diff --git a/Dockerfile b/Dockerfile
index 622eb5c..7551d37 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,24 +5,36 @@ ARG TARGETARCH
 ARG TARGETVARIANT
 
 WORKDIR /src
-COPY go.mod ./
-RUN apk add --no-cache ca-certificates git && go mod download
+
+# cache go mod download between builds (requires BuildKit)
+COPY go.mod go.sum ./
+RUN apk add --no-cache ca-certificates git
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    go mod download
 
 COPY . .
 RUN rm -rf screenies .github
+
+# Static, trimmed, stripped build. Note: removed -gcflags="all=-l"
 RUN CGO_ENABLED=0 \
     GOOS=${TARGETOS:-linux} \
     GOARCH=${TARGETARCH:-amd64} \
     go build -trimpath \
       -ldflags="-s -w -extldflags '-static' -buildid=''" \
-      -gcflags="all=-l" \
       -o /pinata ./main.go
 
 FROM scratch AS runtime
+# copy binary and CA certs only
 COPY --from=builder /pinata /pinata
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+# unprivileged user (optional)
 USER 65532
+
 EXPOSE 8080
+
 ENV GOMEMLIMIT=8MiB \
     GOGC=20
+
 ENTRYPOINT ["/pinata"]