diff --git a/Dockerfile.in b/Dockerfile.in
index bac9a2f..0b8f844 100644
--- a/Dockerfile.in
+++ b/Dockerfile.in
@@ -49,6 +49,10 @@
 #############################################################################
 FROM {ARG_FROM} as prep
 
+# When building, we can pass a unique value (e.g. `date +%s`) for this arg,
+# which will force a rebuild from here (by invalidating docker's cache).
+ARG FORCE_REBUILD=0
+
 RUN apt-get -q -y update
 RUN apt-get -q -y upgrade
 RUN apt-get -q -y install --no-install-recommends \
@@ -78,12 +82,20 @@ RUN echo "git-sync:x:65533:git-sync" >> /etc/group
 # are handling permissions themselves.
 RUN mkdir -m 02775 /git && chown 65533:65533 /git
 
-# Add the platform-specific binary.
-COPY bin/{ARG_OS}_{ARG_ARCH}/{ARG_BIN} /{ARG_BIN}
+# When building, we can pass a hash of the licenses tree, which docker checks
+# against its cache and can force a rebuild from here.
+ARG HASH_LICENSES=0
 
 # Add third-party licenses.
 COPY .licenses/ /LICENSES/
 
+# When building, we can pass a hash of the binary, which docker checks against
+# its cache and can force a rebuild from here.
+ARG HASH_BINARY=0
+
+# Add the platform-specific binary.
+COPY bin/{ARG_OS}_{ARG_ARCH}/{ARG_BIN} /{ARG_BIN}
+
 #############################################################################
 # Now we make a "clean" final image.
 #############################################################################
diff --git a/Makefile b/Makefile
index 7d3f397..4e4ddae 100644
--- a/Makefile
+++ b/Makefile
@@ -19,10 +19,10 @@ BIN := git-sync
 REGISTRY ?= gcr.io/k8s-staging-git-sync
 
 # This version-strategy uses git tags to set the version string
-VERSION := $(shell git describe --tags --always --dirty)
+VERSION ?= $(shell git describe --tags --always --dirty)
 #
 # This version-strategy uses a manual value to set the version string
-#VERSION := 1.2.3
+#VERSION ?= 1.2.3
 
 ###
 ### These variables should not need tweaking.
@@ -130,6 +130,9 @@ $(LICENSES):
 	@./bin/tools/go-licenses save ./... --save_path=$(LICENSES)
 	@chmod -R a+rx $(LICENSES)
 
+# Set this to any value to skip repeating the apt-get steps.  Caution.
+ALLOW_STALE_APT ?=
+
 container: .container-$(DOTFILE_IMAGE) container-name
 .container-$(DOTFILE_IMAGE): bin/$(OS)_$(ARCH)/$(BIN) $(LICENSES) Dockerfile.in
 	@sed                                 \
@@ -138,15 +141,23 @@ container: .container-$(DOTFILE_IMAGE) container-name
 	    -e 's|{ARG_OS}|$(OS)|g'          \
 	    -e 's|{ARG_FROM}|$(BASEIMAGE)|g' \
 	    Dockerfile.in > .dockerfile-$(OS)_$(ARCH)
-	@docker buildx build                       \
-	    --no-cache                             \
-	    --progress=plain                       \
-	    --load                                 \
-	    --platform "$(OS)/$(ARCH)"             \
-	    --build-arg HTTP_PROXY=$(HTTP_PROXY)   \
-	    --build-arg HTTPS_PROXY=$(HTTPS_PROXY) \
-	    -t $(IMAGE):$(TAG)                     \
-	    -f .dockerfile-$(OS)_$(ARCH)           \
+	@HASH_LICENSES=$$(find $(LICENSES) -type f                    \
+	    | xargs md5sum | md5sum | cut -f1 -d' ');                 \
+	 HASH_BINARY=$$(md5sum bin/$(OS)_$(ARCH)/$(BIN)               \
+	    | cut -f1 -d' ');                                         \
+	 FORCE=0;                                                     \
+	 if [ -z "$(ALLOW_STALE_APT)" ]; then FORCE=$$(date +%s); fi; \
+	 docker buildx build                                          \
+	    --build-arg FORCE_REBUILD="$$FORCE"                       \
+	    --build-arg HASH_LICENSES="$$HASH_LICENSES"               \
+	    --build-arg HASH_BINARY="$$HASH_BINARY"                   \
+	    --progress=plain                                          \
+	    --load                                                    \
+	    --platform "$(OS)/$(ARCH)"                                \
+	    --build-arg HTTP_PROXY=$(HTTP_PROXY)                      \
+	    --build-arg HTTPS_PROXY=$(HTTPS_PROXY)                    \
+	    -t $(IMAGE):$(TAG)                                        \
+	    -f .dockerfile-$(OS)_$(ARCH)                              \
 	    .
 	@docker images -q $(IMAGE):$(TAG) > $@
 
diff --git a/test_e2e.sh b/test_e2e.sh
index 2becc09..ab50ed3 100755
--- a/test_e2e.sh
+++ b/test_e2e.sh
@@ -98,6 +98,10 @@ function docker_kill() {
     docker kill "$1" >/dev/null
 }
 
+# E2E_TAG is the tag used for docker builds.  This is needed because docker
+# tags are system-global, but one might have multiple repos checked out.
+E2E_TAG=$(git rev-parse --show-toplevel | sed 's|/|_|g')
+
 # DIR is the directory in which all this test's state lives.
 RUNID="${RANDOM}${RANDOM}"
 DIR="/tmp/git-sync-e2e.$RUNID"
@@ -175,7 +179,7 @@ function GIT_SYNC() {
         -v "$RUNLOG":/var/log/runs \
         -v "$DOT_SSH/id_test":"/etc/git-secret/ssh":ro \
         --env XDG_CONFIG_HOME=$DIR \
-        e2e/git-sync:$(make -s version)__$(go env GOOS)_$(go env GOARCH) \
+        e2e/git-sync:"${E2E_TAG}"__$(go env GOOS)_$(go env GOARCH) \
             -v=6 \
             --add-user \
             "$@"
@@ -2205,7 +2209,7 @@ if [[ "$#" == 0 ]]; then
 fi
 
 # Build it
-make container REGISTRY=e2e VERSION=$(make -s version)
+make container REGISTRY=e2e VERSION="${E2E_TAG}" ALLOW_STALE_APT=1
 make test-tools REGISTRY=e2e
 
 function finish() {