diff --git a/service/hugo/Containerfile b/service/hugo/Containerfile
index 62a4aab..1ece2c1 100644
--- a/service/hugo/Containerfile
+++ b/service/hugo/Containerfile
@@ -1,23 +1,23 @@
-FROM docker.io/golang:1.21-bookworm@sha256:1415bb0b25d3bffc0a44dcf9851c20a9f8bbe558095221d931f2e4a4cc3596eb AS builder
-
-WORKDIR /build
-ENV GOBIN=/build/bin
-
-RUN go install github.com/adnanh/webhook@latest
-
-FROM docker.io/debian:bookworm-slim@sha256:f80c45482c8d147da87613cb6878a7238b8642bcc24fc11bad78c7bec726f340
+FROM docker.io/debian:bookworm-slim@sha256:f80c45482c8d147da87613cb6878a7238b8642bcc24fc11bad78c7bec726f340 AS builder-hugo
 ARG VERSION=0.121.1 # renovate: datasource=github-releases depName=gohugoio/hugo extractVersion=^v(?<version>.*)$
 
-RUN apt-get update -y && apt-get install -y --no-install-recommends \
-    ca-certificates curl git gettext gosu openssh-client
+ADD https://github.com/gohugoio/hugo/releases/download/v${VERSION}/hugo_${VERSION}_Linux-64bit.tar.gz /src/hugo
+RUN install -D --mode 0755 /src/hugo /build/usr/bin/hugo
 
-RUN curl -fsSL https://github.com/gohugoio/hugo/releases/download/v${VERSION}/hugo_${VERSION}_Linux-64bit.tar.gz | \
-    tar -C /bin --no-same-owner -xvzf - hugo && chmod +x /bin/hugo
+FROM docker.io/golang:1.21-bookworm@sha256:1415bb0b25d3bffc0a44dcf9851c20a9f8bbe558095221d931f2e4a4cc3596eb AS builder-webhook
+ARG VERSION=2.8.1 # renovate: datasource=github-releases depName=adnanh/webhook
 
-RUN addgroup --system --gid 10000 hugo
-RUN adduser --system --uid 10000 --ingroup hugo --no-create-home hugo
+RUN GOBIN=/build/usr/bin go install github.com/adnanh/webhook@${VERSION}
 
-COPY --from=builder /build/bin/webhook /bin/webhook
+FROM docker.io/debian:bookworm-slim@sha256:f80c45482c8d147da87613cb6878a7238b8642bcc24fc11bad78c7bec726f340
+RUN apt-get update -y && apt-get upgrade -y && apt-get install -y --no-install-recommends \
+    ca-certificates gettext gosu
+
+RUN apt-get update -y && apt-get install -y --no-install-recommends curl
+RUN adduser --system --group --uid 10000 --no-create-home hugo
+
+COPY --from=builder-hugo /build /
+COPY --from=builder-webhook /build /
 COPY container/config /etc/hugo
 COPY container/run-hugo /run-hugo
 
diff --git a/service/hugo/container/config/deploy.sh b/service/hugo/container/config/deploy.sh
index 002f89f..0c46dbc 100755
--- a/service/hugo/container/config/deploy.sh
+++ b/service/hugo/container/config/deploy.sh
@@ -28,4 +28,4 @@ else
     cd "$GIT_DIR_NAME"
 fi
 
-hugo --logLevel info --minify --destination "/build/${GIT_DIR_NAME}"
+exec /usr/bin/hugo --logLevel info --minify --destination "/build/${GIT_DIR_NAME}"
diff --git a/service/hugo/container/run-hugo b/service/hugo/container/run-hugo
index 6ce8685..8699202 100755
--- a/service/hugo/container/run-hugo
+++ b/service/hugo/container/run-hugo
@@ -20,4 +20,4 @@ chown hugo:hugo /etc/ssh/keys/ssh_host_*
 chown -R hugo:hugo /build
 
 # Run webhook listener for configured hooks.
-gosu hugo /bin/webhook -verbose -port 8080 -hooks /etc/hugo/hooks.yaml
+exec gosu /usr/bin/hugo /usr/bin/webhook -verbose -port 8080 -hooks /etc/hugo/hooks.yaml