diff --git a/Dockerfile b/Dockerfile
index 67c585a..b44aeb4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -97,6 +97,7 @@ RUN set -xe; \
     mv /tmp/redis-cli /usr/bin; \
     \
     if [[ -n "${PYTHON_DEV}" ]]; then \
+        apk add --no-cache ripgrep jq; \
         apk add --update --no-cache -t .wodby-python-build-deps \
             build-base \
             gcc \
diff --git a/tests/development-tools.sh b/tests/development-tools.sh
new file mode 100644
index 0000000..c1951c4
--- /dev/null
+++ b/tests/development-tools.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+# Execute inside the image, bypassing application startup.
+set -eu
+[ -n "${PYTHON_DEV:-}" ] || exit 0
+for tool in sh bash git curl rg jq nano ssh ssh-keygen; do
+    command -v "$tool" >/dev/null
+done
+test -x /usr/sbin/sshd
+test "$(id -u)" -ne 0
+test -w "$HOME"
+identity=$(mktemp -d)
+trap 'rm -rf "$identity"' EXIT
+ssh-keygen -q -t ed25519 -N '' -f "$identity/host"
+sudo -n /usr/sbin/sshd -t -f /dev/null -h "$identity/host"
diff --git a/tests/run.sh b/tests/run.sh
index 1b3d753..4eb352e 100755
--- a/tests/run.sh
+++ b/tests/run.sh
@@ -2,6 +2,9 @@
 
 set -e
 
+# Validate the development tool contract before application integration tests.
+docker run --rm --network none --entrypoint /bin/sh -v "$PWD/development-tools.sh:/tmp/development-tools.sh:ro" "${IMAGE}" /tmp/development-tools.sh
+
 if [[ -n "${DEBUG}" ]]; then
     set -x
 fi