diff --git a/Dockerfile b/Dockerfile
index d5093f5..928afc6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,13 @@ RUN curl -fSL https://ziglang.org/download/0.15.2/zig-x86_64-linux-0.15.2.tar.xz
     | tar xJ -C /opt
 ENV PATH=/opt/zig-x86_64-linux-0.15.2:$PATH
 WORKDIR /build
-COPY . .
+
+# fetch dependencies first (cacheable — only changes when build.zig.zon changes)
+COPY build.zig build.zig.zon ./
+RUN zig build --fetch-only 2>/dev/null || true
+
+# then copy source and build
+COPY src/ src/
 RUN zig build -Doptimize=ReleaseSafe -Dcpu=baseline -Dtarget=x86_64-linux-gnu
 
 FROM --platform=linux/amd64 debian:bookworm-slim
diff --git a/build.zig.zon b/build.zig.zon
index b972492..e3d5147 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -5,12 +5,12 @@
     .minimum_zig_version = "0.15.0",
     .dependencies = .{
         .zat = .{
-            .url = "https://tangled.org/zat.dev/zat/archive/v0.2.7.tar.gz",
-            .hash = "zat-0.2.7-5PuC7oC4BADf6cKEjxRsLlg8SVYDbC1SAQanOLqMl2-Q",
+            .url = "https://tangled.org/zat.dev/zat/archive/v0.2.8.tar.gz",
+            .hash = "zat-0.2.8-5PuC7n-4BACVD9BxQgIOOUh2XZDxp735dXw0E5eJmtc8",
         },
         .websocket = .{
-            .url = "https://github.com/karlseguin/websocket.zig/archive/97fefafa59cc78ce177cff540b8685cd7f699276.tar.gz",
-            .hash = "websocket-0.1.0-ZPISdRlzAwBB_Bz2UMMqxYqF6YEVTIBoFsbzwPUJTHIc",
+            .url = "https://github.com/zzstoatzz/websocket.zig/archive/50f179cfcb307e4872386658160a451fcdc7738d.tar.gz",
+            .hash = "websocket-0.1.0-ZPISddZzAwC_4VR6gW24TQVEVfplV0lEr16AyH0InGMX",
         },
         .pg = .{
             .url = "git+https://github.com/karlseguin/pg.zig?ref=master#e58b318b7867ef065b3135983f829219c5eef891",