diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c2c1e7c5..df99d7799 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,12 @@
+# v0.3.8 (Unreleased)
+
+## Bugfixes
+* None
+
+## Backwards Incompatibilities / Notes:
+* Docker image now contains latest Terraform 0.11.7
+* Docker image now does checksum verification for Terraform binaries during build
+
 # v0.3.7
 
 ## Bugfixes
diff --git a/Dockerfile b/Dockerfile
index b354a4a9f..67311d09d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -37,10 +37,16 @@ ENV DEFAULT_TERRAFORM_VERSION=0.11.7
 
 # In the official Atlantis image we only have the latest of each Terrafrom version.
 RUN AVAILABLE_TERRAFORM_VERSIONS="0.8.8 0.9.11 0.10.8 ${DEFAULT_TERRAFORM_VERSION}" && \
-    for VERSION in ${AVAILABLE_TERRAFORM_VERSIONS}; do curl -LOk https://releases.hashicorp.com/terraform/${VERSION}/terraform_${VERSION}_linux_amd64.zip && \
-    mkdir -p /usr/local/bin/tf/versions/${VERSION} && \
-    unzip terraform_${VERSION}_linux_amd64.zip -d /usr/local/bin/tf/versions/${VERSION} && \
-    ln -s /usr/local/bin/tf/versions/${VERSION}/terraform /usr/local/bin/terraform${VERSION};rm terraform_${VERSION}_linux_amd64.zip;done && \
+    for VERSION in ${AVAILABLE_TERRAFORM_VERSIONS}; do \
+        curl -LOks https://releases.hashicorp.com/terraform/${VERSION}/terraform_${VERSION}_linux_amd64.zip && \
+        curl -LOks https://releases.hashicorp.com/terraform/${VERSION}/terraform_${VERSION}_SHA256SUMS && \
+        sed -n "/terraform_${VERSION}_linux_amd64.zip/p" terraform_${VERSION}_SHA256SUMS | sha256sum -c && \
+        mkdir -p /usr/local/bin/tf/versions/${VERSION} && \
+        unzip terraform_${VERSION}_linux_amd64.zip -d /usr/local/bin/tf/versions/${VERSION} && \
+        ln -s /usr/local/bin/tf/versions/${VERSION}/terraform /usr/local/bin/terraform${VERSION} && \
+        rm terraform_${VERSION}_linux_amd64.zip && \
+        rm terraform_${VERSION}_SHA256SUMS; \
+    done && \
     ln -s /usr/local/bin/tf/versions/${DEFAULT_TERRAFORM_VERSION}/terraform /usr/local/bin/terraform
 
 # copy binary