diff --git a/CHANGELOG.md b/CHANGELOG.md
index b32e1f9..777544c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.31.8-1
+
+* Remove the `acme`, `geoip`, `image-filter`, `njs` and `xslt` dynamic
+  modules.
+* Remove `curl`.
+
 ## 1.31.8
 
 * Upgrade to Nginx 1.31.8.
diff --git a/Dockerfile b/Dockerfile
index 5f06497..3a71870 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,16 @@ FROM nginx:1.31.8-trixie
 
 ENV NGINX_ENTRYPOINT_QUIET_LOGS=1
 
+# Remove dynamic modules and tools that upstream installs but we don't use
+RUN apt-get purge -y --auto-remove \
+      curl \
+      nginx-module-acme \
+      nginx-module-geoip \
+      nginx-module-image-filter \
+      nginx-module-njs \
+      nginx-module-xslt && \
+    rm -rf /var/lib/apt/lists/*
+
 # Override default configuration files
 COPY ./config/nginx.conf /etc/nginx/nginx.conf
 COPY ./config/default.conf /etc/nginx/conf.d/default.conf
diff --git a/README.md b/README.md
index e5099fa..3394928 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,8 @@ https://wikipedia.org/wiki/nginx
 
 ## How does this differ from upstream?
 
-Currently, the only difference is that we use `SIGQUIT` as the [`STOPSIGNAL`](https://docs.docker.com/engine/reference/builder/#stopsignal) whereas upstream uses the default i.e. `SIGTERM`. Using `SIGQUIT` is better for our use-case as it ensures that nginx will perform a [graceful shutdown](https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/).
+* We use `SIGQUIT` as the [`STOPSIGNAL`](https://docs.docker.com/engine/reference/builder/#stopsignal) whereas upstream uses the default i.e. `SIGTERM`. Using `SIGQUIT` is better for our use-case as it ensures that nginx will perform a [graceful shutdown](https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/).
+* We remove the `acme`, `geoip`, `image-filter`, `njs` and `xslt` dynamic modules and `curl`, which upstream installs but we don't use. This keeps their libraries, and the vulnerabilities reported against them, out of the image. Install them in a derived image if you need them.
 
 ## Usage