diff --git a/CHANGELOG.md b/CHANGELOG.md
index 613361cd..e2720d72 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Changes
+
+- **The prebuilt Docker image (`ghcr.io/domainaware/parsedmarc`) is roughly 40% smaller to pull** ([#893](https://github.com/domainaware/parsedmarc/pull/893)). The runtime stage copied the built wheel out of the build stage and deleted it again at the end of the next `RUN`, but a `RUN` can only write a whiteout over a layer an earlier instruction already committed: the wheel shipped in every published image and every `docker pull` downloaded it (10,713,473 bytes of the 11.0.0 image, on both architectures). The wheel is now bind-mounted from the build stage instead, and a bind mount is never committed to a layer. `pip install` also runs with `--no-cache-dir`, which drops a further ~99 MB of pip's download cache that the image had been carrying in the same layer as `site-packages`. Measured on linux/amd64: 272,138,724 compressed bytes across six layers before, 163,757,439 across five after.
+
 ## 11.0.1
 
 ### Security
diff --git a/Dockerfile b/Dockerfile
index b9f1248d..fbe0b652 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,8 +23,12 @@ ARG USERNAME
 ARG USER_UID
 ARG USER_GID
 
-COPY --from=build /app/dist/*.whl /tmp/dist/
-RUN set -ex; \
+# The wheel is bind-mounted from the `build` stage rather than copied in with
+# COPY: a COPY commits the wheel to its own layer, which a later `rm` can only
+# write a whiteout over, so the wheel would ship in every pull. A bind mount is
+# never committed to a layer.
+RUN --mount=type=bind,from=build,source=/app/dist,target=/tmp/dist \
+    set -ex; \
     groupadd --gid ${USER_GID} ${USERNAME}; \
     useradd --uid ${USER_UID} --gid ${USER_GID} -m ${USERNAME}; \
     # Install the wheel with the [all] and [postgresql] extras so the prebuilt
@@ -38,8 +42,7 @@ RUN set -ex; \
     # manylinux wheels for both amd64 and arm64, so this adds no source-build
     # step on either platform.
     whl="$(ls /tmp/dist/*.whl)"; \
-    pip install "${whl}[all,postgresql]"; \
-    rm -rf /tmp/dist
+    pip install --no-cache-dir "${whl}[all,postgresql]"
 
 USER $USERNAME