diff --git a/Containerfile b/Containerfile
index 4930db7..cbcb9ea 100644
--- a/Containerfile
+++ b/Containerfile
@@ -16,10 +16,11 @@ RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 RUN pip install --no-cache-dir --upgrade pip wheel
 
-# Install Python dependencies (includes security pins for setuptools, jaraco.context)
+# Install Python dependencies (includes security pins from requirements.txt)
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt gunicorn \
-    && rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco.context*.dist-info
+    && pip cache purge 2>/dev/null || true \
+    && rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco*
 
 
 # Stage 2: Runtime image
@@ -32,7 +33,8 @@ LABEL description="Lightweight secure pastebin REST API"
 # Note: System packages upgraded for Trivy scan; app runs from venv
 RUN apt clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
     && pip install --no-cache-dir --upgrade pip 'setuptools>=80.0' 'jaraco.context>=6.1.0' \
-    && rm -rf /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco.context*.dist-info \
+    && pip cache purge 2>/dev/null || true \
+    && rm -rf /root/.cache /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco* \
     && groupadd -r flaskpaste && useradd -r -g flaskpaste flaskpaste
 
 # Copy virtual environment from builder
diff --git a/Containerfile.slim b/Containerfile.slim
index 53b91e2..6499bf0 100644
--- a/Containerfile.slim
+++ b/Containerfile.slim
@@ -16,12 +16,13 @@ RUN apk add --no-cache gcc musl-dev libffi-dev
 # Create virtual environment and upgrade pip
 RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
-RUN pip install --no-cache-dir --upgrade "pip>=25.3" wheel
+RUN pip install --no-cache-dir --upgrade pip wheel
 
 # Install Python dependencies (includes security pins from requirements.txt)
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt gunicorn && \
-    pip install --no-cache-dir --force-reinstall --no-deps "jaraco.context>=6.1.0"
+RUN pip install --no-cache-dir -r requirements.txt gunicorn \
+    && pip cache purge 2>/dev/null || true \
+    && rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco*
 
 
 # Stage 2: Alpine runtime (minimal)
@@ -30,12 +31,10 @@ FROM python:3.11-alpine
 LABEL maintainer="FlaskPaste"
 LABEL description="Minimal secure pastebin REST API (Alpine)"
 
-# Apply security fixes to base image (versions from requirements.txt)
-COPY requirements.txt /tmp/
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /tmp/requirements.txt && \
-    pip install --no-cache-dir --force-reinstall --no-deps "jaraco.context>=6.1.0" && \
-    rm /tmp/requirements.txt
+# Apply security fixes to base image, remove vendored vulnerable packages
+RUN pip install --no-cache-dir --upgrade pip 'setuptools>=80.0' 'jaraco.context>=6.1.0' \
+    && pip cache purge 2>/dev/null || true \
+    && rm -rf /root/.cache /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco*
 
 # Create non-root user
 RUN addgroup -g 65532 -S flaskpaste && adduser -u 65532 -S -G flaskpaste flaskpaste