diff --git a/.dockerignore b/.dockerignore
index 0966c2d..1a80c6d 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,6 @@
 .git
 .gitignore
+.gitea
 .dockerignore
 vendor
 storage
diff --git a/Dockerfile b/Dockerfile
index cd790d9..d22c74e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,9 +6,11 @@ FROM node:24-alpine AS frontend
 WORKDIR /web
 
 # Dependencies in their own layer, cached unless the manifests change. npm ci
-# resolves this stage's (musl) platform binaries for rollup/esbuild.
+# resolves this stage's (musl) platform binaries for rollup/esbuild. The cache
+# mount keeps the npm download cache warm across builds, so a lockfile bump
+# only re-fetches what actually changed.
 COPY web/package.json web/package-lock.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm npm ci
 
 COPY web/ ./
 RUN npm run build          # vue-tsc type-check, then `vite build` -> /web/dist
@@ -56,14 +58,17 @@ COPY docker/apache.conf /etc/apache2/conf.d/zz-app.conf
 # Copied early, alongside the other rarely-changing setup above -- after
 # COPY . . (below) every later layer re-runs on nearly every build, so this
 # would otherwise redo work for a file that essentially never changes.
-COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod +x /usr/local/bin/entrypoint.sh
+COPY --chmod=0755 docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 WORKDIR /var/www/html
 
 # --- PHP dependencies (own layer, cached unless composer.* changes) --------
+# The cache mount keeps Composer's package cache warm across builds, so a
+# composer.lock bump only re-fetches the packages that changed.
 COPY composer.json composer.lock ./
-RUN composer install --no-dev --no-interaction --no-progress --prefer-dist --no-autoloader
+RUN --mount=type=cache,target=/tmp/composer-cache \
+    COMPOSER_CACHE_DIR=/tmp/composer-cache \
+    composer install --no-dev --no-interaction --no-progress --prefer-dist --no-autoloader
 
 # --- Application source ----------------------------------------------------
 COPY . .