diff --git a/Dockerfile b/Dockerfile
index e60f88d..962920d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,11 @@ COPY go.mod ./
 RUN --mount=type=cache,target=/go/pkg/mod go mod download
 COPY . .
 RUN test -f ./cmd/dockwatch/main.go || (echo "ERROR: cmd/dockwatch/main.go missing from Docker build context; check .dockerignore" >&2; exit 1)
+# Keep the module graph in sync with the actual source tree. This is required for
+# Go 1.17+ module graph pruning when transitive dependencies must be recorded as
+# indirect requirements in go.mod. The project intentionally has no vendored deps.
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod tidy
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
     CGO_ENABLED=0 GOOS=linux go build -trimpath \
     -ldflags="-s -w -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Version=${VERSION} -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Commit=${COMMIT} -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Date=${BUILD_DATE}" \
diff --git a/Makefile b/Makefile
index 1a3a74a..914f257 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: fmt test build docker run clean
+.PHONY: fmt tidy verify test build docker run clean
 VERSION ?= dev
 COMMIT ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo dev)
 BUILD_DATE ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
@@ -6,6 +6,12 @@ LDFLAGS := -s -w -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Version=$(
 
 fmt:
 	gofmt -w $$(find . -name '*.go' -type f)
+tidy:
+	go mod tidy
+verify:
+	go mod tidy
+	git diff --exit-code -- go.mod go.sum
+	go test ./...
 test:
 	go test ./...
 build:
diff --git a/README.md b/README.md
index fcaaea2..ab3c93b 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# Dockwatch v9.3.1
+# Dockwatch v9.3.2
 
 > Go module: `git.send.nrw/sendnrw/dockwatch`
 
@@ -391,3 +391,22 @@ node --check web/app.js
 The SQLite migration SQL is additionally smoke-tested against Python's SQLite engine because the temporary `modernc.org/sqlite` stub does not implement a real SQL driver.
 
 On a normal networked development machine or during `docker build`, run `go mod tidy && go test ./...` once against the real pinned dependencies.
+
+### Module metadata / `go mod tidy`
+
+The Docker builder runs `go mod tidy` after the full source tree has been copied and before compiling. This is intentional: Go 1.17+ module graph pruning may require transitive dependencies to be recorded as indirect requirements once the actual imported package graph is known. A checkout with an older/incomplete `go.mod` or without `go.sum` therefore still builds reproducibly in CI instead of failing late with `updates to go.mod needed`.
+
+For repository maintenance, run:
+
+```bash
+go mod tidy
+git add go.mod go.sum
+git commit -m "chore: tidy Go modules"
+```
+
+CI can use `make verify` to fail when `go.mod`/`go.sum` are not committed in tidy form.
+
+
+## v9.3.2 module-build fix
+
+v9.3.2 fixes Docker/CI builds that stopped at `go: updates to go.mod needed; to update it: go mod tidy`. The builder now runs `go mod tidy` after the complete source tree has been copied and before `go build`, so indirect requirements required by Go module graph pruning are materialized in the build stage. The Makefile also includes `tidy` and `verify` targets for maintaining committed `go.mod`/`go.sum` files.