diff --git a/keyserver/Dockerfile b/keyserver/Dockerfile
--- a/keyserver/Dockerfile
+++ b/keyserver/Dockerfile
@@ -149,7 +149,15 @@
 RUN yarn cleaninstall
 
 #-------------------------------------------------------------------------------
-# STEP 7: WEBPACK BUILD
+# STEP 7: GEOIP UPDATE
+# We update the GeoIP database for mapping from IP address to timezone
+#-------------------------------------------------------------------------------
+
+COPY --chown=comm keyserver/bash/docker-update-geoip.sh keyserver/bash/
+RUN cd keyserver && bash/docker-update-geoip.sh
+
+#-------------------------------------------------------------------------------
+# STEP 8: WEBPACK BUILD
 # We do this first so Docker doesn't rebuild when only keyserver files change
 #-------------------------------------------------------------------------------
 
@@ -167,21 +175,21 @@
 RUN yarn workspace web prod
 
 #-------------------------------------------------------------------------------
-# STEP 8: COPY IN SOURCE FILES
+# STEP 9: COPY IN SOURCE FILES
 # We run this later so the above layers are cached if only source files change
 #-------------------------------------------------------------------------------
 
 COPY --chown=comm . .
 
 #-------------------------------------------------------------------------------
-# STEP 9: BUILD NODE ADDON
+# STEP 10: BUILD NODE ADDON
 # Now that source files have been copied in, build rust-node-addon
 #-------------------------------------------------------------------------------
 
 RUN yarn workspace rust-node-addon build
 
 #-------------------------------------------------------------------------------
-# STEP 10: RUN BUILD SCRIPTS
+# STEP 11: RUN BUILD SCRIPTS
 # We need to populate keyserver/dist, among other things
 #-------------------------------------------------------------------------------
 
@@ -189,7 +197,7 @@
 RUN yarn workspace keyserver prod-build
 
 #-------------------------------------------------------------------------------
-# STEP 11: RUN THE SERVER
+# STEP 12: RUN THE SERVER
 # Actually run the Node.js keyserver using nvm
 #-------------------------------------------------------------------------------
 
diff --git a/keyserver/bash/docker-update-geoip.sh b/keyserver/bash/docker-update-geoip.sh
new file mode 100755
--- /dev/null
+++ b/keyserver/bash/docker-update-geoip.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+# run as: Docker container user
+# run from: anywhere
+
+set -eo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "$0")"; pwd -P)
+
+if [[ -n "${COMM_JSONCONFIG_secrets_geoip_license-}" ]]; then
+  # shellcheck source=/dev/null
+  . "${SCRIPT_DIR}/source-nvm.sh"
+  node "${SCRIPT_DIR}/../node_modules/geoip-lite/scripts/updatedb.js" \
+    license_key="$(
+      # shellcheck disable=SC2001
+      echo "${COMM_JSONCONFIG_secrets_geoip_license}" |
+        sed 's/{\"key\":\"\([a-zA-Z0-9]*\)\"}/\1/'
+    )"
+fi
diff --git a/keyserver/package.json b/keyserver/package.json
--- a/keyserver/package.json
+++ b/keyserver/package.json
@@ -10,8 +10,7 @@
     "babel-build-comm-config": ". bash/source-nvm.sh && yarn --silent babel src/lib/utils/comm-config.js --out-dir dist/lib/utils/ --config-file ./babel.config.cjs",
     "babel-build": ". bash/source-nvm.sh && yarn --silent babel src/ --out-dir dist/ --config-file ./babel.config.cjs --verbose --ignore 'src/landing/flow-typed','src/landing/node_modules','src/landing/package.json','src/lib/flow-typed','src/lib/node_modules','src/lib/package.json','src/web/flow-typed','src/web/node_modules','src/web/package.json','src/web/dist','src/web/webpack.config.js','src/web/account-bar.react.js','src/web/app.react.js','src/web/calendar','src/web/chat','src/web/flow','src/web/loading-indicator.react.js','src/web/modals','src/web/root.js','src/web/router-history.js','src/web/script.js','src/web/selectors/chat-selectors.js','src/web/selectors/entry-selectors.js','src/web/splash','src/web/vector-utils.js','src/web/vectors.react.js'",
     "rsync": "rsync -rLpmuv --exclude '*/package.json' --exclude '*/node_modules/*' --include '*.json' --include '*.cjs' --include '*.node' --exclude '*.*' src/ dist/",
-    "prod-build": "yarn babel-build && yarn rsync && yarn update-geoip",
-    "update-geoip": "yarn script dist/scripts/update-geoip.js",
+    "prod-build": "yarn babel-build && yarn rsync",
     "prod": "node --trace-warnings --loader=./loader.mjs dist/keyserver",
     "dev-rsync": "yarn --silent chokidar --initial --silent -s 'src/**/*.json' 'src/**/*.cjs' -c 'yarn rsync > /dev/null 2>&1'",
     "dev": ". bash/source-nvm.sh && yarn concurrently --names=\"BABEL,RSYNC,NODEM\" -c \"bgBlue.bold,bgMagenta.bold,bgGreen.bold\" \"yarn babel-build --source-maps --watch\" \"yarn dev-rsync\" \". bash/source-nvm.sh && NODE_ENV=development nodemon -e js,json,cjs --watch dist --no-warnings=ExperimentalWarning --loader=./loader.mjs dist/keyserver\"",
diff --git a/keyserver/src/cron/update-geoip-db.js b/keyserver/src/cron/update-geoip-db.js
--- a/keyserver/src/cron/update-geoip-db.js
+++ b/keyserver/src/cron/update-geoip-db.js
@@ -60,4 +60,4 @@
   });
 }
 
-export { updateGeoipDB, updateAndReloadGeoipDB };
+export { updateAndReloadGeoipDB };
diff --git a/keyserver/src/scripts/update-geoip.js b/keyserver/src/scripts/update-geoip.js
deleted file mode 100644
--- a/keyserver/src/scripts/update-geoip.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// @flow
-
-import { endScript } from './utils.js';
-import { updateGeoipDB } from '../cron/update-geoip-db.js';
-
-async function main() {
-  try {
-    await updateGeoipDB();
-    endScript();
-  } catch (e) {
-    endScript();
-    console.warn(e);
-  }
-}
-
-main();