diff --git a/Dockerfile b/Dockerfile
index a7000f5e..2356dbe3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -142,11 +142,25 @@ FROM ${RUNNER_IMAGE} AS final
 # compile cache. Read at runtime by Microwaveprop.Application.build_timestamp/0.
 ARG BUILD_TIMESTAMP=unknown
 
+# Base runtime deps, without cdo. `APT::Keep-Downloaded-Packages=false`
+# deletes each .deb immediately after install so apt's archive cache
+# doesn't pile up and OOM the /var/cache/apt disk partition the CI
+# builder runs on.
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
+  && apt-get -o APT::Keep-Downloaded-Packages=false install -y --no-install-recommends \
      libstdc++6 openssl libncurses6 locales ca-certificates snmp \
-     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 cdo \
-  && rm -rf /var/lib/apt/lists/*
+     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
+
+# cdo is ~1 GB of transitive deps (netCDF, HDF5, ecCodes, Fortran
+# runtime). Splitting into its own RUN layer means the base deps above
+# are already extracted + pruned before the cdo cache starts filling,
+# which is what kept the image under the 2 GB CI disk cap.
+RUN apt-get update \
+  && apt-get -o APT::Keep-Downloaded-Packages=false install -y --no-install-recommends cdo \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
 
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen