diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a2c8cc3..e3440a6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -50,27 +50,20 @@ People _love_ thorough bug reports. I'm not even kidding.
 
 ## Building
 
-1. Optionally update root hints before building
-
-```bash
-rm rootfs_overlay/var/unbound/root.hints
-wget https://www.internic.net/domain/named.root -O rootfs_overlay/var/unbound/root.hints
-```
-
-2. Enable docker buildkit and experimental mode
+1. Enable docker buildkit and experimental mode
 
 ```bash
 export DOCKER_BUILDKIT=1
 export DOCKER_CLI_EXPERIMENTAL=enabled
 ```
 
-3. Build image for host architecture
+2. Build image for host architecture
 
 ```bash
 docker build . --tag klutchell/unbound:dev
 ```
 
-4. Optionally cross-build for another architecture
+3. Optionally cross-build for another architecture
 
 ```bash
 docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
@@ -128,6 +121,27 @@ docker build . --target conf-example --output rootfs_overlay/etc/unbound/
 
 [Here](https://github.com/klutchell/unbound-docker/pull/235) is an example pull request for reference.
 
+## Updating root.hints and root.key
+
+These files should be updated once a year or so to ensure they have the latest valid information.
+
+1. In your working copy, create a new branch if you haven't already.
+
+2. Enable docker buildkit and experimental mode
+
+```bash
+export DOCKER_BUILDKIT=1
+export DOCKER_CLI_EXPERIMENTAL=enabled
+```
+
+3. Run the following build command to generate new files.
+
+```bash
+docker build . --target root-hints --output rootfs_overlay/var/unbound/
+```
+
+4. Commit changes in `root_overlay/var/unbound/*` and open a pull request for review.
+
 ## License
 
 By contributing, you agree that your contributions will be licensed under its [Software License](LICENSE.md).
diff --git a/Dockerfile b/Dockerfile
index 218241f..8b8261f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -95,11 +95,24 @@ RUN make -j"$(nproc)" && \
 	/opt/usr/sbin/unbound-control \
 	/opt/usr/sbin/unbound-host
 
+WORKDIR /var/unbound/
+
+# download root hints and generate initial root key
+# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html
+RUN wget -q https://www.internic.net/domain/named.root -O root.hints \
+	&& { /opt/usr/sbin/unbound-anchor -v -r root.hints 2>&1 || true ; } | tee -a /dev/stderr | grep -q "success: the anchor is ok"
+
 FROM scratch AS conf-example
 
 # docker build . --target conf-example --output rootfs_overlay/etc/unbound/
 COPY --from=unbound /etc/unbound/unbound.conf /unbound.conf.example
 
+FROM scratch as root-hints
+
+# docker build . --target root-hints --output rootfs_overlay/var/unbound/
+COPY --from=unbound /var/unbound/root.key /root.key
+COPY --from=unbound /var/unbound/root.hints /root.hints
+
 FROM scratch AS final
 
 COPY --from=build-base /lib/ld-musl*.so.1 /lib/