diff --git a/Dockerfile b/Dockerfile
index d40bcb8b..ba37b6c0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,11 +29,8 @@ ENV DATABASE_URL="mysql://build:build@localhost:3306/build"
 RUN ./node_modules/.bin/next build && ./node_modules/.bin/next-sitemap
 
 # ── runner ────────────────────────────────────────────────────────────────────
-FROM docker.arvancloud.ir/library/node:20-slim AS runner
+FROM docker.arvancloud.ir/library/node:20-bookworm AS runner
 WORKDIR /app
-RUN apt-get update -y && \
-    apt-get install -y --no-install-recommends openssl ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
 ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
diff --git a/Dockerfile.prebuilt b/Dockerfile.prebuilt
index 210f11ff..dbcf4685 100644
--- a/Dockerfile.prebuilt
+++ b/Dockerfile.prebuilt
@@ -1,12 +1,8 @@
 # Server-side image — NO npm/pnpm/network. Requires iran-bundle/ from scripts/bundle-for-iran.sh (run on Mac).
-FROM docker.arvancloud.ir/library/node:20-slim AS runner
+# Use full bookworm image (not slim): includes libssl.so.3 for Prisma; apt-get is blocked on Iran servers.
+FROM docker.arvancloud.ir/library/node:20-bookworm AS runner
 WORKDIR /app
 
-# Prisma query engine needs libssl.so.3 (not included in slim image)
-RUN apt-get update -y && \
-    apt-get install -y --no-install-recommends openssl ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
-
 ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"