diff --git a/.gitea/workflows/ci-image.yml b/.gitea/workflows/ci-image.yml
index 3ee05f3..147a3df 100644
--- a/.gitea/workflows/ci-image.yml
+++ b/.gitea/workflows/ci-image.yml
@@ -18,7 +18,7 @@ jobs:
               uses: actions/checkout@v4
 
             - name: Install Docker CLI
-              run: apk add --no-cache docker-cli
+              run: apk add --no-cache docker-cli docker-cli-buildx
 
             - name: Login to registry
               run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.aramjonghu.dev --username aramjonghu --password-stdin
diff --git a/ci/Dockerfile b/ci/Dockerfile
index c585b6d..98c21f7 100644
--- a/ci/Dockerfile
+++ b/ci/Dockerfile
@@ -1,57 +1,28 @@
 FROM archlinux:latest
 
-RUN pacman -Syyu --noconfirm
+RUN pacman -Syu --noconfirm \
+ && pacman -S --needed --noconfirm \
+      base-devel cmake ninja clang lld nodejs tree-sitter \
+      jkqtplotter cmark-gfm git \
+      qt6-base qt6-declarative qt6-shadertools qt6-5compat \
+      qt6-canvaspainter hyprwayland-scanner \
+      libqalculate pipewire aubio cava lm_sensors glib2 \
+ && pacman -Scc --noconfirm
 
-# Build toolchain
-RUN pacman -S --noconfirm \
-    base-devel \
-    cmake \
-    ninja \
-    clang \
-    lld \
-    nodejs \
-    tree-sitter \
-    jkqtplotter \
-    cmark-gfm \
-    git
-
-# Qt6
-RUN pacman -S --noconfirm \
-    qt6-base \
-    qt6-declarative \
-    qt6-shadertools \
-    qt6-5compat \
-    qt6-canvaspainter \
-    hyprwayland-scanner
-
-# Project-specific dependencies
-RUN pacman -S --noconfirm \
-    libqalculate \
-    pipewire \
-    aubio \
-    cava \
-    lm_sensors \
-    glib2
-
-# AUR: libcava (provides development headers for cava)
-RUN pacman -Syu --noconfirm && \
-    pacman -S --needed --noconfirm \
-        sudo \
-        meson \
-        autoconf-archive \
-        python-tqdm && \
-    useradd -m builder && \
-    echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-
-RUN for i in 1 2 3 4 5; do \
-        rm -rf /tmp/libcava && \
-        git clone --depth 1 https://aur.archlinux.org/libcava.git /tmp/libcava && \
-        break || sleep 5; \
-    done && \
-    test -d /tmp/libcava/.git && \
-    chown -R builder /tmp/libcava
-
-RUN su builder -c "cd /tmp/libcava && makepkg -si --noconfirm" && \
-    rm -rf /tmp/libcava && \
-    userdel -r builder && \
-    sed -i '/^builder/d' /etc/sudoers
+RUN pacman -Syu --noconfirm \
+ && pacman -S --needed --noconfirm \
+      sudo meson autoconf-archive python-tqdm \
+ && useradd -m builder \
+ && printf '%s\n' 'builder ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/builder \
+ && chmod 0440 /etc/sudoers.d/builder \
+ && for i in 1 2 3 4 5; do \
+      rm -rf /tmp/libcava; \
+      if git clone --depth 1 https://aur.archlinux.org/libcava.git /tmp/libcava; then break; fi; \
+      sleep 5; \
+    done \
+ && test -d /tmp/libcava/.git \
+ && chown -R builder:builder /tmp/libcava \
+ && su builder -c "cd /tmp/libcava && makepkg -si --noconfirm" \
+ && rm -rf /tmp/libcava /etc/sudoers.d/builder \
+ && userdel -r builder \
+ && pacman -Scc --noconfirm