diff --git a/defaults/main.yml b/defaults/main.yml
index b4daffc..0d6dfe8 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -4,7 +4,10 @@
 # SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
 # SPDX-License-Identifier: Apache-2.0
 
-devtools_extras: []
+devtools_install: []
+
+# delete the distribution files
+devtools_delete_dist: false
 
 # code review and lint tools
 devtools_python_piptools:
@@ -12,7 +15,7 @@
   - reuse~=0.14.0
   - yamllint~=1.26.3
 
-devtools_repo_version: "2.25"
+devtools_repo_version: "2.26"
 devtools_repo_url: >-
   https://gerrit.googlesource.com/git-repo/+/refs/tags/v{{
   devtools_repo_version }}/repo?format=TEXT
@@ -80,13 +83,13 @@
 devtools_fleet_checksum: "sha256:9e337fe898f0683c58d527c09df333e95403ea3c1fcc8ebf64a8b5d8e403275e"
 
 # terraform
-devtools_terraform_version: "1.1.9"
+devtools_terraform_version: "1.2.2"
 devtools_terraform_url: >-
   https://releases.hashicorp.com/terraform/{{
   devtools_terraform_version }}/terraform_{{
   devtools_terraform_version }}_linux_amd64.zip
 devtools_terraform_checksum: >-
-  sha256:9d2d8a89f5cc8bc1c06cb6f34ce76ec4b99184b07eb776f8b39183b513d7798a
+  sha256:2934a0e8824925beb956b2edb5fef212a6141c089d29d8568150a43f95b3a626
 
 devtools_tfmask_version: "0.7.0"
 devtools_tfmask_url: >-
diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml
index 8a6323c..efcb9b8 100644
--- a/molecule/default/verify.yml
+++ b/molecule/default/verify.yml
@@ -12,21 +12,7 @@
     # Can't be checked, will download bazel if run with --version
 
     # chromium
-    - name: Check chromium version
-      command:
-        cmd: "chromium --version"
-      become: true
-      register: chromium_version
-      tags:
-        - skip_ansible_lint  # info gathering
-
-    - debug:
-        var: chromium_version
-
-    - name: Assert chromium installed
-      assert:
-        that:
-          - "'Chromium' in chromium_version.stdout"
+    # Can't be checked as has protections against being run as root
 
     # java
     - name: Check java version
@@ -37,7 +23,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print java version
+      debug:
         var: java_version
 
     - name: Assert java 11 installed
@@ -54,7 +41,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print kubectl version
+      debug:
         var: kubectl_version
 
     - name: Assert kubectl 1.22 installed
@@ -71,7 +59,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print kind version
+      debug:
         var: kind_version
 
     - name: Assert kind 0.13.x installed
@@ -88,7 +77,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print helm version
+      debug:
         var: helm_version
 
     - name: Assert helm 3.8.x installed
@@ -105,7 +95,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print kubeval version
+      debug:
         var: kubeval_version
 
     - name: Assert kubeval 0.16.x installed
@@ -122,7 +113,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print conftest version
+      debug:
         var: conftest_version
 
     - name: Assert conftest 0.32.x installed
@@ -139,7 +131,8 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print fleet version
+      debug:
         var: fleet_version
 
     - name: Assert fleet 0.3.x installed
@@ -159,13 +152,14 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print terraform version
+      debug:
         var: terraform_version
 
-    - name: Assert terraform 1.1.x installed
+    - name: Assert terraform 1.2.x installed
       assert:
         that:
-          - "'Terraform v1.1' in terraform_version.stdout"
+          - "'Terraform v1.2' in terraform_version.stdout"
 
     # tfmask
     # no version/test command
@@ -179,11 +173,11 @@
       tags:
         - skip_ansible_lint  # info gathering
 
-    - debug:
+    - name: Print yq version
+      debug:
         var: yq_version
 
     - name: Assert yq 4.11.x installed
       assert:
         that:
           - "'yq (https://github.com/mikefarah/yq/) version 4.11' in yq_version.stdout"
-
diff --git a/tasks/Debian.yml b/tasks/Debian.yml
index b61b40e..0e22f53 100644
--- a/tasks/Debian.yml
+++ b/tasks/Debian.yml
@@ -8,7 +8,9 @@
   apt:
     name:
       - acl
+      - autoconf
       - apt-transport-https
+      - bison
       - build-essential
       - ca-certificates
       - curl
@@ -17,6 +19,7 @@
       - git-crypt
       - gnupg
       - jq
+      - libbison-dev
       - libenchant-2-dev
       - libxml2-utils
       - python-is-python3
diff --git a/tasks/k8s.yml b/tasks/k8s.yml
index d9e1cc5..36d1129 100644
--- a/tasks/k8s.yml
+++ b/tasks/k8s.yml
@@ -4,6 +4,13 @@
 # SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
 # SPDX-License-Identifier: Apache-2.0
 
+- name: create k8s sub dir in dist dir
+  file:
+    dest: "{{ devtools_dist_dir }}/k8s"
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
 
 # kubectl
 - name: Download/install kubectl binary
@@ -26,17 +33,17 @@
   get_url:
     url: "{{ devtools_helm_url }}"
     checksum: "{{ devtools_helm_checksum }}"
-    dest: "/tmp/helm.tgz"
+    dest: "{{ devtools_dist_dir }}/helm.tgz"
 
 - name: Unarchive helm
   unarchive:
-    src: "/tmp/helm.tgz"
-    dest: "/tmp"
+    src: "{{ devtools_dist_dir }}/helm.tgz"
+    dest: "{{ devtools_dist_dir }}/k8s"
     remote_src: true
 
 - name: Install helm binary
   copy:
-    src: /tmp/linux-amd64/helm
+    src: "{{ devtools_dist_dir }}/k8s/linux-amd64/helm"
     dest: /usr/local/bin/helm
     mode: "0755"
     remote_src: true
@@ -46,17 +53,18 @@
   get_url:
     url: "{{ devtools_kubeval_url }}"
     checksum: "{{ devtools_kubeval_checksum }}"
-    dest: "/tmp/kubeval.tgz"
+    dest: "{{ devtools_dist_dir }}/kubeval.tgz"
 
 - name: Unarchive kubeval
   unarchive:
-    src: "/tmp/kubeval.tgz"
-    dest: "/tmp"
+    src: "{{ devtools_dist_dir }}/kubeval.tgz"
+    dest: "{{ devtools_dist_dir }}/k8s"
     remote_src: true
+    creates: "{{ devtools_dist_dir }}/k8s/kubeval"
 
 - name: Install kubeval binary
   copy:
-    src: /tmp/kubeval
+    src: "{{ devtools_dist_dir }}/k8s/kubeval"
     dest: /usr/local/bin/kubeval
     mode: "0755"
     remote_src: true
@@ -66,17 +74,18 @@
   get_url:
     url: "{{ devtools_conftest_url }}"
     checksum: "{{ devtools_conftest_checksum }}"
-    dest: "/tmp/conftest.tgz"
+    dest: "{{ devtools_dist_dir }}/conftest.tgz"
 
 - name: Unarchive conftest
   unarchive:
-    src: "/tmp/conftest.tgz"
-    dest: "/tmp"
+    src: "{{ devtools_dist_dir }}/conftest.tgz"
+    dest: "{{ devtools_dist_dir }}/k8s"
     remote_src: true
+    creates: "{{ devtools_dist_dir }}/k8s/conftest"
 
 - name: Install conftest binary
   copy:
-    src: /tmp/conftest
+    src: "{{ devtools_dist_dir }}/k8s/conftest"
     dest: /usr/local/bin/conftest
     mode: "0755"
     remote_src: true
@@ -88,14 +97,3 @@
     checksum: "{{ devtools_fleet_checksum }}"
     dest: /usr/local/bin/fleet
     mode: "0755"
-
-# cleanup
-- name: Cleanup k8s downloads in /tmp
-  file:
-    path: "/tmp/{{ item }}"
-    state: absent
-  with_items:
-    - linux-amd64
-    - helm.tgz
-    - kubeval.tgz
-    - conftest.tgz
diff --git a/tasks/main.yml b/tasks/main.yml
index f4fe901..46a2d7a 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -10,35 +10,43 @@
 - name: include OS-specific tasks
   include_tasks: "{{ ansible_os_family }}.yml"
 
+# create devtools dist dir
+- name: create devtools dist dir
+  file:
+    path: "{{ devtools_dist_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+
 # repo
 - name: Download repo launcher
   get_url:
     url: "{{ devtools_repo_url }}"
     checksum: "{{ devtools_repo_checksum }}"
-    dest: /tmp/repo.b64
+    dest: "{{ devtools_dist_dir }}/repo.b64"
 
 - name: Decode, fix shebang, and make repo launcher executable
   shell:
     cmd: |
-      base64 --decode /tmp/repo.b64 > /tmp/repo
+      base64 --decode "{{ devtools_dist_dir }}/repo.b64" > \
+                      "{{ devtools_dist_dir }}/repo"
       # force repo launcher to use python3 - not needed if python-is-python3 installed
-      sed -i.bak 's"#!/usr/bin/env python"#!/usr/bin/env python3"' /tmp/repo
-      cp /tmp/repo /usr/local/bin/repo
+      sed -i.bak 's"#!/usr/bin/env python"#!/usr/bin/env python3"' \
+                 "{{ devtools_dist_dir }}/repo"
+      cp "{{ devtools_dist_dir }}/repo" /usr/local/bin/repo
       chmod 755 /usr/local/bin/repo
     creates: /usr/local/bin/repo
 
-# cleanup
-- name: Clean up downloads in /tmp
-  file:
-    path: "/tmp/{{ item }}"
-    state: absent
-  with_items:
-    - repo.b64
-    - repo.bak
-    - repo
-
 - name: Install additional devtools
   include_tasks: "{{ dt_inst_item }}.yml"
   loop: "{{ devtools_install | flatten(levels=1) }}"
   loop_control:
     loop_var: dt_inst_item
+
+# cleanup
+- name: Delete devtools dist dir
+  when: devtools_delete_dist
+  file:
+    path: "{{ devtools_dist_dir }}"
+    state: absent
diff --git a/tasks/shellcheck.yml b/tasks/shellcheck.yml
index deeb6d0..d163a5e 100644
--- a/tasks/shellcheck.yml
+++ b/tasks/shellcheck.yml
@@ -8,26 +8,19 @@
   get_url:
     url: "{{ devtools_shellcheck_url }}"
     checksum: "{{ devtools_shellcheck_checksum }}"
-    dest: "/tmp/shellcheck.tar.xz"
+    dest: "{{ devtools_dist_dir }}/shellcheck.tar.xz"
 
 - name: Unarchive shellcheck
   unarchive:
-    src: "/tmp/shellcheck.tar.xz"
-    dest: "/tmp"
+    src: "{{ devtools_dist_dir }}/shellcheck.tar.xz"
+    dest: "{{ devtools_dist_dir }}"
     remote_src: true
 
 - name: Install shellcheck binary
   copy:
-    src: "/tmp/shellcheck-v{{ devtools_shellcheck_version }}/shellcheck"
+    src: >-
+      {{ devtools_dist_dir }}/shellcheck-v{{
+      devtools_shellcheck_version }}/shellcheck
     dest: /usr/local/bin/shellcheck
     mode: "0755"
     remote_src: true
-
-# cleanup
-- name: Cleanup shellcheck downloads in /tmp
-  file:
-    path: "/tmp/{{ item }}"
-    state: absent
-  with_items:
-    - shellcheck.tar.xz
-    - "shellcheck-v{{ devtools_shellcheck_version }}"
diff --git a/tasks/terraform.yml b/tasks/terraform.yml
index 11bb240..6fbf34a 100644
--- a/tasks/terraform.yml
+++ b/tasks/terraform.yml
@@ -9,17 +9,17 @@
   get_url:
     url: "{{ devtools_terraform_url }}"
     checksum: "{{ devtools_terraform_checksum }}"
-    dest: "/tmp/terraform.zip"
+    dest: "{{ devtools_dist_dir }}/terraform.zip"
 
 - name: Unarchive terraform
   unarchive:
-    src: "/tmp/terraform.zip"
-    dest: "/tmp"
+    src: "{{ devtools_dist_dir }}/terraform.zip"
+    dest: "{{ devtools_dist_dir }}"
     remote_src: true
 
 - name: Install terraform binary
   copy:
-    src: /tmp/terraform
+    src: "{{ devtools_dist_dir }}/terraform"
     dest: /usr/local/bin/terraform
     mode: "0755"
     remote_src: true
@@ -31,11 +31,3 @@
     checksum: "{{ devtools_tfmask_checksum }}"
     dest: /usr/local/bin/tfmask
     mode: "0755"
-
-# cleanup
-- name: Cleanup terraform downloads in /tmp
-  file:
-    path: "/tmp/{{ item }}"
-    state: absent
-  with_items:
-    - terraform.zip
diff --git a/vars/Debian.yml b/vars/Debian.yml
index 7965c39..677c09e 100644
--- a/vars/Debian.yml
+++ b/vars/Debian.yml
@@ -9,3 +9,5 @@
 
 devtools_chromium_apt:
   - "chromium-shell"
+
+devtools_dist_dir: "/opt/devtools"