diff --git a/.forgejo/workflows/image.yaml b/.forgejo/workflows/image.yaml
index d0e46d5..87eadc8 100644
--- a/.forgejo/workflows/image.yaml
+++ b/.forgejo/workflows/image.yaml
@@ -62,7 +62,7 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build --no-cache -f buildctx/Dockerfile.ci \
+          docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker run --rm "${IMAGE}:main-${SHORT}" \
             /app/.venv/bin/python -c "import asyncpg; print('asyncpg ok')"
diff --git a/Dockerfile b/Dockerfile
index 355764e..261e08d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,13 +13,20 @@ RUN apt-get update \
 
 COPY pyproject.toml ./
 
+# Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
+ARG DEPS_LOCK_ID=2
 RUN python - <<'PY' > /tmp/requirements.txt
+import sys
 import tomllib
 
 with open("pyproject.toml", "rb") as f:
     project = tomllib.load(f)["project"]
 
-for dep in project["dependencies"]:
+deps = project.get("dependencies") or []
+if not deps:
+    sys.exit("pyproject.toml has no dependencies")
+
+for dep in deps:
     # llm-connect is a local editable test integration and must not be pulled
     # into the production image. hub-core is runtime code, but it is installed
     # from the named Docker build context below because it is not published yet.
@@ -27,6 +34,7 @@ for dep in project["dependencies"]:
         continue
     print(dep)
 PY
+RUN test -s /tmp/requirements.txt
 
 RUN uv venv /app/.venv \
     && uv pip install --python /app/.venv/bin/python --no-cache -r /tmp/requirements.txt