diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 40283e9..2232f7e 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -22,7 +22,9 @@
       "--network=host"
     ],
     "remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
-  "postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {
     },
     "customizations": {
diff --git a/Makefile b/Makefile
index 40646c3..ab813ea 100644
--- a/Makefile
+++ b/Makefile
@@ -65,8 +65,12 @@ build-all: build-base-image build-node-24-image build-node-24-python-3-10-image
 	build-regression-tests-image
 
 build-image: guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
+	workspace_folder="$${CONTAINER_NAME}"; \
+	case "$${CONTAINER_NAME}" in \
+		eps_*) workspace_folder="$$(printf '%s' "$${CONTAINER_NAME}" | tr '_' '-')" ;; \
+	esac; \
 	npx devcontainer build \
-		--workspace-folder ./src/$${BASE_FOLDER}/$${CONTAINER_NAME} \
+		--workspace-folder ./src/$${BASE_FOLDER}/$${workspace_folder} \
 		$(NO_CACHE_FLAG) \
 		--push false \
 		--output type=image,name="${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}",push=false,compression=zstd \
diff --git a/src/base/.devcontainer/Dockerfile b/src/base/.devcontainer/Dockerfile
index 8b1f4fd..de08e1e 100644
--- a/src/base/.devcontainer/Dockerfile
+++ b/src/base/.devcontainer/Dockerfile
@@ -21,6 +21,7 @@ ENV CONTAINER_NAME=${CONTAINER_NAME}
 ENV TARGETARCH=${TARGETARCH}
 
 COPY .tool-versions.asdf ${SCRIPTS_DIR}/${CONTAINER_NAME}/.tool-versions.asdf
+COPY --chmod=755 scripts/lifecycle/*.sh ${SCRIPTS_DIR}/
 COPY --chmod=755 scripts/root_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/root_install.sh
 COPY --chmod=755 Mk ${SCRIPTS_DIR}/Mk
 
diff --git a/src/base/.devcontainer/devcontainer.json b/src/base/.devcontainer/devcontainer.json
index 7e75348..9b8e753 100644
--- a/src/base/.devcontainer/devcontainer.json
+++ b/src/base/.devcontainer/devcontainer.json
@@ -12,6 +12,9 @@
         "IMAGE_TAG": "${localEnv:IMAGE_TAG}"
       }
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {
       "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
         "version": "latest",
diff --git a/src/base/.devcontainer/scripts/lifecycle/post_attach.sh b/src/base/.devcontainer/scripts/lifecycle/post_attach.sh
new file mode 100755
index 0000000..6fe214c
--- /dev/null
+++ b/src/base/.devcontainer/scripts/lifecycle/post_attach.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Script to run as devcontainer postAttachCommand
+set -euo pipefail
+
+# currently empty
diff --git a/src/base/.devcontainer/scripts/lifecycle/post_create.sh b/src/base/.devcontainer/scripts/lifecycle/post_create.sh
new file mode 100755
index 0000000..13c7512
--- /dev/null
+++ b/src/base/.devcontainer/scripts/lifecycle/post_create.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Script to run as devcontainer postCreateCommand
+set -euo pipefail
+
+# Install git-secrets, register AWS patterns and NHS rules in an idempotent way
+if ! git config --get-all secrets.patterns | grep -Fq AKIA; then
+  git-secrets --register-aws
+fi
+if ! git config --get-all secrets.providers | grep -Fxq "cat /usr/share/secrets-scanner/nhsd-rules-deny.txt"; then
+  git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt
+fi
diff --git a/src/base/.devcontainer/scripts/lifecycle/post_start.sh b/src/base/.devcontainer/scripts/lifecycle/post_start.sh
new file mode 100755
index 0000000..63dbbc0
--- /dev/null
+++ b/src/base/.devcontainer/scripts/lifecycle/post_start.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Script to run as devcontainer postStartCommand
+set -euo pipefail
+
+# currently empty
diff --git a/src/base_node/node_24/.devcontainer/devcontainer.json b/src/base_node/node_24/.devcontainer/devcontainer.json
index 90d861a..c14ec52 100644
--- a/src/base_node/node_24/.devcontainer/devcontainer.json
+++ b/src/base_node/node_24/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/languages/node_24_python_3_10/.devcontainer/devcontainer.json b/src/languages/node_24_python_3_10/.devcontainer/devcontainer.json
index a810718..3e8304b 100644
--- a/src/languages/node_24_python_3_10/.devcontainer/devcontainer.json
+++ b/src/languages/node_24_python_3_10/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/languages/node_24_python_3_12/.devcontainer/devcontainer.json b/src/languages/node_24_python_3_12/.devcontainer/devcontainer.json
index 0ac0328..95b9ffb 100644
--- a/src/languages/node_24_python_3_12/.devcontainer/devcontainer.json
+++ b/src/languages/node_24_python_3_12/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/languages/node_24_python_3_13/.devcontainer/devcontainer.json b/src/languages/node_24_python_3_13/.devcontainer/devcontainer.json
index 0ac0328..95b9ffb 100644
--- a/src/languages/node_24_python_3_13/.devcontainer/devcontainer.json
+++ b/src/languages/node_24_python_3_13/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/languages/node_24_python_3_14/.devcontainer/devcontainer.json b/src/languages/node_24_python_3_14/.devcontainer/devcontainer.json
index 8580944..01708ae 100644
--- a/src/languages/node_24_python_3_14/.devcontainer/devcontainer.json
+++ b/src/languages/node_24_python_3_14/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/projects/eps-data-extract/.devcontainer/devcontainer.json b/src/projects/eps-data-extract/.devcontainer/devcontainer.json
index 8b10457..bfcb365 100644
--- a/src/projects/eps-data-extract/.devcontainer/devcontainer.json
+++ b/src/projects/eps-data-extract/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/projects/eps-storage-terraform/.devcontainer/devcontainer.json b/src/projects/eps-storage-terraform/.devcontainer/devcontainer.json
index 95c0a22..9c56e49 100644
--- a/src/projects/eps-storage-terraform/.devcontainer/devcontainer.json
+++ b/src/projects/eps-storage-terraform/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/projects/fhir_facade_api/.devcontainer/devcontainer.json b/src/projects/fhir_facade_api/.devcontainer/devcontainer.json
index 95c0a22..9c56e49 100644
--- a/src/projects/fhir_facade_api/.devcontainer/devcontainer.json
+++ b/src/projects/fhir_facade_api/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/projects/node_24_python_3_14_golang_1_24/.devcontainer/devcontainer.json b/src/projects/node_24_python_3_14_golang_1_24/.devcontainer/devcontainer.json
index e84c9ef..67e5a9b 100644
--- a/src/projects/node_24_python_3_14_golang_1_24/.devcontainer/devcontainer.json
+++ b/src/projects/node_24_python_3_14_golang_1_24/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/projects/node_24_python_3_14_java_24/.devcontainer/devcontainer.json b/src/projects/node_24_python_3_14_java_24/.devcontainer/devcontainer.json
index 65abfbe..2a6b023 100644
--- a/src/projects/node_24_python_3_14_java_24/.devcontainer/devcontainer.json
+++ b/src/projects/node_24_python_3_14_java_24/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }
   
diff --git a/src/projects/regression_tests/.devcontainer/devcontainer.json b/src/projects/regression_tests/.devcontainer/devcontainer.json
index 95c0a22..9c56e49 100644
--- a/src/projects/regression_tests/.devcontainer/devcontainer.json
+++ b/src/projects/regression_tests/.devcontainer/devcontainer.json
@@ -13,6 +13,9 @@
       },
       "context": "."
     },
+    "postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
+    "postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
+    "postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
     "features": {}
   }