diff --git a/base/area_detector_versions.sh b/base/area_detector_versions.sh
index acba440..8c270a5 100644
--- a/base/area_detector_versions.sh
+++ b/base/area_detector_versions.sh
@@ -1,3 +1,5 @@
 AREA_DETECTOR_VERSION=R3-14
 NDSSCPIMEGA_VERSION=1.0.0
+NDSSCPIMEGA_SHA256=a688e1f54ce184fad4b0ea0d781fd69f744636fff6bddcbe477bf22087f907b0
 LIBSSCPIMEGA_VERSION=fb8acf533a7c01b5266bf32d60d1a5f923e19523
+LIBSSCPIMEGA_SHA256=8bb043b63a1b7bf81b3d27b8f947a134b26c9280607f3bf32f1f2ecf8e58d384
diff --git a/base/cagateway_versions.sh b/base/cagateway_versions.sh
index f724b99..9311b51 100644
--- a/base/cagateway_versions.sh
+++ b/base/cagateway_versions.sh
@@ -1,2 +1,4 @@
 PCAS_VERSION=v4.13.3
+PCAS_SHA256=5004e39339c8e592fcb9b4275c84143635c6e688c0fbe01f17dafe19850398a0
 CA_GATEWAY_VERSION=v2.1.3
+CA_GATEWAY_SHA256=f6e9dba46951a168d3208fc57054138759d56ebd8a7c07b496e8f5b8a56027d7
diff --git a/base/epics_versions.sh b/base/epics_versions.sh
index 4f9a4e3..ca8e87b 100644
--- a/base/epics_versions.sh
+++ b/base/epics_versions.sh
@@ -1 +1,2 @@
 EPICS_BASE_VERSION=7.0.8.1
+EPICS_BASE_SHA256=6c93a5e09b21392adbb3de423605d428ee4ddb1272fc708a251b082272fa73f5
diff --git a/base/install-functions.sh b/base/install-functions.sh
index 0822572..f4fbea0 100644
--- a/base/install-functions.sh
+++ b/base/install-functions.sh
@@ -15,8 +15,9 @@ download_from_github() {
     github_org=$1
     module_name=$2
     commit=$3
+    sha=$4
 
-    lnls-get-n-unpack -l https://github.com/$github_org/$module_name/archive/$commit.tar.gz
+    lnls-get-n-unpack -l https://github.com/$github_org/$module_name/archive/$commit.tar.gz $sha
 
     # GitHub tarballs for tags starting with 'v' don't include that 'v'
     commit=${commit#v}
@@ -65,8 +66,9 @@ install_from_github() {
     module_name=$2
     dependency_name=$3
     tag=$4
-    release_content="$5"
+    sha=$5
+    release_content="$6"
 
-    download_from_github $github_org $module_name $tag
+    download_from_github $github_org $module_name $tag $sha
     install_module $flag_ioc $module_name $dependency_name "$release_content"
 }
diff --git a/base/install_area_detector.sh b/base/install_area_detector.sh
index 8d43d53..feeb495 100755
--- a/base/install_area_detector.sh
+++ b/base/install_area_detector.sh
@@ -104,11 +104,11 @@ make clean
 
 cd ..
 
-download_from_github cnpem ssc-pimega $LIBSSCPIMEGA_VERSION
+download_from_github cnpem ssc-pimega $LIBSSCPIMEGA_VERSION $LIBSSCPIMEGA_SHA256
 make -C ssc-pimega/c install
 rm -rf ssc-pimega
 
-install_from_github cnpem NDSSCPimega NDSSCPIMEGA $NDSSCPIMEGA_VERSION "
+install_from_github cnpem NDSSCPimega NDSSCPIMEGA $NDSSCPIMEGA_VERSION $NDSSCPIMEGA_SHA256 "
 EPICS_BASE
 ASYN
 AREA_DETECTOR
diff --git a/base/install_cagateway.sh b/base/install_cagateway.sh
index baddd39..8910b8b 100755
--- a/base/install_cagateway.sh
+++ b/base/install_cagateway.sh
@@ -5,11 +5,11 @@ set -ex
 . $EPICS_IN_DOCKER/install-functions.sh
 . $EPICS_IN_DOCKER/cagateway_versions.sh
 
-install_from_github epics-modules pcas PCAS $PCAS_VERSION "
+install_from_github epics-modules pcas PCAS $PCAS_VERSION $PCAS_SHA256 "
 EPICS_BASE
 "
 
-install_from_github epics-extensions ca-gateway CA_GATEWAY $CA_GATEWAY_VERSION "
+install_from_github epics-extensions ca-gateway CA_GATEWAY $CA_GATEWAY_VERSION $CA_GATEWAY_SHA256 "
 EPICS_BASE
 PCAS
 CAPUTLOG
diff --git a/base/install_epics.sh b/base/install_epics.sh
index 5e1be34..06e547d 100755
--- a/base/install_epics.sh
+++ b/base/install_epics.sh
@@ -5,7 +5,7 @@ set -ex
 . $EPICS_IN_DOCKER/install-functions.sh
 . $EPICS_IN_DOCKER/epics_versions.sh
 
-lnls-get-n-unpack -l https://epics-controls.org/download/base/base-${EPICS_BASE_VERSION}.tar.gz
+lnls-get-n-unpack -l https://epics-controls.org/download/base/base-${EPICS_BASE_VERSION}.tar.gz $EPICS_BASE_SHA256
 mv base-${EPICS_BASE_VERSION} ${EPICS_BASE_PATH}
 
 patch -d ${EPICS_BASE_PATH} -Np1 < $EPICS_IN_DOCKER/epics-base-static-linking.patch
diff --git a/base/install_modules.sh b/base/install_modules.sh
index dde7a42..94cacaa 100755
--- a/base/install_modules.sh
+++ b/base/install_modules.sh
@@ -5,11 +5,11 @@ set -ex
 . $EPICS_IN_DOCKER/install-functions.sh
 . $EPICS_IN_DOCKER/modules_versions.sh
 
-install_from_github epics-base pvxs PVXS $PVXS_VERSION "
+install_from_github epics-base pvxs PVXS $PVXS_VERSION $PVXS_SHA256 "
 EPICS_BASE
 "
 
-download_from_github epics-base p4p $P4P_VERSION
+download_from_github epics-base p4p $P4P_VERSION $P4P_SHA256
 echo PYTHON=python3 >> p4p/configure/CONFIG_SITE
 install_module p4p P4P "
 EPICS_BASE
@@ -17,46 +17,46 @@ PVXS
 "
 echo 'python3*/linux*/' > p4p/.lnls-keep-paths
 
-install_from_github epics-modules sequencer SNCSEQ $SEQUENCER_VERSION "
+install_from_github epics-modules sequencer SNCSEQ $SEQUENCER_VERSION $SEQUENCER_SHA256 "
 EPICS_BASE
 "
 
-install_from_github epics-modules calc CALC $CALC_VERSION "
+install_from_github epics-modules calc CALC $CALC_VERSION $CALC_SHA256 "
 EPICS_BASE
 "
 
 # Build asyn without seq since it's only needed for testIPServer
-install_from_github epics-modules asyn ASYN $ASYN_VERSION "
+install_from_github epics-modules asyn ASYN $ASYN_VERSION $ASYN_SHA256 "
 EPICS_BASE
 CALC
 "
 
-install_from_github epics-modules modbus MODBUS $MODBUS_VERSION "
+install_from_github epics-modules modbus MODBUS $MODBUS_VERSION $MODBUS_SHA256 "
 EPICS_BASE
 ASYN
 "
 
-install_from_github paulscherrerinstitute StreamDevice STREAM $STREAMDEVICE_VERSION "
+install_from_github paulscherrerinstitute StreamDevice STREAM $STREAMDEVICE_VERSION $STREAMDEVICE_SHA256 "
 EPICS_BASE
 ASYN
 CALC
 "
 
-install_from_github epics-modules busy BUSY $BUSY_VERSION "
+install_from_github epics-modules busy BUSY $BUSY_VERSION $BUSY_SHA256 "
 EPICS_BASE
 ASYN
 "
 
-install_from_github epics-modules autosave AUTOSAVE $AUTOSAVE_VERSION "
+install_from_github epics-modules autosave AUTOSAVE $AUTOSAVE_VERSION $AUTOSAVE_SHA256 "
 EPICS_BASE
 "
 
-install_from_github epics-modules sscan SSCAN $SSCAN_VERSION "
+install_from_github epics-modules sscan SSCAN $SSCAN_VERSION $SSCAN_SHA256 "
 EPICS_BASE
 SNCSEQ
 "
 
-download_from_github ChannelFinder recsync $RECCASTER_VERSION
+download_from_github ChannelFinder recsync $RECCASTER_VERSION $RECCASTER_SHA256
 mv recsync recsync-root
 mv recsync-root/client recsync
 rm -r recsync-root
@@ -64,29 +64,29 @@ install_module recsync RECCASTER "
 EPICS_BASE
 "
 
-install_from_github epics-modules ipac IPAC $IPAC_VERSION "
+install_from_github epics-modules ipac IPAC $IPAC_VERSION $IPAC_SHA256 "
 EPICS_BASE
 "
 
-download_from_github epics-modules caPutLog $CAPUTLOG_VERSION
+download_from_github epics-modules caPutLog $CAPUTLOG_VERSION $CAPUTLOG_SHA256
 patch -d caPutLog -Np1 < $EPICS_IN_DOCKER/caputlog-waveform-fix.patch
 install_module caPutLog CAPUTLOG "
 EPICS_BASE
 "
 
-install_from_github brunoseivam retools RETOOLS $RETOOLS_VERSION "
+install_from_github brunoseivam retools RETOOLS $RETOOLS_VERSION $RETOOLS_SHA256 "
 EPICS_BASE
 "
 
-install_from_github -i epics-modules ether_ip ETHER_IP $ETHER_IP_VERSION "
+install_from_github -i epics-modules ether_ip ETHER_IP $ETHER_IP_VERSION $ETHER_IP_SHA256 "
 EPICS_BASE
 "
 
-install_from_github epics-modules iocStats DEVIOCSTATS $IOCSTATS_VERSION "
+install_from_github epics-modules iocStats DEVIOCSTATS $IOCSTATS_VERSION $IOCSTATS_SHA256 "
 EPICS_BASE
 "
 
-download_from_github slac-epics-modules ipmiComm $IPMICOMM_VERSION
+download_from_github slac-epics-modules ipmiComm $IPMICOMM_VERSION $IPMICOMM_SHA256
 patch -d ipmiComm -Np1 < $EPICS_IN_DOCKER/backport-ipmicomm.patch
 patch -d ipmiComm -Np1 < $EPICS_IN_DOCKER/ipmicomm.patch
 JOBS=1 install_module ipmiComm IPMICOMM "
@@ -94,7 +94,7 @@ EPICS_BASE
 ASYN
 "
 
-download_from_github mdavidsaver pyDevSup $PYDEVSUP_VERSION
+download_from_github mdavidsaver pyDevSup $PYDEVSUP_VERSION $PYDEVSUP_SHA256
 echo PYTHON=python3 >> pyDevSup/configure/CONFIG_SITE
 install_module pyDevSup PYDEVSUP "
 EPICS_BASE
@@ -103,18 +103,19 @@ echo 'python3*/linux*/' > pyDevSup/.lnls-keep-paths
 
 mkdir snmp
 cd snmp
-lnls-get-n-unpack -l https://groups.nscl.msu.edu/controls/files/epics-snmp-$SNMP_VERSION.zip
+lnls-get-n-unpack -l https://groups.nscl.msu.edu/controls/files/epics-snmp-$SNMP_VERSION.zip \
+    $SNMP_SHA256
 cd ..
 install_module -i snmp SNMP "
 EPICS_BASE
 "
 
-install_from_github epics-modules scaler SCALER $SCALER_VERSION "
+install_from_github epics-modules scaler SCALER $SCALER_VERSION $SCALER_SHA256 "
 EPICS_BASE
 ASYN
 "
 
-install_from_github -i epics-modules mca MCA $MCA_VERSION "
+install_from_github -i epics-modules mca MCA $MCA_VERSION $MCA_SHA256 "
 EPICS_BASE
 CALC
 SSCAN
@@ -126,14 +127,14 @@ ASYN
 MCA
 "
 
-download_from_github ISISComputingGroup EPICS-lakeshore $LAKESHORE_VERSION
+download_from_github ISISComputingGroup EPICS-lakeshore $LAKESHORE_VERSION $LAKESHORE_SHA256
 mv EPICS-lakeshore/lakeshore336 .
 rm -r EPICS-lakeshore
 install_module lakeshore336 LAKESHORE "
 EPICS_BASE
 "
 
-install_from_github DiamondLightSource lakeshore340 LAKESHORE340 $LAKESHORE340_VERSION "
+install_from_github DiamondLightSource lakeshore340 LAKESHORE340 $LAKESHORE340_VERSION $LAKESHORE340_SHA256 "
 EPICS_BASE
 ASYN
 CALC
diff --git a/base/install_motor.sh b/base/install_motor.sh
index cf01859..c95d2ae 100755
--- a/base/install_motor.sh
+++ b/base/install_motor.sh
@@ -55,7 +55,7 @@ SNCSEQ
 
 cd $EPICS_MODULES_PATH
 
-download_from_github dls-controls pmac $PMAC_VERSION
+download_from_github dls-controls pmac $PMAC_VERSION $PMAC_SHA256
 
 rm pmac/configure/RELEASE.local.linux-x86_64
 rm pmac/configure/RELEASE.linux-x86_64.Common
@@ -80,7 +80,7 @@ MOTOR
 BUSY
 "
 
-download_from_github cnpem motorParker $PARKER_VERSION
+download_from_github cnpem motorParker $PARKER_VERSION $PARKER_SHA256
 install_module motorParker MOTOR_PARKER "
 EPICS_BASE
 ASYN
diff --git a/base/install_opcua.sh b/base/install_opcua.sh
index 9fc17f9..be8e127 100755
--- a/base/install_opcua.sh
+++ b/base/install_opcua.sh
@@ -8,7 +8,7 @@ set -ex
 
 opcua_release_url=https://github.com/epics-modules/opcua/releases/download/v${OPCUA_VERSION}
 opcua_release_file=BDIST_opcua-${OPCUA_VERSION}_Base-${EPICS_BASE_VERSION}_debian${DEBIAN_VERSION%.*}.tar.gz
-lnls-get-n-unpack -l $opcua_release_url/$opcua_release_file
+lnls-get-n-unpack -l $opcua_release_url/$opcua_release_file $OPCUA_SHA256
 rm HOW_TO.md
 
 mv opcuaBinaryDist opcua-module
diff --git a/base/lnls-get-n-unpack.sh b/base/lnls-get-n-unpack.sh
index f123997..d7c660f 100755
--- a/base/lnls-get-n-unpack.sh
+++ b/base/lnls-get-n-unpack.sh
@@ -4,30 +4,81 @@
 
 set -eu
 
-case "$1" in
-    -r) dest=/ ;;
-    -l) dest=. ;;
-    *)
-        >&2 echo "Invalid extraction mode: must be either root (-r) or local (-l)."
-        exit 1
-        ;;
-esac
+help() {
+    echo "lnls-get-n-unpack: download and extract archive from the network"
+    echo -e "Usage: lnls-get-n-unpack <extraction_mode> <URL1> <SHA256SUM1> [<URL2> <SHA256SUM2> ...]\n"
+    echo "Extraction mode:"
+    echo "  -l extracts to local directory (./)"
+    echo "  -r extracts to root directory (/)"
+    echo "URL:"
+    echo "  url to download source from."
+    echo "SHA256SUM:"
+    echo "  Reference sha256 hash to compare url download with."
+    exit $1
+}
+
+parse_arguments() {
+    if [ "$#" -eq 0 ]; then
+        help
+    fi
 
-shift
+    # Check extraction mode
+    case "$1" in
+        -r) dest=/ ;;
+        -l) dest=. ;;
+        *)
+            echo >&2 "Invalid extraction mode: must be either root (-r) or local (-l)."
+            exit 1
+            ;;
+    esac
 
-for url; do
-    download_dir=$(mktemp -d)
+    # Check if we have odd number of arguments (extraction_mode + N*url + N*sha256sum)
+    if [ $(($# % 2)) -ne 1 ]; then
+        echo >&2 "ERROR: Even number of arguments detected. Something is wrong."
+        help 1
+    fi
 
-    echo Downloading "$url"...
-    wget -P $download_dir "$url" &> /tmp/wget.log || (cat /tmp/wget.log && false)
+    # Throw extraction mode argument away
+    shift
+    echo "$dest $@"
+}
 
-    filename=$(basename $download_dir/*)
+shacheck() {
+    downloaded_file=$1
+    sha=$2
+    url=$3
 
-    if [[ ${filename,,} == *".zip" ]]; then
-        unzip -qo $download_dir/$filename -d $dest
-    else
-        tar --no-same-owner -xf $download_dir/$filename -C $dest
+    if ! echo $sha $downloaded_file | sha256sum -c; then
+        echo "ERROR: SHA $sha for URL $url does not match."
+        exit 1
     fi
+}
+
+download() {
+    dest=$1
+    shift
+
+    while [ $# -gt 1 ]; do
+        url=$1
+        sha=$2
+        download_dir=$(mktemp -d)
+        echo Downloading "$url"...
+        wget -P $download_dir "$url" &> /tmp/wget.log || (cat /tmp/wget.log && false)
+        filename=$(basename $download_dir/*)
+
+        shacheck $download_dir/$filename $sha $url
+
+        if [[ ${filename,,} == *".zip" ]]; then
+            unzip -qo $download_dir/$filename -d $dest
+        else
+            tar --no-same-owner -xf $download_dir/$filename -C $dest
+        fi
+
+        rm -rf $download_dir /tmp/wget.log
+
+        shift 2
+    done
+}
 
-    rm -rf $download_dir /tmp/wget.log
-done
+args=$(parse_arguments ${@})
+download ${args}
diff --git a/base/modules_versions.sh b/base/modules_versions.sh
index 67cbf30..b4b7183 100644
--- a/base/modules_versions.sh
+++ b/base/modules_versions.sh
@@ -1,24 +1,47 @@
 PVXS_VERSION=1.3.1
+PVXS_SHA256=14936dda59e81a2252e1da3cf147a038cc420e4510df30c3aeb2bf1113641555
 P4P_VERSION=4.2.0
+P4P_SHA256=2b89d7605ae35dc7edad2a36cf6b1d395170698b6d7fdfc3811a8d3ed5183bab
 
 SEQUENCER_VERSION=R2-2-9
+SEQUENCER_SHA256=f5ebecdb231e106bb83db9a5fc877adb03bfd119e879a3668fdfc33d0aacb397
 CALC_VERSION=R3-7-5
+CALC_SHA256=5cf1a7b3d444e763eb96ca5b9cdbcb9c29f5a6f9ac2b8d9cdb17a007d3fa8347
 ASYN_VERSION=R4-44-2
+ASYN_SHA256=47e993aeb300c597fcb0c3df6d3c88b9dd9e9fb90600da84cb2d2dc5b59a31aa
 MODBUS_VERSION=R3-3
+MODBUS_SHA256=c890feb00844c9bb15525307b6c3322832d10f504d288f0f650b6ea987483e7c
 STREAMDEVICE_VERSION=2.8.24
+STREAMDEVICE_SHA256=e0640f00cd23ddd6015091d4b4e8e43a21d9e9e31d9639a5d0da6b187f42eb79
 BUSY_VERSION=R1-7-4
+BUSY_SHA256=1a09675bb69cdb09157b06d7276c4e4a9db8ca7e257108529e380c55452e4a53
 AUTOSAVE_VERSION=R5-11
+AUTOSAVE_SHA256=766dd7a8f71529f48d8122a3655f7986004b62ba589342153fa5a47f59119903
 SSCAN_VERSION=R2-11-6
+SSCAN_SHA256=6911e114b07b3c200db781750035237d7dd494130f360e278df950a8358d6d78
 RECCASTER_VERSION=1.5
+RECCASTER_SHA256=7108963bfa6c74d9571fe808ffa4312c1d562b30f575fb6b102fb20bc910aeb8
 IPAC_VERSION=2.16
+IPAC_SHA256=4bd404eb9a205a32e6e25730115f6a1ab201dac69454136d4b570f880843f726
 CAPUTLOG_VERSION=R4.0
+CAPUTLOG_SHA256=6b85137906ed44a1f15358ab32fa9b4c450b37c495c65410606ea660ef4feb4c
 RETOOLS_VERSION=5ada1e1573969c242d2af922c2021e9c7971dbff
+RETOOLS_SHA256=676e2d325fe43126bf2762fa003450bc4c5ed33002ff42761a1d8c9a1f743bf7
 ETHER_IP_VERSION=ether_ip-3-3
+ETHER_IP_SHA256=ccf441ab842c8d24cea5b912b210852a4dc2fc005391a64f14de2ed586644155
 IOCSTATS_VERSION=3.2.0
+IOCSTATS_SHA256=13fbca066bdb34f1d84641a1b3f9fc505729866963f1e7d6d66dbc55b32a2cc8
 IPMICOMM_VERSION=R4.6.0
+IPMICOMM_SHA256=7e526601461d7222834219a0f081a0550932b340eb945e515ffae94febe429f8
 PYDEVSUP_VERSION=1.2
+PYDEVSUP_SHA256=3280cf3c4e9355f34841bc5ec38d0e5337783ea1678f31f7559b723ba8f4489b
 SNMP_VERSION=1.1.0.4
+SNMP_SHA256=f190b807aecd7d319e58263bca2ff883f891496793b68c871ada48a192d695a3
 SCALER_VERSION=4.1
+SCALER_SHA256=faad6df4a71922ad6dcbd2d73020fad301ecd32e6e4e31ca0b0e4fd013c3bbce
 MCA_VERSION=R7-10
+MCA_SHA256=dddee716247e97e61f2e5a4bad07966ee00a7c107aed6f2d697b27337a44b9bc
 LAKESHORE_VERSION=Release_ibex_25.2.1
+LAKESHORE_SHA256=29b2a57583f69b02289368bcf76debe4a872380400fd4e309d1be320ec38d51e
 LAKESHORE340_VERSION=2-6-4
+LAKESHORE340_SHA256=3a5ac79abcce29d62d4eb6a16a63dc297594358512e3c90a96e2417ba40f7fd5
diff --git a/base/motor_versions.sh b/base/motor_versions.sh
index 0e17d0f..8604c1c 100644
--- a/base/motor_versions.sh
+++ b/base/motor_versions.sh
@@ -1,4 +1,6 @@
 MOTOR_VERSION=R7-3-1
 PIGCS2_VERSION=60af8bdb17c1717e4545d8170f820e358ce31458
 PMAC_VERSION=2-6-4b3
+PMAC_SHA256=baac82f617ddd7fb10e8967799b95353bdca4c0fefbe784636766229c1872408
 PARKER_VERSION=R1-1-1-oem-3
+PARKER_SHA256=34a3fd860d6442cfd02bd87b415f88dd42a450fab1584c326ceaf8c36fe58a34
diff --git a/base/opcua_versions.sh b/base/opcua_versions.sh
index 7f91707..80b0b0a 100644
--- a/base/opcua_versions.sh
+++ b/base/opcua_versions.sh
@@ -1 +1,2 @@
 OPCUA_VERSION=0.10.0
+OPCUA_SHA256=d7552987ebe9446091aaaac25cb25d0c2a54ad77ac02864cfee9a706520467bf