diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5b7be9..a863c0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,6 +108,8 @@ jobs:
           file: deploy/docker/Dockerfile.velocity
           load: true
           tags: rampart/velocity:ci
+      - name: Download Paper jar
+        run: bash deploy/docker/download-paper.sh
       - name: Build paper
         uses: docker/build-push-action@v6
         with:
diff --git a/.gitignore b/.gitignore
index 211b83e..175ad69 100644
--- a/.gitignore
+++ b/.gitignore
@@ -62,3 +62,6 @@ bin/
 
 # Reference projects (cloned for research)
 ref/
+
+# Paper jar cache
+deploy/docker/downloads/
diff --git a/deploy/docker/Dockerfile.paper b/deploy/docker/Dockerfile.paper
index 16bcd6c..f6485d8 100644
--- a/deploy/docker/Dockerfile.paper
+++ b/deploy/docker/Dockerfile.paper
@@ -2,20 +2,11 @@ FROM eclipse-temurin:21-jre-noble
 
 ARG PAPER_VERSION=1.21
 ARG PAPER_BUILD=latest
+ARG PAPER_JAR=deploy/docker/downloads/paper.jar
 
-RUN apt-get update && apt-get install -y curl jq && rm -rf /var/lib/apt/lists/*
-
-# Download Paper
-RUN VERSION="${PAPER_VERSION}" && \
-    BUILD="${PAPER_BUILD}" && \
-    BUILDS_JSON=$(curl -s -H "User-Agent: rampart/1.0.0 (https://github.com/loki5512344/rampart)" \
-        -H "Accept-Encoding: identity" \
-        "https://fill.papermc.io/v3/projects/paper/versions/${VERSION}/builds") && \
-    if [ "${BUILD}" = "latest" ]; then \
-        BUILD=$(echo "${BUILDS_JSON}" | jq -r 'first(.[] | select(.channel == "STABLE") | .id) // empty'); \
-    fi && \
-    URL=$(echo "${BUILDS_JSON}" | jq -r --arg b "${BUILD}" 'first(.[] | select(.id == ($b | tonumber)) | .downloads."server:default".url) // empty') && \
-    curl -fsSLo /opt/paper.jar -H "Accept-Encoding: identity" "${URL}"
+# The Paper server jar is downloaded on the CI runner by deploy/docker/download-paper.sh
+# because the fill.papermc.io API is unreliably served inside the BuildKit container.
+COPY ${PAPER_JAR} /opt/paper.jar
 
 COPY deploy/config/server.properties /opt/server.properties
 COPY deploy/config/paper-global.yml /opt/paper-global.yml
diff --git a/deploy/docker/download-paper.sh b/deploy/docker/download-paper.sh
new file mode 100755
index 0000000..510d79c
--- /dev/null
+++ b/deploy/docker/download-paper.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PAPER_VERSION="${PAPER_VERSION:-1.21}"
+PAPER_BUILD="${PAPER_BUILD:-latest}"
+OUT="${PAPER_OUT:-deploy/docker/downloads/paper.jar}"
+UA="rampart/1.0.0 (https://github.com/loki5512344/rampart)"
+
+mkdir -p "$(dirname "${OUT}")"
+
+if [ "${PAPER_BUILD}" = "latest" ]; then
+  PAPER_BUILD="$(curl -fsSL -H "User-Agent: ${UA}" \
+    "https://fill.papermc.io/v3/projects/paper/versions/${PAPER_VERSION}/builds" \
+    | jq -r 'first(.[] | select(.channel == "STABLE") | .id) // empty')"
+fi
+
+URL="$(curl -fsSL -H "User-Agent: ${UA}" \
+  "https://fill.papermc.io/v3/projects/paper/versions/${PAPER_VERSION}/builds" \
+  | jq -r --arg b "${PAPER_BUILD}" 'first(.[] | select(.id == ($b | tonumber)) | .downloads."server:default".url) // empty')"
+
+if [ -z "${URL}" ]; then
+  echo "error: no Paper download URL found for version ${PAPER_VERSION} build ${PAPER_BUILD}" >&2
+  exit 1
+fi
+
+echo "Downloading Paper ${PAPER_VERSION} build ${PAPER_BUILD}"
+case "${URL}" in
+  http*) JAR_URL="${URL}" ;;
+  *) JAR_URL="https://fill.papermc.io${URL}" ;;
+esac
+curl -fsSLo "${OUT}" -H "User-Agent: ${UA}" "${JAR_URL}"
+echo "Saved ${OUT}"