diff --git a/Dockerfile b/Dockerfile
index 3945ece..896d664 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # ---- Build stage -------------------------------------------------------------
 # Uses the uv image to resolve and install the pinned dependency set into a
 # self-contained virtual environment.
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS builder
+FROM ghcr.io/astral-sh/uv:python3.13-alpine3.23 AS builder
 
 ENV UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy \
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev --no-editable
 
 # ---- Runtime stage -----------------------------------------------------------
-FROM python:3.13-slim-bookworm AS runtime
+FROM python:3.13-alpine3.23 AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -32,8 +32,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     MCP_HOST=0.0.0.0 \
     MCP_PORT=8000
 
-RUN groupadd --system --gid 1001 xmcp \
- && useradd --system --uid 1001 --gid xmcp xmcp
+RUN addgroup -S -g 1001 xmcp \
+ && adduser -S -D -H -u 1001 -G xmcp xmcp
 
 WORKDIR /app
 COPY --from=builder --chown=xmcp:xmcp /app/.venv /app/.venv
diff --git a/README.md b/README.md
index 5bd57f9..8faad70 100644
--- a/README.md
+++ b/README.md
@@ -137,6 +137,6 @@ This publishes `gitea.woggioni.net/woggioni/xmcp:0.1.0` and
 src/xmcp/config.py        env var parsing and validation
 src/xmcp/spec.py          spec loading, base URL resolution, API client
 src/xmcp/server.py        FastMCP server construction and entrypoint
-Dockerfile                multi-stage build (uv builder -> slim runtime, non-root)
+Dockerfile                multi-stage build (uv builder -> alpine runtime, non-root)
 .gitea/workflows/build.yaml  release pipeline (tag push -> docker build & push)
 ```