diff --git a/docker/Dockerfile b/docker/Dockerfile
index bf1f286be7..a75e8e314f 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -69,6 +69,12 @@ curl -fSsL -o /tmp/enroot.deb \
 apt-get install -y /tmp/enroot.deb
 rm /tmp/enroot.deb
 
+# Drop the --ldconfig arg from enroot's NVIDIA hook so nvidia-container-cli
+# reuses the sandbox's existing ld.so.cache instead of regenerating it.
+sed -i 's/cli_args=("--no-cgroups" "--ldconfig=@$(command -v ldconfig.real || command -v ldconfig)")/cli_args=("--no-cgroups")/' \
+    /etc/enroot/hooks.d/98-nvidia.sh
+grep -q '^cli_args=("--no-cgroups")$' /etc/enroot/hooks.d/98-nvidia.sh
+
 # Install nvidia-container-toolkit so enroot's NVIDIA hook
 # (/etc/enroot/hooks.d/98-nvidia.sh) can find nvidia-container-cli to inject
 # GPUs into enroot sandboxes. Without this, enroot sandboxes that request a