diff --git a/CHANGELOG.md b/CHANGELOG.md
index 06b7ed7..e31a342 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,13 @@ All notable changes to this project will be documented in this file.
  
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## 2026-06-27 (continued 7)
+
+### Changed
+
+- Reorder Dockerfile layers for better cache utilisation: `apk` packages now install before S6 overlay is added, and S6 is extracted in its own `RUN` step. Previously a S6 version bump invalidated the entire apk + pip chain; now each concern caches independently.
+- Use `--mount=type=cache,id=apk-${TARGETARCH}` for the `apk` step (consistent with the existing pip cache mount).
+
 ## 2026-06-27 (continued 6)
 
 ### Fixed
diff --git a/Dockerfile b/Dockerfile
index 1df0e25..6d85f28 100755
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,18 +14,11 @@ ENV S6_OVERLAY_ARCH=x86_64
 FROM base AS base-arm64
 ENV S6_OVERLAY_ARCH=aarch64
 
+# hadolint ignore=DL3006
 FROM base-${TARGETARCH}${TARGETVARIANT}
 
 ARG S6_OVERLAY_VERSION=3.2.3.0
 
-# Add S6 Overlay
-ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz /tmp/s6-overlay.tar.xz
-ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
-
-# Add S6 optional symlinks
-ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz /tmp
-ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz /tmp
-
 ENV LANG='en_US.UTF-8'                      \
     LANGUAGE='en_US.UTF-8'                  \
     S6_LOGGING="1"                          \
@@ -33,27 +26,23 @@ ENV LANG='en_US.UTF-8'                      \
     S6_CMD_WAIT_FOR_SERVICES_MAXTIME="0"     \
     TZ="Europe/London"
 
-RUN <<EOF
-    set -xe
-    apk upgrade --update --no-cache
-    tar -C / -Jxpf /tmp/s6-overlay.tar.xz
-    tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
-    tar -C / -Jxpf /tmp/s6-overlay-symlinks-noarch.tar.xz
-    tar -C / -Jxpf /tmp/s6-overlay-symlinks-arch.tar.xz
-    rm -rf /tmp/*.tar.xz
-
-    apk add --no-cache -U   \
-        bash                \
-        bash-completion     \
-        btrfs-progs         \
-        ca-certificates     \
-        curl                \
-        findmnt             \
-        fuse                \
-        acl-libs            \
-        libxxhash           \
-        logrotate           \
-        lz4-libs            \
+# Install system packages first — this layer is independent of S6 and borgmatic
+# versions, so it stays cached across S6 bumps and requirements.txt changes.
+# hadolint ignore=DL3005,DL3018,DL3019,DL3059
+RUN --mount=type=cache,id=apk-${TARGETARCH},target=/etc/apk/cache \
+    apk upgrade -U && \
+    apk add -U          \
+        bash            \
+        bash-completion \
+        btrfs-progs     \
+        ca-certificates \
+        curl            \
+        findmnt         \
+        fuse            \
+        acl-libs        \
+        libxxhash       \
+        logrotate       \
+        lz4-libs        \
         mariadb-client      \
         mariadb-connector-c \
         mongodb-tools       \
@@ -63,6 +52,22 @@ RUN <<EOF
         sqlite              \
         tzdata              \
         xxhash
+
+# hadolint ignore=DL3059
+# Add S6 Overlay — separate layer so S6 bumps don't invalidate the apk layer
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz /tmp/s6-overlay.tar.xz
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz /tmp
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz /tmp
+
+# hadolint ignore=DL3059
+RUN <<EOF
+    set -xe
+    tar -C / -Jxpf /tmp/s6-overlay.tar.xz
+    tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
+    tar -C / -Jxpf /tmp/s6-overlay-symlinks-noarch.tar.xz
+    tar -C / -Jxpf /tmp/s6-overlay-symlinks-arch.tar.xz
+    rm -rf /tmp/*.tar.xz
 EOF
 
 COPY --link requirements.txt /