diff --git a/Dockerfile b/Dockerfile
index d8fae5c..0e22ff2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,14 +33,18 @@ RUN golangci-lint run --config .golangci.yml ./...
 # golang:1.24.13-bookworm, 2026-10-06
 FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
 WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
 COPY . .
 RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
 # -p 4 because test runs on a shared build host cap their parallelism.
-RUN go test -p 4 -timeout 90s -race -cover ./... || \
+# The modules download in this RUN rather than a layer of their own, because
+# exporting a layer that holds them is slow. Nothing reads them or the build
+# cache afterwards, so go clean removes both.
+RUN set -e; \
+    go mod download; \
+    go test -p 4 -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
-      go test -p 4 -timeout 90s -race -v ./...; exit 1; }
+      go test -p 4 -timeout 90s -race -v ./...; exit 1; }; \
+    go clean -cache -modcache
 
 # Build stage. Nothing is wanted from either phase above; the copies
 # are what make BuildKit build them first, so this stage cannot run