diff --git a/iot-certbot/Dockerfile b/iot-certbot/Dockerfile
index e640e92..b7b70b1 100755
--- a/iot-certbot/Dockerfile
+++ b/iot-certbot/Dockerfile
@@ -1,5 +1,5 @@
 ARG BUILD_FROM
-FROM $BUILD_FROM
+FROM $BUILD_FROM AS build
 
 # setup base
 ARG \
@@ -9,31 +9,44 @@ ARG \
 
 # py3-pip is kept in the installation because otherwise it removes some dependencies
 # that we need (six)
-RUN \
-    set -x \
-    && apk add --no-cache --update \
+RUN apk add --no-cache --update \
         augeas \
         curl \
         libffi \
         musl \
         openssl \
         py3-pip \
-        python3 \
-    && apk add --no-cache --virtual .build-dependencies \
+        python3
+RUN apk add --no-cache --virtual .build-dependencies \
         augeas-dev \
         build-base \
         cargo \
         libffi-dev \
         musl-dev \
         openssl-dev \
-        python3-dev \
-    && python3 -mvenv /opt/certbot \
-    && /opt/certbot/bin/python -mpip install --no-cache-dir --find-links \
+        python3-dev
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+RUN python3 -mvenv /opt/certbot
+RUN /opt/certbot/bin/python -mpip install --no-cache-dir --find-links \
         "https://wheels.home-assistant.io/alpine-$(cut -d '.' -f 1-2 < /etc/alpine-release)/${BUILD_ARCH}/" \
         cryptography==${CRYPTOGRAPHY_VERSION} \
         certbot==${CERTBOT_VERSION} \
-        certbot-dns-route53==${CERTBOT_VERSION} \
-    && apk del .build-dependencies
+        certbot-dns-route53==${CERTBOT_VERSION}
+
+FROM $BUILD_FROM
+
+# Install the runtime dependencies in this layer
+RUN apk add --no-cache --update \
+        augeas \
+        curl \
+        libffi \
+        musl \
+        openssl \
+        py3-pip \
+        python3
+
+# Copy virtualenv
+COPY --from=build /opt/certbot /opt/certbot
 
 # Copy data
 COPY rootfs /