diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 225081a..5cc7c16 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -39,6 +39,11 @@ jobs:
         with:
           context: .
           file: docker/production/Dockerfile
+          # arm64 is deliberate: nothing of ours deploys to it, but the image is
+          # published for self-hosters and dropping it would exclude ARM boxes.
+          # It is emulated via QEMU, so keep the Dockerfile free of compilation.
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=registry,ref=forge.lvl0.xyz/lvl0/incr:buildcache
+          cache-to: type=registry,ref=forge.lvl0.xyz/lvl0/incr:buildcache,mode=max
diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index 327fdd1..a38cd2c 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -20,39 +20,41 @@ RUN npm run build
 # PHP runtime stage
 FROM php:8.3-fpm-alpine
 
-# Install system dependencies
+# mysql-client backs the database readiness loop in start-app.sh.
 RUN apk add --no-cache \
-    git \
     curl \
-    libpng-dev \
-    libxml2-dev \
     zip \
     unzip \
-    oniguruma-dev \
     mysql-client \
     nginx \
     supervisor
 
-# Install PHP extensions
-RUN docker-php-ext-install \
+# Prebuilt binaries rather than docker-php-ext-install: compiling these under
+# QEMU for the arm64 image dominated the build time.
+COPY --from=mlocati/php-extension-installer:2 /usr/bin/install-php-extensions /usr/local/bin/
+
+RUN install-php-extensions \
     pdo_mysql \
     mbstring \
-    exif \
     pcntl \
     bcmath \
     gd
 
 # Install Composer
-COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
 # Set working directory
 WORKDIR /var/www/html
 
-# Copy application code first
+# Dependencies before the source, so a code change does not reinstall vendor.
+# --no-scripts because package discovery needs the full application.
+COPY composer.json composer.lock ./
+RUN composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
+
 COPY . .
 
-# Install PHP dependencies after copying all files
-RUN composer install --no-dev --optimize-autoloader --no-interaction
+# dump-autoload triggers post-autoload-dump, which runs package:discover.
+RUN composer dump-autoload --optimize --no-interaction
 
 # Copy built frontend assets from builder stage
 COPY --from=frontend-builder /app/public/build/ ./public/build/