diff --git a/Dockerfile b/Dockerfile
index 75cd14a..5be5dbb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 
 # Prevent .pyc files and enable unbuffered stdout/stderr
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -6,14 +6,27 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /app
 
-# Install build tools for C extensions (e.g. TgCrypto), then clean up
+# Install build tools in builder stage only
 RUN apt-get update && \
     apt-get install -y --no-install-recommends gcc libc6-dev && \
     rm -rf /var/lib/apt/lists/*
 
 # Install deps first — layer cache reuse on code-only changes
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-cache-dir -r requirements.txt
+
+# Runtime stage - clean slate
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# Copy only installed packages from builder
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 
 # Copy source
 COPY main.py config.py ./
@@ -29,4 +42,4 @@ USER botuser
 # Persistent volume for Pyrogram session and logs
 VOLUME ["/app/storage", "/app/logs"]
 
-CMD ["python", "main.py"]
\ No newline at end of file
+CMD ["python", "main.py"]