diff --git a/.changeset/silent-suits-mate.md b/.changeset/silent-suits-mate.md
new file mode 100644
index 000000000..4eabf2afd
--- /dev/null
+++ b/.changeset/silent-suits-mate.md
@@ -0,0 +1,7 @@
+---
+'skuba': patch
+---
+
+**template:** Prune `devDependencies` instead of installing twice in Docker
+
+The template-bundled Dockerfiles would previously run `yarn install` twice to build a separate stage for production `dependencies` only. These have been updated to correctly share the Yarn cache across stages and to use `yarn install --production` to perform offline pruning.
diff --git a/template/express-rest-api/Dockerfile b/template/express-rest-api/Dockerfile
index fc11c2a41..f4e10ac1a 100644
--- a/template/express-rest-api/Dockerfile
+++ b/template/express-rest-api/Dockerfile
@@ -1,5 +1,5 @@
 # Docker image history includes ARG values, so never target this stage directly
-FROM node:14-alpine AS unsafe-deps
+FROM node:14-alpine AS unsafe-dev-deps
 
 WORKDIR /workdir
 
@@ -7,17 +7,7 @@ COPY package.json yarn.lock ./
 
 ARG NPM_READ_TOKEN
 
-RUN \
-  echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
-  yarn install --frozen-lockfile --ignore-optional --non-interactive --production && \
-  rm .npmrc
-
-###
-
-# Docker image history includes ARG values, so never target this stage directly
-FROM unsafe-deps AS unsafe-dev-deps
-
-ARG NPM_READ_TOKEN
+RUN yarn config set cache-folder /yarn
 
 RUN \
   echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
@@ -26,19 +16,21 @@ RUN \
 
 ###
 
-FROM node:14-alpine AS deps
+FROM node:14-alpine AS dev-deps
 
 WORKDIR /workdir
 
-COPY --from=unsafe-deps /workdir .
+COPY --from=unsafe-dev-deps /workdir .
 
-###
+COPY --from=unsafe-dev-deps /yarn /yarn
 
-FROM node:14-alpine AS dev-deps
+RUN yarn config set cache-folder /yarn
 
-WORKDIR /workdir
+###
 
-COPY --from=unsafe-dev-deps /workdir .
+FROM dev-deps AS deps
+
+RUN yarn install --ignore-optional --ignore-scripts --non-interactive --offline --production
 
 ###
 
diff --git a/template/greeter/Dockerfile b/template/greeter/Dockerfile
index 5c53e1ac6..b25ee7323 100644
--- a/template/greeter/Dockerfile
+++ b/template/greeter/Dockerfile
@@ -7,6 +7,8 @@ COPY package.json yarn.lock ./
 
 ARG NPM_READ_TOKEN
 
+RUN yarn config set cache-folder /yarn
+
 RUN \
   echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
   yarn install --frozen-lockfile --ignore-optional --non-interactive && \
@@ -20,6 +22,10 @@ WORKDIR /workdir
 
 COPY --from=unsafe-dev-deps /workdir .
 
+COPY --from=unsafe-dev-deps /yarn /yarn
+
+RUN yarn config set cache-folder /yarn
+
 ###
 
 FROM dev-deps AS build
diff --git a/template/koa-rest-api/Dockerfile b/template/koa-rest-api/Dockerfile
index fc11c2a41..f4e10ac1a 100644
--- a/template/koa-rest-api/Dockerfile
+++ b/template/koa-rest-api/Dockerfile
@@ -1,5 +1,5 @@
 # Docker image history includes ARG values, so never target this stage directly
-FROM node:14-alpine AS unsafe-deps
+FROM node:14-alpine AS unsafe-dev-deps
 
 WORKDIR /workdir
 
@@ -7,17 +7,7 @@ COPY package.json yarn.lock ./
 
 ARG NPM_READ_TOKEN
 
-RUN \
-  echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
-  yarn install --frozen-lockfile --ignore-optional --non-interactive --production && \
-  rm .npmrc
-
-###
-
-# Docker image history includes ARG values, so never target this stage directly
-FROM unsafe-deps AS unsafe-dev-deps
-
-ARG NPM_READ_TOKEN
+RUN yarn config set cache-folder /yarn
 
 RUN \
   echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
@@ -26,19 +16,21 @@ RUN \
 
 ###
 
-FROM node:14-alpine AS deps
+FROM node:14-alpine AS dev-deps
 
 WORKDIR /workdir
 
-COPY --from=unsafe-deps /workdir .
+COPY --from=unsafe-dev-deps /workdir .
 
-###
+COPY --from=unsafe-dev-deps /yarn /yarn
 
-FROM node:14-alpine AS dev-deps
+RUN yarn config set cache-folder /yarn
 
-WORKDIR /workdir
+###
 
-COPY --from=unsafe-dev-deps /workdir .
+FROM dev-deps AS deps
+
+RUN yarn install --ignore-optional --ignore-scripts --non-interactive --offline --production
 
 ###
 
diff --git a/template/lambda-sqs-worker-cdk/Dockerfile b/template/lambda-sqs-worker-cdk/Dockerfile
index 95d85a688..43f27d9bc 100644
--- a/template/lambda-sqs-worker-cdk/Dockerfile
+++ b/template/lambda-sqs-worker-cdk/Dockerfile
@@ -7,6 +7,8 @@ COPY package.json yarn.lock ./
 
 ARG NPM_READ_TOKEN
 
+RUN yarn config set cache-folder /yarn
+
 RUN \
   echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
   yarn install --frozen-lockfile --ignore-optional --non-interactive && \
@@ -20,3 +22,7 @@ FROM node:14-alpine AS dev-deps
 WORKDIR /workdir
 
 COPY --from=unsafe-dev-deps /workdir .
+
+COPY --from=unsafe-dev-deps /yarn /yarn
+
+RUN yarn config set cache-folder /yarn
diff --git a/template/lambda-sqs-worker/Dockerfile b/template/lambda-sqs-worker/Dockerfile
index 5c53e1ac6..b25ee7323 100644
--- a/template/lambda-sqs-worker/Dockerfile
+++ b/template/lambda-sqs-worker/Dockerfile
@@ -7,6 +7,8 @@ COPY package.json yarn.lock ./
 
 ARG NPM_READ_TOKEN
 
+RUN yarn config set cache-folder /yarn
+
 RUN \
   echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
   yarn install --frozen-lockfile --ignore-optional --non-interactive && \
@@ -20,6 +22,10 @@ WORKDIR /workdir
 
 COPY --from=unsafe-dev-deps /workdir .
 
+COPY --from=unsafe-dev-deps /yarn /yarn
+
+RUN yarn config set cache-folder /yarn
+
 ###
 
 FROM dev-deps AS build