diff --git a/Dockerfile.litespeed b/Dockerfile.litespeed
index cbf7dbc..a0b5332 100644
--- a/Dockerfile.litespeed
+++ b/Dockerfile.litespeed
@@ -31,10 +31,16 @@ ENV PHPVER=${PHPVER}
 ##   - sudo: install-lscache-wp.sh runs wp-cli as the customer user
 ##   - composer: not in the base image (wp-cli is)
 ##   - cron: customer crontab support (mirror cac:phpXX behaviour)
-##   - mariadb-server + memcached: DEV-mode parity with the existing CAC
-##     entrypoints. PROD mode never starts these.
 ##   - lsphp83-ldap: not in base image, useful for some WP plugins
 ##
+## NOTE: mariadb-server + memcached were previously installed here for
+## DEV-mode parity but bloated the PROD image by ~500MB. They are now
+## installed at runtime by entrypoint-litespeed.sh ONLY when
+## environment=DEV, mirroring the cac:phpNN pattern. The mysql CLI
+## client (used by the DEV creds-bootstrap and by wp-cli) is already
+## present in the litespeedtech/openlitespeed base via the mysql-client
+## package, so no client-side install is needed at build time.
+##
 ## All apt cache is cleaned in the same layer to keep image size down.
 ## lsphp${PHPVER}-ldap is the only extra ext we add (everything else WP needs
 ## ships in the prebuilt base). lsphp84 + lsphp85 don't ship imap or pspell
@@ -43,7 +49,6 @@ RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         gettext-base sudo cron \
         ca-certificates curl wget \
-        mariadb-server memcached \
         lsphp${PHPVER}-ldap && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
diff --git a/scripts/entrypoint-litespeed.sh b/scripts/entrypoint-litespeed.sh
index 5d145f4..e5e86b6 100644
--- a/scripts/entrypoint-litespeed.sh
+++ b/scripts/entrypoint-litespeed.sh
@@ -72,8 +72,20 @@ sudo -u "$user" sh -c "echo ok > /home/$user/public_html/healthz"
 if [ "$environment" = "DEV" ]; then
   echo "Starting Dev Deployment (litespeed)"
   mkdir -p "/home/$user/_db_backups"
-  ## mariadb-server + memcached are already in the image (apt-installed
-  ## in the Dockerfile). Just start them.
+  ## mariadb-server + memcached are NOT baked into the image (saves ~500MB
+  ## on PROD pulls). Install them at runtime, but only once per container —
+  ## the command -v guard means a restart of an already-bootstrapped
+  ## container skips the apt step and DEV boot stays ~1.5s like PROD.
+  ## First-boot in DEV adds ~30-60s for the apt install; acceptable
+  ## tradeoff per the design spec.
+  if ! command -v mysqld >/dev/null 2>&1; then
+    echo "DEV first boot: installing mariadb-server + memcached..."
+    apt-get update -qq
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      mariadb-server memcached
+    apt-get clean
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+  fi
   mkdir -p /run/mysqld && chown mysql:mysql /run/mysqld
   nohup mysqld --user=mysql &>/dev/null &
   if [ ! -f "/home/$user/mysql_creds" ]; then