diff --git a/Dockerfile.in b/Dockerfile.in
index 3c82e71..7bad07a 100644
--- a/Dockerfile.in
+++ b/Dockerfile.in
@@ -49,6 +49,10 @@
 #############################################################################
 FROM {ARG_FROM} as prep
 
+# When building, we can pass a unique value (e.g. `date +%s`) for this arg,
+# which will force a rebuild from here (by invalidating docker's cache).
+ARG FORCE_REBUILD=0
+
 RUN apt-get -q -y update
 RUN apt-get -q -y upgrade
 RUN apt-get -q -y install --no-install-recommends \
@@ -77,12 +81,20 @@ RUN echo "git-sync:x:65533:git-sync" >> /etc/group
 # are handling permissions themselves.
 RUN mkdir -m 02775 /tmp/git && chown 65533:65533 /tmp/git
 
-# Add the platform-specific binary.
-COPY bin/{ARG_OS}_{ARG_ARCH}/{ARG_BIN} /{ARG_BIN}
+# When building, we can pass a hash of the licenses tree, which docker checks
+# against its cache and can force a rebuild from here.
+ARG HASH_LICENSES=0
 
 # Add third-party licenses.
 COPY .licenses/ /LICENSES/
 
+# When building, we can pass a hash of the binary, which docker checks against
+# its cache and can force a rebuild from here.
+ARG HASH_BINARY=0
+
+# Add the platform-specific binary.
+COPY bin/{ARG_OS}_{ARG_ARCH}/{ARG_BIN} /{ARG_BIN}
+
 #############################################################################
 # Now we make a "clean" final image.
 #############################################################################
diff --git a/Makefile b/Makefile
index fb6839f..ef14b0c 100644
--- a/Makefile
+++ b/Makefile
@@ -130,6 +130,9 @@ $(LICENSES):
 	@./bin/tools/go-licenses save ./... --save_path=$(LICENSES)
 	@chmod -R a+rx $(LICENSES)
 
+# Set this to any value to skip repeating the apt-get steps.  Caution.
+ALLOW_STALE_APT ?=
+
 container: .container-$(DOTFILE_IMAGE) container-name
 .container-$(DOTFILE_IMAGE): bin/$(OS)_$(ARCH)/$(BIN) $(LICENSES) Dockerfile.in
 	@sed \
@@ -138,15 +141,23 @@ container: .container-$(DOTFILE_IMAGE) container-name
 	    -e 's|{ARG_OS}|$(OS)|g'          \
 	    -e 's|{ARG_FROM}|$(BASEIMAGE)|g' \
 	    Dockerfile.in > .dockerfile-$(OS)_$(ARCH)
-	@docker buildx build                       \
-	    --no-cache                             \
-	    --progress=plain                       \
-	    --load                                 \
-	    --platform "$(OS)/$(ARCH)"             \
-	    --build-arg HTTP_PROXY=$(HTTP_PROXY)   \
-	    --build-arg HTTPS_PROXY=$(HTTPS_PROXY) \
-	    -t $(IMAGE):$(TAG)                     \
-	    -f .dockerfile-$(OS)_$(ARCH)           \
+	@HASH_LICENSES=$$(find $(LICENSES) -type f                    \
+	    | xargs md5sum | md5sum | cut -f1 -d' ');                 \
+	 HASH_BINARY=$$(md5sum bin/$(OS)_$(ARCH)/$(BIN)               \
+	    | cut -f1 -d' ');                                         \
+	 FORCE=0;                                                     \
+	 if [ -z "$(ALLOW_STALE_APT)" ]; then FORCE=$$(date +%s); fi; \
+	 docker buildx build                                          \
+	    --build-arg FORCE_REBUILD="$$FORCE"                       \
+	    --build-arg HASH_LICENSES="$$HASH_LICENSES"               \
+	    --build-arg HASH_BINARY="$$HASH_BINARY"                   \
+	    --progress=plain                                          \
+	    --load                                                    \
+	    --platform "$(OS)/$(ARCH)"                                \
+	    --build-arg HTTP_PROXY=$(HTTP_PROXY)                      \
+	    --build-arg HTTPS_PROXY=$(HTTPS_PROXY)                    \
+	    -t $(IMAGE):$(TAG)                                        \
+	    -f .dockerfile-$(OS)_$(ARCH)                              \
 	    .
 	@docker images -q $(IMAGE):$(TAG) > $@
 
diff --git a/test_e2e.sh b/test_e2e.sh
index a233694..65c394f 100755
--- a/test_e2e.sh
+++ b/test_e2e.sh
@@ -2050,7 +2050,7 @@ if [[ "$#" == 0 ]]; then
 fi
 
 # Build it
-make container REGISTRY=e2e VERSION="${E2E_TAG}"
+make container REGISTRY=e2e VERSION="${E2E_TAG}" ALLOW_STALE_APT=1
 make test-tools REGISTRY=e2e
 
 function finish() {