diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index b968702..0000000
--- a/Dockerfile
+++ /dev/null
@@ -1,31 +0,0 @@
-FROM debian:bookworm-slim
-
-ARG MISE_VERSION=2026.1.7
-ARG TOOLS_DIR=/tools
-
-RUN apt-get update \
-    && apt-get -y --no-install-recommends install \
-    zstd curl git ca-certificates build-essential \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN mkdir -p ${TOOLS_DIR}/bin ${TOOLS_DIR}/config
-
-# Mise environment variables
-ENV TOOLS_DIR="${TOOLS_DIR}"
-ENV MISE_DATA_DIR="${TOOLS_DIR}"
-ENV MISE_CONFIG_DIR="${TOOLS_DIR}/config"
-ENV MISE_CACHE_DIR="${TOOLS_DIR}/cache"
-ENV MISE_INSTALL_PATH="${TOOLS_DIR}/bin/mise"
-ENV PATH="${TOOLS_DIR}/bin:${TOOLS_DIR}/shims:${PATH}"
-ENV MISE_GITHUB_ATTESTATIONS=false
-ENV MISE_VERSION=${MISE_VERSION}
-
-RUN curl https://mise.run | sh
-
-COPY tools-config/mise.toml ${TOOLS_DIR}/config/mise.toml
-
-RUN sh -c "\
-    rm -rf ${TOOLS_DIR}/shims ${TOOLS_DIR}/installs \
-    && mise install \
-    && chmod 755 ${TOOLS_DIR}/bin/mise ${TOOLS_DIR}/shims/* \
-    "
diff --git a/.env.example b/dev-tools/base/.env.example
similarity index 100%
rename from .env.example
rename to dev-tools/base/.env.example
diff --git a/dev-tools/base/Dockerfile b/dev-tools/base/Dockerfile
new file mode 100644
index 0000000..7bc56cb
--- /dev/null
+++ b/dev-tools/base/Dockerfile
@@ -0,0 +1,31 @@
+FROM ubuntu:24.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  ca-certificates git sudo tini jq \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/jdx/mise:2026.3.5 /usr/local/bin/mise /tools/bin/mise
+
+# Always needed env vars for mise
+ENV PATH="/tools/bin:/tools/shims:${PATH}"
+ENV MISE_DATA_DIR="/tools"
+ENV MISE_CONFIG_DIR="/tools/config"
+
+# Installation and cache paths
+ENV MISE_CACHE_DIR="/tools/.cache"
+ENV MISE_INSTALL_PATH="/tools/bin/mise"
+
+# UV environment variables
+ENV UV_TOOL_BIN_DIR=/tools/bin
+ENV UV_PYTHON=3.11
+
+COPY mise.toml /tools/config/mise.toml
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+HEALTHCHECK --interval=5s --timeout=5s --start-period=300s --retries=5 \
+  CMD test -f /tools/.ready
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/entrypoint.sh"]
+CMD ["sleep", "infinity"]
diff --git a/dev-tools/base/compose.yml b/dev-tools/base/compose.yml
new file mode 100644
index 0000000..190366a
--- /dev/null
+++ b/dev-tools/base/compose.yml
@@ -0,0 +1,14 @@
+services:
+  dev-tools:
+    # run `just build dev-tools base` first
+    image: dev-tools:base
+    restart: no
+    environment:
+      - GITHUB_TOKEN=${GITHUB_TOKEN}
+      - MISE_DATA_DIR=/tools
+      - MISE_CONFIG_DIR=/tools/config
+    volumes:
+      - dev-tools-data:/tools
+
+volumes:
+  dev-tools-data:
diff --git a/dev-tools/base/entrypoint.sh b/dev-tools/base/entrypoint.sh
new file mode 100644
index 0000000..0451cd4
--- /dev/null
+++ b/dev-tools/base/entrypoint.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -euo pipefail
+
+rm -f /tools/.ready
+
+mise ls --missing --json | jq -r 'keys[]' | while read -r tool; do
+  mise install "$tool"
+done
+
+mise reshim
+
+uv tool install ansible --with-executables-from ansible-core
+
+chmod -R 755 /tools
+
+touch /tools/.ready
+
+exec "$@"
diff --git a/dev-tools/base/mise.toml b/dev-tools/base/mise.toml
new file mode 100644
index 0000000..e7d5953
--- /dev/null
+++ b/dev-tools/base/mise.toml
@@ -0,0 +1,26 @@
+[tools]
+
+### Runtimes ###
+node   = "24"
+go     = "1.26"
+uv     = "latest"
+
+### Infrastructure ###
+kubectl   = "latest"
+terraform = "latest"
+docker-cli = "latest"
+# ansible - controlled via uv
+
+### Secrets ###
+sops = "latest"
+age  = "latest"
+
+### CLI ###
+just    = "latest"
+gh      = "latest"
+jq      = "latest"
+yq      = "latest"
+bat     = "latest"
+ripgrep = "latest"
+fzf     = "latest"
+direnv  = "latest"
diff --git a/docker-compose.yml b/docker-compose.yml
deleted file mode 100644
index d843faf..0000000
--- a/docker-compose.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-services:
-  dev-tools:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        - MISE_VERSION=2026.1.7
-        - TOOLS_DIR=/tools
-    environment:
-      - GITHUB_TOKEN=${GITHUB_TOKEN}
-    volumes:
-      - dev-tools:/tools
-    restart: no
-
-volumes:
-  dev-tools:
-    name: dev-tools
diff --git a/tools-config/mise.toml b/tools-config/mise.toml
deleted file mode 100644
index ce624ae..0000000
--- a/tools-config/mise.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-[tools]
-# programming tools
-duckdb = "1"
-node = "24"
-python = "3.11.14"
-go = "1.26"
-uv = "latest"
-
-# secret tools
-sops = "latest"
-age = "latest"
-
-# infra tools
-mc = "latest"
-supabase = "2"
-
-# dev tools
-bat = "latest"
-eza = "latest"
-ripgrep = "latest"
-fzf = "latest"
-jq = "latest"
-yq = "latest"
-just = "latest"
-gh = "latest"
-starship = "latest"