- pass `--from https://www.cpan.org` to cpanm by default - Ensure ca-certificates and curl are installed in slim builds so HTTPS installs work