diff --git a/docker/Dockerfile b/docker/Dockerfile
index 96f3ed37e..13a855fc1 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -37,6 +37,10 @@ WORKDIR /opal
 COPY scripts/wait-for.sh .
 RUN chmod +x ./wait-for.sh
 RUN ln -s /opal/wait-for.sh /usr/wait-for.sh
+
+# netcat (nc) is used by the wait-for.sh script
+RUN apt-get update && apt-get install -y netcat jq && apt-get clean
+
 # copy startup script (create link at old path to maintain backward compatibility)
 COPY ./scripts/start.sh .
 RUN chmod +x ./start.sh
@@ -124,8 +128,6 @@ FROM client-standalone as client-cedar
 # Temporarily move back to root for additional setup
 USER root
 
-RUN apt-get update && apt-get install -y netcat jq && apt-get clean
-
 # Copy cedar from its build stage
 COPY --from=cedar-builder /cedar-agent /bin/cedar-agent