diff --git a/.gitignore b/.gitignore
index 101e251..1077f43 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,6 +22,8 @@ config.json
 settings.json
 *.db
 
+# go.sum is intentionally committed once populated by go mod tidy
+
 # OS
 .DS_Store
 Thumbs.db
diff --git a/backend/go.sum b/backend/go.sum
new file mode 100644
index 0000000..e69de29
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 0e2298d..c52802e 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -11,8 +11,10 @@ RUN npm run build
 FROM golang:1.22-alpine AS backend-builder
 
 WORKDIR /app/backend
-COPY backend/go.mod backend/go.sum ./
-RUN go mod download
+# Copy go.mod first for layer caching. go.sum is written by go mod download
+# when it doesn't exist yet (skeleton project), or verified when it does.
+COPY backend/go.mod ./
+RUN go mod download -x
 COPY backend/ ./
 # CGO disabled — pure Go SQLite (modernc.org/sqlite).
 RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /archivum ./cmd/server