diff --git a/Dockerfile b/Dockerfile
index 4ce0b04..d5a5220 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,13 @@
 # --- Build stage: produce static dist/ ---
-# Debian (glibc), not alpine: Astro 7's Rust toolchain (rolldown/oxc) has
-# flaky musl native bindings, and the lockfile is resolved for linux-x64-gnu.
+# Debian (glibc), not alpine: Astro 7's Rust toolchain (rolldown/oxc) resolves
+# cleanly against the linux-x64-gnu lockfile entries.
 FROM node:22-slim AS build
 WORKDIR /app
 
+# The lockfile is generated by npm 11; node:22 ships npm 10, which rejects it
+# ("Missing: @emnapi/core ..."). Match the generator before installing.
+RUN npm install -g npm@11
+
 # Install deps against the lockfile for reproducible builds.
 COPY package.json package-lock.json* ./
 RUN npm ci