diff --git a/gosigner.Dockerfile b/gosigner.Dockerfile
index 76f0dbf..09ed63e 100644
--- a/gosigner.Dockerfile
+++ b/gosigner.Dockerfile
@@ -3,12 +3,22 @@ FROM golang:alpine AS builder
 COPY cacert-gosigner /src/
 
 RUN set -ex ; \
-    cd /src/signer ; \
-    go build .
+    cd /src/cmd/signer ; \
+    CGO_ENABLED=0 go build .
 
-FROM alpine/socat:latest
+# need to use Debian because we need xdelta 1.x to support signer protocol
+# version 1
+FROM debian:buster-slim
 
-COPY --from=builder /src/signer/signer /app/
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive \
+    apt-get install -y --no-install-recommends \
+    socat \
+    xdelta \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /src/cmd/signer/signer /app/
 
 COPY docker/run-gosigner usr/local/bin/
 COPY docker/signer-config/* /srv/caconfig/
diff --git a/mail.Dockerfile b/mail.Dockerfile
index 2ea32fb..9ff5fd9 100644
--- a/mail.Dockerfile
+++ b/mail.Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:buster
+FROM debian:buster-slim
 
 RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive \