diff --git a/3.10/alpine3.21/Dockerfile b/3.10/alpine3.21/Dockerfile
index a3ec54a2c..e91793cfa 100644
--- a/3.10/alpine3.21/Dockerfile
+++ b/3.10/alpine3.21/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 ae665bc678abd9ab6a6e1573d2481625a53719bc517e9a634ed2b9fefae381
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.10/alpine3.22/Dockerfile b/3.10/alpine3.22/Dockerfile
index 5825dfc91..820b51313 100644
--- a/3.10/alpine3.22/Dockerfile
+++ b/3.10/alpine3.22/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 ae665bc678abd9ab6a6e1573d2481625a53719bc517e9a634ed2b9fefae381
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.11/alpine3.21/Dockerfile b/3.11/alpine3.21/Dockerfile
index 078086c67..a1f465616 100644
--- a/3.11/alpine3.21/Dockerfile
+++ b/3.11/alpine3.21/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 8fb5f9fbc7609fa822cb31549884575db7fd9657cbffb89510b5d7975963a8
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.11/alpine3.22/Dockerfile b/3.11/alpine3.22/Dockerfile
index c1680e4d4..73b6d1ea8 100644
--- a/3.11/alpine3.22/Dockerfile
+++ b/3.11/alpine3.22/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 8fb5f9fbc7609fa822cb31549884575db7fd9657cbffb89510b5d7975963a8
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.12/alpine3.21/Dockerfile b/3.12/alpine3.21/Dockerfile
index b4a1f5503..4f98f359a 100644
--- a/3.12/alpine3.21/Dockerfile
+++ b/3.12/alpine3.21/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7a
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.12/alpine3.22/Dockerfile b/3.12/alpine3.22/Dockerfile
index bef8c1968..afac11c47 100644
--- a/3.12/alpine3.22/Dockerfile
+++ b/3.12/alpine3.22/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7a
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.13/alpine3.21/Dockerfile b/3.13/alpine3.21/Dockerfile
index 33846a35d..676dd7adf 100644
--- a/3.13/alpine3.21/Dockerfile
+++ b/3.13/alpine3.21/Dockerfile
@@ -23,16 +23,13 @@ ENV PYTHON_SHA256 b9910730526b298299b46b35595ced9055722df60c06ad6301f6a4e2c728a2
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -44,10 +41,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.13/alpine3.22/Dockerfile b/3.13/alpine3.22/Dockerfile
index f32cbed2e..19acd8c79 100644
--- a/3.13/alpine3.22/Dockerfile
+++ b/3.13/alpine3.22/Dockerfile
@@ -23,16 +23,13 @@ ENV PYTHON_SHA256 b9910730526b298299b46b35595ced9055722df60c06ad6301f6a4e2c728a2
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -44,10 +41,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.14/alpine3.21/Dockerfile b/3.14/alpine3.21/Dockerfile
index 7c333923f..c3788113a 100644
--- a/3.14/alpine3.21/Dockerfile
+++ b/3.14/alpine3.21/Dockerfile
@@ -22,16 +22,13 @@ ENV PYTHON_SHA256 2299dae542d395ce3883aca00d3c910307cd68e0b2f7336098c8e7b7eee9f3
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -43,12 +40,15 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
+		zstd-dev \
 	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
diff --git a/3.14/alpine3.22/Dockerfile b/3.14/alpine3.22/Dockerfile
index 7b757165e..86ea2ccc6 100644
--- a/3.14/alpine3.22/Dockerfile
+++ b/3.14/alpine3.22/Dockerfile
@@ -22,16 +22,13 @@ ENV PYTHON_SHA256 2299dae542d395ce3883aca00d3c910307cd68e0b2f7336098c8e7b7eee9f3
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -43,12 +40,15 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
+		zstd-dev \
 	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
diff --git a/3.14/bookworm/Dockerfile b/3.14/bookworm/Dockerfile
index fc40a1d23..f802ef786 100644
--- a/3.14/bookworm/Dockerfile
+++ b/3.14/bookworm/Dockerfile
@@ -23,6 +23,12 @@ ENV PYTHON_VERSION 3.14.0
 ENV PYTHON_SHA256 2299dae542d395ce3883aca00d3c910307cd68e0b2f7336098c8e7b7eee9f3e9
 
 RUN set -eux; \
+	\
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		libzstd-dev \
+	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
 	echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; \
@@ -94,6 +100,20 @@ RUN set -eux; \
 	\
 	ldconfig; \
 	\
+	apt-mark auto '.*' > /dev/null; \
+	apt-mark manual $savedAptMark; \
+	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
+		| awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+		| sort -u \
+		| xargs -rt dpkg-query --search \
+# https://manpages.debian.org/bookworm/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+		| awk 'sub(":$", "", $1) { print $1 }' \
+		| sort -u \
+		| xargs -r apt-mark manual \
+	; \
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	rm -rf /var/lib/apt/lists/*; \
+	\
 	export PYTHONDONTWRITEBYTECODE=1; \
 	python3 --version; \
 	pip3 --version
diff --git a/3.14/slim-bookworm/Dockerfile b/3.14/slim-bookworm/Dockerfile
index 5208bfd3b..efc7d3a65 100644
--- a/3.14/slim-bookworm/Dockerfile
+++ b/3.14/slim-bookworm/Dockerfile
@@ -41,6 +41,7 @@ RUN set -eux; \
 		libreadline-dev \
 		libsqlite3-dev \
 		libssl-dev \
+		libzstd-dev \
 		make \
 		tk-dev \
 		uuid-dev \
diff --git a/3.14/slim-trixie/Dockerfile b/3.14/slim-trixie/Dockerfile
index 6b35ef69f..1abf7739d 100644
--- a/3.14/slim-trixie/Dockerfile
+++ b/3.14/slim-trixie/Dockerfile
@@ -41,6 +41,7 @@ RUN set -eux; \
 		libreadline-dev \
 		libsqlite3-dev \
 		libssl-dev \
+		libzstd-dev \
 		make \
 		tk-dev \
 		uuid-dev \
diff --git a/3.14/trixie/Dockerfile b/3.14/trixie/Dockerfile
index 6193c5ab5..7aa50e8b8 100644
--- a/3.14/trixie/Dockerfile
+++ b/3.14/trixie/Dockerfile
@@ -23,6 +23,12 @@ ENV PYTHON_VERSION 3.14.0
 ENV PYTHON_SHA256 2299dae542d395ce3883aca00d3c910307cd68e0b2f7336098c8e7b7eee9f3e9
 
 RUN set -eux; \
+	\
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		libzstd-dev \
+	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
 	echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; \
@@ -94,6 +100,20 @@ RUN set -eux; \
 	\
 	ldconfig; \
 	\
+	apt-mark auto '.*' > /dev/null; \
+	apt-mark manual $savedAptMark; \
+	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
+		| awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+		| sort -u \
+		| xargs -rt dpkg-query --search \
+# https://manpages.debian.org/bookworm/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+		| awk 'sub(":$", "", $1) { print $1 }' \
+		| sort -u \
+		| xargs -r apt-mark manual \
+	; \
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	apt-get dist-clean; \
+	\
 	export PYTHONDONTWRITEBYTECODE=1; \
 	python3 --version; \
 	pip3 --version
diff --git a/3.9/alpine3.21/Dockerfile b/3.9/alpine3.21/Dockerfile
index ec25bdb83..38b800a15 100644
--- a/3.9/alpine3.21/Dockerfile
+++ b/3.9/alpine3.21/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 61a42919e13d539f7673cf11d1c404380e28e540510860b9d242196e165709
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/3.9/alpine3.22/Dockerfile b/3.9/alpine3.22/Dockerfile
index 242d08b09..ff29c909d 100644
--- a/3.9/alpine3.22/Dockerfile
+++ b/3.9/alpine3.22/Dockerfile
@@ -28,16 +28,13 @@ ENV PYTHON_SHA256 61a42919e13d539f7673cf11d1c404380e28e540510860b9d242196e165709
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
 		bluez-dev \
 		bzip2-dev \
 		dpkg-dev dpkg \
 		findutils \
 		gcc \
 		gdbm-dev \
+		gnupg \
 		libc-dev \
 		libffi-dev \
 		libnsl-dev \
@@ -49,10 +46,12 @@ RUN set -eux; \
 		pax-utils \
 		readline-dev \
 		sqlite-dev \
+		tar \
 		tcl-dev \
 		tk \
 		tk-dev \
 		util-linux-dev \
+		xz \
 		xz-dev \
 		zlib-dev \
 	; \
diff --git a/Dockerfile-linux.template b/Dockerfile-linux.template
index b0ee03d7f..d58480c09 100644
--- a/Dockerfile-linux.template
+++ b/Dockerfile-linux.template
@@ -96,63 +96,86 @@ ENV PYTHON_SHA256 {{ .checksums.source.sha256 }}
 
 RUN set -eux; \
 	\
+{{ def build_deps: [
+	if is_alpine then
+		"bluez-dev",
+		"bzip2-dev",
+		"dpkg-dev dpkg",
+		"findutils",
+		"gcc",
+		"gdbm-dev",
+		"gnupg",
+		"libc-dev",
+		"libffi-dev",
+		"libnsl-dev",
+		"libtirpc-dev",
+		"linux-headers",
+		"make",
+		"ncurses-dev",
+		"openssl-dev",
+		"pax-utils",
+		"readline-dev",
+		"sqlite-dev",
+		"tar",
+		"tcl-dev",
+		"tk",
+		"tk-dev",
+		"util-linux-dev",
+		"xz",
+		"xz-dev",
+		"zlib-dev",
+		if IN(env.version; "3.9", "3.10", "3.11", "3.12", "3.13") then empty else
+			"zstd-dev"
+		end,
+		empty
+	else
+		if is_slim then
+			"dpkg-dev",
+			"gcc",
+			"gnupg",
+			"libbluetooth-dev",
+			"libbz2-dev",
+			"libc6-dev",
+			"libdb-dev",
+			"libffi-dev",
+			"libgdbm-dev",
+			"liblzma-dev",
+			"libncursesw5-dev",
+			"libreadline-dev",
+			"libsqlite3-dev",
+			"libssl-dev",
+			"make",
+			"tk-dev",
+			"uuid-dev",
+			"wget",
+			"xz-utils",
+			"zlib1g-dev",
+			empty
+		else empty end,
+		if IN(env.version; "3.9", "3.10", "3.11", "3.12", "3.13") then empty else
+			"libzstd-dev"
+		end,
+		empty
+	end
+] -}}
+{{ build_deps | if length > 0 then sort | ( -}}
 {{ if is_alpine then ( -}}
 	apk add --no-cache --virtual .build-deps \
-		gnupg \
-		tar \
-		xz \
-		\
-		bluez-dev \
-		bzip2-dev \
-		dpkg-dev dpkg \
-		findutils \
-		gcc \
-		gdbm-dev \
-		libc-dev \
-		libffi-dev \
-		libnsl-dev \
-		libtirpc-dev \
-		linux-headers \
-		make \
-		ncurses-dev \
-		openssl-dev \
-		pax-utils \
-		readline-dev \
-		sqlite-dev \
-		tcl-dev \
-		tk \
-		tk-dev \
-		util-linux-dev \
-		xz-dev \
-		zlib-dev \
+{{ map( -}}
+		{{ . }} \
+{{ ) | add -}}
 	; \
 	\
-{{ ) elif is_slim then ( -}}
+{{ ) else ( -}}
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
-		dpkg-dev \
-		gcc \
-		gnupg \
-		libbluetooth-dev \
-		libbz2-dev \
-		libc6-dev \
-		libdb-dev \
-		libffi-dev \
-		libgdbm-dev \
-		liblzma-dev \
-		libncursesw5-dev \
-		libreadline-dev \
-		libsqlite3-dev \
-		libssl-dev \
-		make \
-		tk-dev \
-		uuid-dev \
-		wget \
-		xz-utils \
-		zlib1g-dev \
+{{ map( -}}
+		{{ . }} \
+{{ ) | add -}}
 	; \
 	\
+{{ ) end -}}
 {{ ) else "" end -}}
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
 {{ if .checksums.source.sha256 then ( -}}
@@ -272,7 +295,7 @@ RUN set -eux; \
 		\) -exec rm -rf '{}' + \
 	; \
 	\
-{{ if is_alpine then ( -}}
+{{ if is_alpine and (build_deps | length > 0) then ( -}}
 	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \
 		| tr ',' '\n' \
 		| sort -u \
@@ -282,7 +305,7 @@ RUN set -eux; \
 	apk del --no-network .build-deps; \
 {{ ) else ( -}}
 	ldconfig; \
-{{ if is_slim then ( -}}
+{{ if build_deps | length > 0 then ( -}}
 	\
 	apt-mark auto '.*' > /dev/null; \
 	apt-mark manual $savedAptMark; \