diff --git a/Dockerfile b/Dockerfile
index 8b5bf16..f93e57a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,14 +7,15 @@ COPY tsconfig.json ./
 COPY src ./src
 RUN npm run build
 
-# Runtime stage: no dev deps (this service has zero runtime deps)
+# Runtime stage: production deps only
 FROM node:22-slim
 WORKDIR /app
 ENV NODE_ENV=production
 ARG GIT_SHA=dev
 ENV GIT_SHA=${GIT_SHA}
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
 COPY --from=build /app/dist ./dist
-COPY package.json ./
 USER node
 EXPOSE 3000
 CMD ["node", "dist/index.js"]