diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..04fe0267
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,6 @@
+[submodule "palpo-and-octos-deploy/repos/palpo"]
+	path = palpo-and-octos-deploy/repos/palpo
+	url = https://github.com/palpo-im/palpo.git
+[submodule "palpo-and-octos-deploy/repos/octos"]
+	path = palpo-and-octos-deploy/repos/octos
+	url = https://github.com/octos-org/octos.git
diff --git a/palpo-and-octos-deploy/.gitignore b/palpo-and-octos-deploy/.gitignore
index 42567b37..98aaa20c 100644
--- a/palpo-and-octos-deploy/.gitignore
+++ b/palpo-and-octos-deploy/.gitignore
@@ -1,8 +1,7 @@
 # Runtime data (created by docker compose)
 data/
 
-# Source repos cloned by setup.sh
-repos/
+# Source repos are now git submodules (tracked in .gitmodules)
 
 # User's local env file (contains API keys)
 .env
diff --git a/palpo-and-octos-deploy/palpo.Dockerfile b/palpo-and-octos-deploy/palpo.Dockerfile
index 7442f8e7..53de85b1 100644
--- a/palpo-and-octos-deploy/palpo.Dockerfile
+++ b/palpo-and-octos-deploy/palpo.Dockerfile
@@ -7,10 +7,16 @@
 
 FROM rust:bookworm AS builder
 WORKDIR /work
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN rm -rf /var/lib/apt/lists/* /var/lib/apt/extended_states /var/cache/apt/archives/*.deb \
+    && apt-get clean \
+    && apt-get update \
+    && dpkg --configure -a || true \
+    && apt-get install -y --no-install-recommends \
     libclang-dev libpq-dev cmake \
     && rm -rf /var/lib/apt/lists/*
 COPY ./repos/palpo .
+ENV CARGO_PROFILE_RELEASE_LTO=false
+ENV CARGO_PROFILE_RELEASE_CODEGEN_UNITS=4
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/work/target \
     cargo build --release && cp target/release/palpo /usr/local/bin/palpo
diff --git a/palpo-and-octos-deploy/repos/octos b/palpo-and-octos-deploy/repos/octos
new file mode 160000
index 00000000..15cf07bb
--- /dev/null
+++ b/palpo-and-octos-deploy/repos/octos
@@ -0,0 +1 @@
+Subproject commit 15cf07bb23650d783a18718aeabc39dcd3cc221d
diff --git a/palpo-and-octos-deploy/repos/palpo b/palpo-and-octos-deploy/repos/palpo
new file mode 160000
index 00000000..cf6aee6f
--- /dev/null
+++ b/palpo-and-octos-deploy/repos/palpo
@@ -0,0 +1 @@
+Subproject commit cf6aee6fabed031269520854e7d6de4e5324a2fe
diff --git a/palpo-and-octos-deploy/setup.sh b/palpo-and-octos-deploy/setup.sh
index 1bd80a8c..4b559620 100755
--- a/palpo-and-octos-deploy/setup.sh
+++ b/palpo-and-octos-deploy/setup.sh
@@ -3,25 +3,14 @@
 # Robrix + Palpo + Octos — One-time Setup
 # ============================================================
 # Run this once before "docker compose up -d".
-# It clones the required source repos and prepares .env.
+# It initializes git submodules and prepares .env.
 # ============================================================
 set -e
 
 cd "$(dirname "$0")"
 
-echo "==> Cloning Palpo (Matrix homeserver)..."
-if [ -d repos/palpo ]; then
-  echo "    repos/palpo already exists, skipping."
-else
-  git clone --depth 1 https://github.com/palpo-im/palpo.git repos/palpo
-fi
-
-echo "==> Cloning Octos (AI bot)..."
-if [ -d repos/octos ]; then
-  echo "    repos/octos already exists, skipping."
-else
-  git clone --depth 1 --recurse-submodules=no https://github.com/octos-org/octos.git repos/octos
-fi
+echo "==> Initializing git submodules (Palpo + Octos)..."
+git submodule update --init --depth 1 repos/palpo repos/octos
 
 if [ ! -f .env ]; then
   cp .env.example .env