diff --git a/lib/functions/cli/cli-requirements.sh b/lib/functions/cli/cli-requirements.sh
index 5dc202b4e6..2e1b1f3552 100644
--- a/lib/functions/cli/cli-requirements.sh
+++ b/lib/functions/cli/cli-requirements.sh
@@ -23,7 +23,15 @@ function cli_requirements_run() {
 
 	LOG_SECTION="install_host_dependencies" do_with_logging install_host_dependencies "for requirements command"
 
-	# @TODO: get stuff like shellcheck, shfmt, and ORAS in here. Deploy them somewhere not-in-./cache, so it's baked into Docker image.
+	if [[ "${ARMBIAN_INSIDE_DOCKERFILE_BUILD}" == "yes" ]]; then
+		# During the Dockerfile build, we want to pre-download ORAS/shellcheck/shfmt so it's included in the image.
+		# We need to change the deployment directory to something not in ./cache, so it's baked into the image.
+
+		deploy_to_non_cache_dir="yes" run_tool_oras # download-only, to non-cache dir.
+
+		# @TODO: shellcheck
+		# @TODO: shfmt
+	fi
 
 	display_alert "Done with" "@host dependencies" "cachehit"
 }
diff --git a/lib/functions/general/oci-oras.sh b/lib/functions/general/oci-oras.sh
index 4b42f12b5c..6f4c9306cc 100644
--- a/lib/functions/general/oci-oras.sh
+++ b/lib/functions/general/oci-oras.sh
@@ -2,13 +2,21 @@ function run_tool_oras() {
 	# Default version
 	ORAS_VERSION=${ORAS_VERSION:-0.16.0} # https://github.com/oras-project/oras/releases
 
+	declare non_cache_dir="/armbian-tools/oras" # To deploy/reuse cached ORAS in a Docker image.
+
 	if [[ -z "${DIR_ORAS}" ]]; then
 		display_alert "DIR_ORAS is not set, using default" "ORAS" "debug"
-		if [[ -n "${SRC}" ]]; then
-			DIR_ORAS="${SRC}/cache/tools/oras"
+
+		if [[ "${deploy_to_non_cache_dir:-"no"}" == "yes" ]]; then
+			DIR_ORAS="${non_cache_dir}" # root directory.
+			display_alert "Deploying ORAS to non-cache dir" "DIR_ORAS: ${DIR_ORAS}" "debug"
 		else
-			display_alert "Missing DIR_ORAS, or SRC fallback" "DIR_ORAS: ${DIR_ORAS}; SRC: ${SRC}" "ORAS" "err"
-			return 1
+			if [[ -n "${SRC}" ]]; then
+				DIR_ORAS="${SRC}/cache/tools/oras"
+			else
+				display_alert "Missing DIR_ORAS, or SRC fallback" "DIR_ORAS: ${DIR_ORAS}; SRC: ${SRC}" "ORAS" "err"
+				return 1
+			fi
 		fi
 	else
 		display_alert "DIR_ORAS is set to ${DIR_ORAS}" "ORAS" "debug"
@@ -35,6 +43,12 @@ function run_tool_oras() {
 			;;
 	esac
 
+	# Check if we have a cached version in a Docker image, and copy it over before possibly updating it.
+	if [[ "${deploy_to_non_cache_dir:-"no"}" != "yes" && -d "${non_cache_dir}" ]]; then
+		display_alert "Using cached ORAS from Docker image" "ORAS" "debug"
+		run_host_command_logged cp -v "${non_cache_dir}/"* "${DIR_ORAS}/"
+	fi
+
 	declare ORAS_FN="oras_${ORAS_VERSION}_${ORAS_OS}_${ORAS_ARCH}"
 	declare ORAS_FN_TARXZ="${ORAS_FN}.tar.gz"
 	declare DOWN_URL="https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/${ORAS_FN_TARXZ}"
@@ -47,6 +61,11 @@ function run_tool_oras() {
 	ACTUAL_VERSION="$("${ORAS_BIN}" version | grep "^Version" | xargs echo -n)"
 	display_alert "Running ORAS ${ACTUAL_VERSION}" "ORAS" "debug"
 
+	if [[ "${deploy_to_non_cache_dir:-"no"}" == "yes" ]]; then
+		display_alert "Deployed ORAS to non-cache dir" "DIR_ORAS: ${DIR_ORAS}" "debug"
+		return 0 # don't actually execute.
+	fi
+
 	# Run oras with it
 	display_alert "Calling ORAS" "$*" "debug"
 	"${ORAS_BIN}" "$@"
@@ -104,7 +123,7 @@ function oras_pull_artifact_file() {
 
 	# @TODO: this needs retries...
 	pushd "${full_temp_dir}" &> /dev/null || exit_with_error "Failed to pushd to ${full_temp_dir} - ORAS download"
-	run_tool_oras pull --verbose "${image_full_oci}" 
+	run_tool_oras pull --verbose "${image_full_oci}"
 	popd &> /dev/null || exit_with_error "Failed to popd - ORAS download"
 
 	# sanity check; did we get the file we expected?