diff --git a/Dockerfile b/Dockerfile
index 7db3297..00dea0a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,41 +9,41 @@ COPY abra/ ./
 COPY .git/modules/abra /gitdir
 # abra ships its dependencies in vendor/, so the build itself needs no network
 RUN set -eu; \
-    sed -i '/worktree =/d' /gitdir/config; \
-    version="$(git --git-dir=/gitdir describe --tags)"; \
-    commit="$(git --git-dir=/gitdir rev-parse HEAD)"; \
-    echo "building abra $version"; \
-    go build -mod=vendor -trimpath \
-        -ldflags "-s -w -X 'main.Version=$version' -X 'main.Commit=$commit'" \
-        -o /out/abra ./cmd/abra
+  sed -i '/worktree =/d' /gitdir/config; \
+  version="$(git --git-dir=/gitdir describe --tags)"; \
+  commit="$(git --git-dir=/gitdir rev-parse HEAD)"; \
+  echo "building abra $version"; \
+  go build -mod=vendor -trimpath \
+  -ldflags "-s -w -X 'main.Version=$version' -X 'main.Commit=$commit'" \
+  -o /out/abra ./cmd/abra
 
 FROM python:3.11-slim AS deps
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends gcc libc6-dev \
-    && rm -rf /var/lib/apt/lists/*
+  && apt-get install -y --no-install-recommends gcc libc6-dev \
+  && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt /tmp/requirements.txt
 RUN python -m venv /opt/alakazam \
-    && /opt/alakazam/bin/pip install --no-cache-dir -r /tmp/requirements.txt
+  && /opt/alakazam/bin/pip install --no-cache-dir -r /tmp/requirements.txt
 
 FROM python:3.11-slim
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends git openssh-client \
-    && rm -rf /var/lib/apt/lists/* \
-    && git config --global --add safe.directory '*'
+  && apt-get install -y --no-install-recommends git openssh-client make \
+  && rm -rf /var/lib/apt/lists/* \
+  && git config --global --add safe.directory '*'
 
 COPY --from=abra /out/abra /usr/local/bin/abra
 COPY --from=deps /opt/alakazam /opt/alakazam
 COPY alakazam.py combine.yml /opt/alakazam/
 RUN printf '#!/bin/sh\nexec /opt/alakazam/bin/python /opt/alakazam/alakazam.py "$@"\n' \
-        > /usr/local/bin/alakazam \
-    && chmod +x /usr/local/bin/alakazam
+  > /usr/local/bin/alakazam \
+  && chmod +x /usr/local/bin/alakazam
 
 # PYTHONUNBUFFERED so the streamed hook output arrives while a command is still running.
 # LANG pins abra to its untranslated messages, which alakazam matches on to tell a missing
 # secret or an empty generate run apart from a real failure.
 ENV PYTHONUNBUFFERED=1 \
-    LANG=C.UTF-8 \
-    ABRA_DIR=/root/.abra
+  LANG=C.UTF-8 \
+  ABRA_DIR=/root/.abra
 
 WORKDIR /config
 CMD ["alakazam", "--help"]