diff --git a/Dockerfile b/Dockerfile
index 33d8553d..2a4a9986 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -68,9 +68,17 @@ WORKDIR "${EP_DIR}"
 
 COPY --chown=etherpad:etherpad ./ ./
 
-RUN src/bin/installDeps.sh && \
-    { [ -z "${ETHERPAD_PLUGINS}" ] || \
+# Plugins must be installed before installing Etherpad's dependencies, otherwise
+# npm will try to hoist common dependencies by removing them from
+# src/node_modules and installing them in the top-level node_modules. As of
+# v6.14.10, npm's hoist logic appears to be buggy, because it sometimes removes
+# dependencies from src/node_modules but fails to add them to the top-level
+# node_modules. Even if npm correctly hoists the dependencies, the hoisting
+# seems to confuse tools such as `npm outdated`, `npm update`, and some ESLint
+# rules.
+RUN { [ -z "${ETHERPAD_PLUGINS}" ] || \
       npm install --no-save ${ETHERPAD_PLUGINS}; } && \
+    src/bin/installDeps.sh && \
     rm -rf ~/.npm
 
 # Copy the configuration file.