diff --git a/backend/Dockerfile b/backend/Dockerfile
index fe98608..bdbfb19 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -15,8 +15,12 @@ RUN adduser --disabled-password --gecos "" --uid 1001 ghostbill
 
 COPY pyproject.toml .
 
+# Test tooling is opt-in so it never ships in the production image.
+# docker-compose.test.yml sets INSTALL_TEST_DEPS=true for CI.
+ARG INSTALL_TEST_DEPS=false
 RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir .
+    && if [ "$INSTALL_TEST_DEPS" = "true" ]; then pip install --no-cache-dir ".[test]"; \
+       else pip install --no-cache-dir .; fi
 
 COPY . .
 
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index c11939d..3b55340 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -16,9 +16,13 @@ dependencies = [
     "bcrypt>=4.2.0",
     "cryptography>=44.0.0",
     "python-multipart>=0.0.12",
+    "segno>=1.6.0",
+]
+
+[project.optional-dependencies]
+test = [
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24.0",
-    "segno>=1.6.0",
 ]
 
 [build-system]
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
index 7d4d2e9..6c9c6c3 100644
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -43,6 +43,8 @@ services:
     build:
       context: ./backend
       dockerfile: Dockerfile
+      args:
+        INSTALL_TEST_DEPS: "true"
     env_file:
       - .env.test
     depends_on: