diff --git a/Dockerfile b/Dockerfile
index 258814d..5db4cf7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,8 @@
+# syntax=docker/dockerfile:1.7
 FROM rocker/shiny:4.4.0
 
 # System dependencies commonly required by R packages
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     libcurl4-openssl-dev \
     libssl-dev \
@@ -18,12 +19,14 @@ RUN apt-get update && apt-get install -y \
 
 WORKDIR /srv/shiny-server
 
-# Copy the application
-COPY . /srv/shiny-server/
+# Copy dependency manifests first so package restore can be cached
+COPY renv.lock /srv/shiny-server/renv.lock
+COPY renv /srv/shiny-server/renv
 
 # Prevent renv attempting to use pak
 ENV RENV_CONFIG_PAK_ENABLED=FALSE
 ENV RENV_DOWNLOAD_METHOD=libcurl
+ENV RENV_PATHS_CACHE=/opt/renv/cache
 
 # Some CRAN packages in this lockfile fail under Ubuntu hardening defaults
 # because -Werror=format-security turns benign warnings into build failures.
@@ -34,9 +37,15 @@ RUN for f in /usr/local/lib/R/etc/Makeconf /usr/lib/R/etc/Makeconf; do \
     done
 
 # Install renv and restore project packages
-RUN R --vanilla -e "install.packages('renv', repos='https://cran.rstudio.com')" && \
+RUN --mount=type=cache,target=/opt/renv/cache \
+    --mount=type=cache,target=/root/.cache/R/renv \
+    R --vanilla -e "install.packages('renv', repos='https://cran.rstudio.com')" && \
     R --vanilla -e "renv::restore(project='/srv/shiny-server', lockfile='/srv/shiny-server/renv.lock', prompt=FALSE)"
 
+# Copy the application after dependencies so regular code changes do not
+# invalidate the expensive restore layer.
+COPY . /srv/shiny-server/
+
 # Permissions
 RUN chown -R shiny:shiny /srv/shiny-server