diff --git a/.dockerignore b/.dockerignore
index 378eac25d311703f3f2cd456d8036da525cd0366..10ea399322819ceb4a9bbcacfc1c2c80db2d2dfd 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1 +1,2 @@
 build
+.git
diff --git a/Dockerfile b/Dockerfile
index 43aa9d89ae7b918872dbead2113bd2f2ec41d933..b639297f5227a2b756d788344caecec811dcd08e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,13 @@
-FROM debian:stable AS build
+FROM debian:bullseye AS build
+RUN apt-get -q update && env DEBIAN_FRONTEND=noninteractive apt-get -qy install --no-install-recommends rsync git golang ca-certificates
 ADD . /src
-RUN apt-get -q update && env DEBIAN_FRONTEND=noninteractive apt-get -qy install --no-install-recommends rsync git golang ca-certificates && cd /src && ./scripts/lint.sh && ./scripts/update.sh
+WORKDIR /src
+RUN ./scripts/lint.sh && ./scripts/update.sh
 
 FROM registry.git.autistici.org/ai3/docker/apache2-base:buster
 
 COPY --from=build /src/public /var/www/autistici.org
-COPY --from=build /src/build/bin/sitesearch /usr/sbin/sitesearch
+COPY --from=build /root/go/bin/sitesearch /usr/sbin/sitesearch
 COPY --from=build /src/index /var/lib/sitesearch/index
 COPY templates /var/lib/sitesearch/templates
 COPY docker/conf /tmp/conf
diff --git a/scripts/update.sh b/scripts/update.sh
index 92fce8e83b6513631045a51936a80d0392084617..af8f70a850b9ed9128b782a0a9b3a2f3365c50f0 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -20,22 +20,18 @@ is_installed() {
 
 # We can use the installed version of some tools, or invoke 'go get'
 # to build them locally (if Go is installed).
-find_or_install() {
+find_or_install_go_pkg() {
     local bin="$1"
     local url="$2"
-    local relpath="${3:-}"
     if is_installed "${bin}" ; then
         echo "${bin}"
     else
-        if [ ! -x "${GOPATH}/bin/${bin}" ]; then
-            echo "Installing ${url}" >&2
-            # Go needs to be installed.
-            is_installed go || die "Go needs to be installed. See https://golang.org/dl/"
-            go get -u -d ${url} >&2 || true
-            go install ${url}/${relpath} \
-                || die "Could not install ${bin}"
-        fi
-        echo "${GOPATH}/bin/${bin}"
+        echo "Installing ${url}" >&2
+        # Go needs to be installed.
+        is_installed go || die "Go needs to be installed. See https://golang.org/dl/"
+        go get -u ${url} >&2 \
+            || die "Could not install ${bin} (${url})"
+        find_installed "${bin}"
     fi
 }
 
@@ -67,16 +63,17 @@ update_website() {
 
     msg "checking prerequisites"
 
-    # In case we need to build some Go packages locally, set GOPATH to
-    # point at the 'build' subdirectory of root_dir.
+    # Build and install Go packages with a sufficiently recent
+    # version of Go which understands modules and can ignore GOPATH.
     build_dir="${root_dir}/build"
     mkdir -p "${build_dir}"
-    export GOPATH="${build_dir}"
-    export PATH="$PATH:$GOPATH/bin"
+    unset GOPATH
+    export PATH="$PATH:$HOME/go/bin"
+    export GO111MODULE=on
 
     # Install the required Go utilities.
-    gostatic=$(find_or_install gostatic github.com/piranha/gostatic)
-    sitesearch=$(find_or_install sitesearch git.autistici.org/ai/webtools cmd/...)
+    gostatic=$(find_or_install_go_pkg gostatic github.com/piranha/gostatic)
+    sitesearch=$(find_or_install_go_pkg sitesearch git.autistici.org/ai/webtools/...)
 
     test -d "${site_dir}" || mkdir -p "${site_dir}"