diff --git a/modules/nf-core/gatk4spark/applybqsr/main.nf b/modules/nf-core/gatk4spark/applybqsr/main.nf
index 4aec53545cb6..a87a06da9dda 100644
--- a/modules/nf-core/gatk4spark/applybqsr/main.nf
+++ b/modules/nf-core/gatk4spark/applybqsr/main.nf
@@ -7,11 +7,18 @@ process GATK4SPARK_APPLYBQSR {
         ? 'https://community-cr-prod.seqera.io/docker/registry/v2/blobs/sha256/49/498aea9c9bcaf736b9fb2a01366c1b7b38ccc0d38143178afc325d6a93241447/data'
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
+    // Spark's native UnixLoginModule fails to resolve a username for the container's UID
+    // (LoginException "invalid null input" for name), because the container's own /etc/passwd
+    // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
+    // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
+    containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
+
     input:
     tuple val(meta), path(input), path(input_index), path(bqsr_table), path(intervals)
     path fasta
     path fai
     path dict
+    val output_suffix
 
     output:
     tuple val(meta), path("${prefix}.bam"), emit: bam, optional: true
@@ -26,7 +33,7 @@ process GATK4SPARK_APPLYBQSR {
     def args = task.ext.args ?: ''
     prefix = task.ext.prefix ?: "${meta.id}"
     // suffix can only be bam or cram, cram being the sensible default
-    def suffix = task.ext.suffix && task.ext.suffix == "bam" ? "bam" : "cram"
+    def suffix = output_suffix == "bam" ? "bam" : "cram"
     def interval_command = intervals ? "--intervals ${intervals}" : ""
 
     def avail_mem = 3072
@@ -51,7 +58,7 @@ process GATK4SPARK_APPLYBQSR {
 
     stub:
     prefix = task.ext.prefix ?: "${meta.id}"
-    def suffix = task.ext.suffix ?: "cram"
+    def suffix = output_suffix == "bam" ? "bam" : "cram"
     """
     touch ${prefix}.${suffix}
     if [[ ${suffix} == bam ]]; then
diff --git a/modules/nf-core/gatk4spark/applybqsr/meta.yml b/modules/nf-core/gatk4spark/applybqsr/meta.yml
index 4d5c25821c4d..29f894ab8e51 100644
--- a/modules/nf-core/gatk4spark/applybqsr/meta.yml
+++ b/modules/nf-core/gatk4spark/applybqsr/meta.yml
@@ -57,6 +57,9 @@ input:
       description: GATK sequence dictionary
       pattern: "*.dict"
       ontologies: []
+  - output_suffix:
+      type: string
+      description: Output file format, either "bam" or "cram" (cram is the default)
 output:
   bam:
     - - meta:
diff --git a/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test b/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test
index b0f1ce00f22b..677ff9665cf8 100644
--- a/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test
+++ b/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test
@@ -2,7 +2,6 @@ nextflow_process {
 
     name "Test Process GATK4SPARK_APPLYBQSR"
     script "../main.nf"
-    config "./nextflow.config"
     process "GATK4SPARK_APPLYBQSR"
 
     tag "modules"
@@ -13,10 +12,6 @@ nextflow_process {
     test("sarscov2 - bam") {
 
         when {
-            params {
-                module_suffix = "bam"
-            }
-
             process {
                 """
                 input[0] = [
@@ -29,6 +24,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "bam"
                 """
             }
         }
@@ -56,6 +52,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "cram"
                 """
             }
         }
@@ -74,10 +71,6 @@ nextflow_process {
     test("sarscov2 - bam - intervals") {
 
         when {
-            params {
-                module_suffix = "bam"
-            }
-
             process {
                 """
                 input[0] = [
@@ -90,6 +83,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "bam"
                 """
             }
         }
@@ -117,6 +111,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.dict', checkIfExists: true)
+                input[4] = "cram"
                 """
             }
         }
@@ -149,6 +144,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.dict', checkIfExists: true)
+                input[4] = "cram"
                 """
             }
         }
@@ -165,10 +161,6 @@ nextflow_process {
 
         options "-stub"
         when {
-            params {
-                module_suffix = "bam"
-            }
-
             process {
                 """
                 input[0] = [
@@ -181,6 +173,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "bam"
                 """
             }
         }
diff --git a/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config b/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
deleted file mode 100644
index 3525ef1278ab..000000000000
--- a/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
+++ /dev/null
@@ -1,7 +0,0 @@
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /etc/group:/etc/group:ro -v $HOME:$HOME'
-process {
-    withName: GATK4SPARK_APPLYBQSR {
-        ext.prefix = { "${meta.id}" }
-        ext.suffix = { params.module_suffix ?: "" }
-    }
-}
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/main.nf b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
index 2b8deb171f86..77adb975307c 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/main.nf
+++ b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
@@ -7,6 +7,12 @@ process GATK4SPARK_BASERECALIBRATOR {
         ? 'https://community-cr-prod.seqera.io/docker/registry/v2/blobs/sha256/49/498aea9c9bcaf736b9fb2a01366c1b7b38ccc0d38143178afc325d6a93241447/data'
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
+    // Spark's native UnixLoginModule fails to resolve a username for the container's UID
+    // (LoginException "invalid null input" for name), because the container's own /etc/passwd
+    // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
+    // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
+    containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
+
     input:
     tuple val(meta), path(input), path(input_index), path(intervals)
     path fasta
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test b/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test
index d2b3238b0b34..c8863029ccd2 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test
+++ b/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test
@@ -2,7 +2,6 @@ nextflow_process {
 
     name "Test Process GATK4SPARK_BASERECALIBRATOR"
     script "../main.nf"
-    config "./nextflow.config"
     process "GATK4SPARK_BASERECALIBRATOR"
 
     tag "modules"
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config b/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
deleted file mode 100644
index 85142680d89f..000000000000
--- a/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
+++ /dev/null
@@ -1 +0,0 @@
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /etc/group:/etc/group:ro -v $HOME:$HOME'
diff --git a/modules/nf-core/gatk4spark/markduplicates/main.nf b/modules/nf-core/gatk4spark/markduplicates/main.nf
index 2278afa1ef78..a2941d87adb4 100644
--- a/modules/nf-core/gatk4spark/markduplicates/main.nf
+++ b/modules/nf-core/gatk4spark/markduplicates/main.nf
@@ -7,6 +7,12 @@ process GATK4SPARK_MARKDUPLICATES {
         ? 'https://community-cr-prod.seqera.io/docker/registry/v2/blobs/sha256/49/498aea9c9bcaf736b9fb2a01366c1b7b38ccc0d38143178afc325d6a93241447/data'
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
+    // Spark's native UnixLoginModule fails to resolve a username for the container's UID
+    // (LoginException "invalid null input" for name), because the container's own /etc/passwd
+    // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
+    // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
+    containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
+
     input:
     tuple val(meta), path(bam)
     path fasta
diff --git a/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test b/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test
index 3e7272bb4d91..4e939369aadb 100644
--- a/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test
+++ b/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test
@@ -2,7 +2,6 @@ nextflow_process {
 
     name "Test Process GATK4SPARK_MARKDUPLICATES"
     script "../main.nf"
-    config "./nextflow.config"
     process "GATK4SPARK_MARKDUPLICATES"
 
     tag "modules"
diff --git a/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config b/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
deleted file mode 100644
index 85142680d89f..000000000000
--- a/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
+++ /dev/null
@@ -1 +0,0 @@
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /etc/group:/etc/group:ro -v $HOME:$HOME'