESULT