diff --git a/.dockerignore b/.dockerignore
index 19b1345e..8358162e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -19,4 +19,7 @@
 **/bin
 **/obj
 **/target
-**/node_modules
\ No newline at end of file
+**/node_modules
+
+# don't clear docker cache when updating dockerfiles
+Dockerfile
\ No newline at end of file
diff --git a/.github/workflows/api.yml b/.github/workflows/api.yml
index 5b6746cd..b198a90b 100644
--- a/.github/workflows/api.yml
+++ b/.github/workflows/api.yml
@@ -1,3 +1,8 @@
+# todo: use https://github.com/jpribyl/action-docker-layer-caching
+# todo: make this generic for all Rust images in this repo
+# todo: don't use docker/build-push-action
+# todo: run builds on pull request
+
 name: Build and push API Docker image
 on:
   push:
@@ -26,7 +31,7 @@ jobs:
         with:
           # https://github.com/docker/build-push-action/issues/378
           context: .
-          file: services/api/Dockerfile
+          file: Dockerfile.rust
           push: true
           tags: |
             ghcr.io/pluralkit/api:${{ env.BRANCH_NAME }}
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
deleted file mode 100644
index 1ca6213d..00000000
--- a/.github/workflows/gateway.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Build gateway Docker image
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'gateway/**'
-      - 'proto/**'
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    if: github.repository == 'PluralKit/PluralKit'
-    steps:
-      - uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.CR_PAT }}
-      - uses: actions/checkout@v2
-      - run: echo "BRANCH_NAME=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - uses: docker/build-push-action@v2
-        with:
-          # https://github.com/docker/build-push-action/issues/378
-          context: .
-          file: gateway/Dockerfile
-          push: true
-          tags: |
-            ghcr.io/pluralkit/gateway:${{ env.BRANCH_NAME }}
-            ghcr.io/pluralkit/gateway:${{ github.sha }}
-            ghcr.io/pluralkit/gateway:latest
-          cache-from: type=registry,ref=ghcr.io/pluralkit/gateway:${{ env.BRANCH_NAME }}
-          cache-to: type=inline
diff --git a/.gitignore b/.gitignore
index f43417ac..3958d8d5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,4 @@ pluralkit.*.conf
 # Generated
 logs/
 .version
+recipe.json
\ No newline at end of file
diff --git a/Cargo.toml b/Cargo.toml
index 676f5e4e..fa978adc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,4 +4,10 @@ members = [
     "./services/api"
 ]
 
-# todo: add workspace dependencies here
\ No newline at end of file
+[workspace.dependencies]
+anyhow = "1"
+fred = { version = "5.2.0", default-features = false, features = ["tracing", "pool-prefer-active"] }
+lazy_static = "1.4.0"
+serde = "1.0.152"
+tokio = { version = "1.25.0", features = ["full"] }
+tracing = "0.1.37"
diff --git a/Dockerfile.rust b/Dockerfile.rust
new file mode 100644
index 00000000..092cd9cb
--- /dev/null
+++ b/Dockerfile.rust
@@ -0,0 +1,34 @@
+FROM alpine:latest AS builder
+
+WORKDIR /build
+
+RUN apk add rustup build-base
+# todo: arm64 target
+RUN rustup-init --default-host x86_64-unknown-linux-musl --default-toolchain stable --profile default -y
+
+ENV PATH=/root/.cargo/bin:$PATH
+ENV RUSTFLAGS='-C link-arg=-s'
+
+RUN cargo install cargo-chef --locked
+
+# build dependencies first to cache
+FROM builder AS recipe-builder
+COPY . .
+RUN cargo chef prepare --recipe-path recipe.json
+
+FROM builder AS binary-builder
+COPY --from=recipe-builder /build/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json --target x86_64-unknown-linux-musl
+
+COPY Cargo.toml /build/
+COPY Cargo.lock /build/
+
+# this needs to match workspaces in Cargo.toml
+COPY lib/libpk /build/lib/libpk
+COPY services/api/ /build/services/api
+
+RUN cargo build --bin api --release --target x86_64-unknown-linux-musl
+
+FROM scratch 
+
+COPY --from=binary-builder /build/target/x86_64-unknown-linux-musl/release/api /api
diff --git a/lib/libpk/Cargo.toml b/lib/libpk/Cargo.toml
index d0926993..5ae30d86 100644
--- a/lib/libpk/Cargo.toml
+++ b/lib/libpk/Cargo.toml
@@ -3,15 +3,13 @@ name = "libpk"
 version = "0.1.0"
 edition = "2021"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
-anyhow = "1.0.69"
+anyhow = { workspace = true } 
 config = "0.13.3"
 gethostname = "0.4.1"
-lazy_static = "1.4.0"
-serde = "1.0.152"
-tokio = { version = "1.25.0", features = ["full"] }
-tracing = "0.1.37"
+lazy_static = { workspace = true }
+serde = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
 tracing-gelf = "0.7.1"
 tracing-subscriber = { version = "0.3.16", features = ["env-filter"] }
diff --git a/services/api/Cargo.toml b/services/api/Cargo.toml
index 6aa6beff..d38d1091 100644
--- a/services/api/Cargo.toml
+++ b/services/api/Cargo.toml
@@ -3,16 +3,14 @@ name = "api"
 version = "0.1.0"
 edition = "2021"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
-anyhow = "1.0.69"
+anyhow = { workspace = true } 
 axum = "0.6.4"
-fred = { version = "5.2.0", default-features = false, features = ["tracing", "pool-prefer-active"] }
+fred = { workspace = true }
 http = "0.2.8"
 hyper-reverse-proxy = "0.5.1"
 lazy_static = "1.4.0"
 libpk = { path = "../../lib/libpk" }
-tokio = { version = "1.25.0", features = ["full"] }
+tokio = { workspace = true }
 tower = "0.4.13"
-tracing = "0.1.37"
+tracing = { workspace = true }
diff --git a/services/api/Dockerfile b/services/api/Dockerfile
deleted file mode 100644
index 461c9733..00000000
--- a/services/api/Dockerfile
+++ /dev/null
@@ -1,27 +0,0 @@
-FROM alpine:latest AS builder
-
-WORKDIR /build
-
-RUN apk add rustup build-base
-# todo: arm64 target
-RUN rustup-init --default-host x86_64-unknown-linux-musl --default-toolchain stable --profile default -y
-
-COPY Cargo.toml /build/
-COPY Cargo.lock /build/
-
-# todo: fetch dependencies first to cache
-# RUN cargo fetch
-
-COPY lib/libpk /build/lib/libpk
-COPY services/api/ /build/services/api
-
-RUN source "$HOME/.cargo/env" && RUSTFLAGS='-C link-arg=-s' cargo build --bin api --release --target x86_64-unknown-linux-musl
-
-RUN ls /build/target
-RUN ls /build/target/release
-
-FROM alpine:latest
-
-COPY --from=builder /build/target/x86_64-unknown-linux-musl/release/api /bin/api
-
-ENTRYPOINT [ "/bin/api" ]