diff --git a/.gitignore b/.gitignore
index bc7dd99..0c6ac91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,4 +21,3 @@ oidc-role.json
 __pycache__/
 *.tar.gz
 .env
-sts-agent/grte/
diff --git a/docs/storage-transfer.md b/docs/storage-transfer.md
index 9948bce..51ac764 100644
--- a/docs/storage-transfer.md
+++ b/docs/storage-transfer.md
@@ -117,23 +117,12 @@ STS_AGENT_POOL=my-agents
 HOSTNAME=agent-host
 ```
 
-The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. The agent launcher is statically linked with GRTE v5, the Google Run Time Environment based on glibc 2.27, which loads shared libraries from `/usr/grte/v5/lib64`. The libraries must come from the same GRTE build, because GRTE changes internal structures of the dynamic loader. `sts-agent/build-grte.sh` builds them from the GRTE v5 source at `https://third-party-mirror.googlesource.com/GRTEv5` in a temporary `ubuntu:18.04` container, and `sts-agent/Dockerfile` adds them to the image.
-
-Build the GRTE v5 libraries into `sts-agent/grte`:
-
-```bash
-cd sts-agent
-docker run --rm --security-opt apparmor=unconfined \
-    -v "$PWD/build-grte.sh:/build-grte.sh:ro" \
-    -v "$PWD/grte:/out" \
-    ubuntu:18.04 /build-grte.sh
-```
-
-`--security-opt apparmor=unconfined` is needed only where Docker cannot load its AppArmor profile, for example inside an LXC container.
+The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. The agent launcher is statically linked with GRTE v5, the Google Run Time Environment based on glibc 2.27, which loads shared libraries from `/usr/grte/v5/lib64`. The libraries must come from the same GRTE build, because GRTE changes internal structures of the dynamic loader. The first stage of `sts-agent/Dockerfile` builds them from the GRTE v5 source at `https://third-party-mirror.googlesource.com/GRTEv5` on `ubuntu:18.04`, and the second stage adds them to the image of Google.
 
 Build the image and start the agent:
 
 ```bash
+cd sts-agent
 docker compose build
 docker compose up -d
 ```
diff --git a/sts-agent/Dockerfile b/sts-agent/Dockerfile
index e86ef1e..e6f1ee1 100644
--- a/sts-agent/Dockerfile
+++ b/sts-agent/Dockerfile
@@ -1,4 +1,25 @@
+FROM ubuntu:18.04 AS grte
+
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential gawk bison python3 git texinfo ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# GRTE v5 source, Google's glibc 2.27
+RUN git clone --depth 1 https://third-party-mirror.googlesource.com/GRTEv5 /src
+
+# Build the libraries into the library directory searched by the GRTE v5 loader
+WORKDIR /build
+RUN printf 'slibdir=/usr/grte/v5/lib64\nrtlddir=/usr/grte/v5/lib64\n' > configparms \
+    && /src/google3/third_party/grte/v5_src/glibc-2.27/configure \
+        --prefix=/usr/grte/v5 \
+        --libdir=/usr/grte/v5/lib64 \
+        --disable-werror \
+        --enable-kernel=3.2 \
+    && make -j"$(nproc)" \
+    && make install DESTDIR=/out
+
 FROM gcr.io/cloud-ingest/tsop-agent:latest
 
-# GRTE v5 shared libraries built by build-grte.sh, matching the GRTE v5 glibc the launcher is statically linked with.
-COPY grte/usr/grte/v5/lib64/ /usr/grte/v5/lib64/
+# GRTE v5 shared libraries matching the GRTE v5 glibc the launcher is statically linked with.
+COPY --from=grte /out/usr/grte/v5/lib64/ /usr/grte/v5/lib64/
diff --git a/sts-agent/build-grte.sh b/sts-agent/build-grte.sh
deleted file mode 100755
index 32d81c7..0000000
--- a/sts-agent/build-grte.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-prefix=/usr/grte/v5
-libdir="${prefix}/lib64"
-
-# Install the build tools
-export DEBIAN_FRONTEND=noninteractive
-apt-get update -qq
-apt-get install -y -qq --no-install-recommends build-essential gawk bison python3 git texinfo ca-certificates > /dev/null
-
-# Get the GRTE v5 source, Google's glibc 2.27
-git clone --depth 1 https://third-party-mirror.googlesource.com/GRTEv5 /src
-
-# Build the libraries in the library directory searched by the GRTE v5 loader
-mkdir /build
-cd /build
-cat > configparms <<EOF
-slibdir=${libdir}
-rtlddir=${libdir}
-EOF
-/src/google3/third_party/grte/v5_src/glibc-2.27/configure \
-    --prefix="${prefix}" \
-    --libdir="${libdir}" \
-    --disable-werror \
-    --enable-kernel=3.2
-make -j"$(nproc)"
-make install DESTDIR=/out
-
-ls -l "/out${libdir}/libc.so.6" "/out${libdir}/libm.so.6" "/out${libdir}/libpthread.so.0" "/out${libdir}/ld-linux-x86-64.so.2"