How do I reset the sa user password inside a Dockerfile using the Windows SQL Server Express Docker image?

Question

I am trying to build a Docker image from the Windows SQL Server Express image augmented with the SqlPackage tool and preloaded with some data to run integration tests using the following Dockerfile:

FROM microsoft/mssql-server-windows-express

ARG DB_BACPAC=data.bacpac
ARG DB_NAME=db
ENV sa_password=VeryLongComplexP4ssW0rd
ENV accept_eula=Y

WORKDIR C:\\db
COPY $DB_BACPAC db.bacpac

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

RUN Invoke-WebRequest -Uri https://go.microsoft.com/fwlink/?linkid=2134206 -OutFile "sqlpackage-installer.msi"; \
    Start-Process msiexec.exe -Wait -ArgumentList '/I sqlpackage-installer.msi /quiet'; \
    Remove-Item sqlpackage-installer.msi -force

RUN stop-service MSSQL`$SQLEXPRESS
# Borrowed from the base Dockerfile for SQL Server express
CMD C:\\start -sa_password $env:SA_PASSWORD -ACCEPT_EULA Y

RUN & 'C:\\Program Files\\Microsoft SQL Server\\150\\DAC\\bin\\SqlPackage.exe' /Action:Import /SourceFile:"db.bacpac" /TargetServerName:localhost /TargetUser:sa /TargetPassword:$Env:sa_password /TargetDatabaseName:$Env:DB_NAME

Unfortunately, attempts to build this Docker image fail on the final RUN command with the following message:

*** Error importing database:Could not import package.
Unable to connect to target server 'localhost'. Please verify the connection information such as the server name, login credentials, and firewall rules for the target server.
Login failed for user 'sa'.

I have tried varying the name of the SA password environment variable (sa_password) based on the documentation & GitHub issues. Other users warned that login can fail silently if the password itself is not complex enough, hence the over-the-top password choice.

Previously, I had to build the Linux of this image and it required starting SQL server itself in the same layer and before running the SqlPackage commands in order to set the password, hence the stop & start commands (I also tried simply using Restart-Service to no avail).

Is there something I'm missing about (re)setting the sa user password? Or is there a different way I should be importing the BACPAC inside this Dockerfile?