diff --git a/Dockerfile b/Dockerfile
index fa0109a..1f510dd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,18 +1,28 @@
 # syntax=docker/dockerfile:1.7
 
 # ============================================================================
-# Build stage: create a self-contained venv with all dependencies
+# Build stage: Debian 12's Python (paths/libs match the distroless runtime)
 # ============================================================================
-FROM python:3.11-slim-bookworm AS builder
+# We deliberately do NOT use python:3.11-slim-bookworm here — that image is
+# Python.org's, which installs Python to /usr/local with an RPATH pointing
+# back into /usr/local/lib. Distroless has libpython under /usr/lib, so the
+# RPATH would break. Debian's apt-installed python3 lives at the same paths
+# as distroless's, so symlinks and libpython all resolve correctly.
+FROM debian:12-slim AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
-# --copies bundles the Python binary itself into /opt/venv so the runtime
-# stage gets a self-contained tree (no symlinks back to /usr/local/bin).
-RUN python -m venv --copies /opt/venv
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+         python3 python3-pip python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# Default (symlink) venv. /opt/venv/bin/python ends up as a symlink to
+# /usr/bin/python3, which distroless also provides.
+RUN python3 -m venv /opt/venv
 ENV PATH=/opt/venv/bin:$PATH
 
 # Install runtime deps into the venv's site-packages
@@ -22,7 +32,7 @@ RUN pip install \
       redis==5.0.*
 
 # Pre-compile bytecode for faster cold start on a read-only rootfs
-RUN python -m compileall -q /opt/venv
+RUN python3 -m compileall -q /opt/venv
 
 # ============================================================================
 # Runtime stage: distroless Python 3.11, non-root, no shell
@@ -37,7 +47,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /app
 
-# Self-contained venv (its bin/python and site-packages travel together)
+# Venv ships its site-packages; its bin/python symlink resolves against
+# distroless's /usr/bin/python3 and Debian's libpython at /usr/lib/...
 COPY --from=builder --chown=nonroot:nonroot /opt/venv /opt/venv
 
 # Application source (its own layer so source-only changes don't bust dep cache)
@@ -46,7 +57,5 @@ COPY --chown=nonroot:nonroot app.py favicon.ico /app/
 USER nonroot
 EXPOSE 8000
 
-# Invoking the venv's Python directly makes its site-packages discoverable
-# automatically (sys.prefix points inside /opt/venv) — no PYTHONPATH needed.
 ENTRYPOINT ["/opt/venv/bin/python", "-m", "uvicorn"]
 CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"]