diff --git a/Dockerfile b/Dockerfile
index aa2b8b7..3096dfc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,45 +1,27 @@
 # syntax=docker/dockerfile:1
-FROM node:22-bookworm-slim
-
-# Install system libraries needed by native Node modules (better-sqlite3, canvas, sharp)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    curl \
-    python3 \
-    make \
-    g++ \
-    libcairo2-dev \
-    libpango1.0-dev \
-    libjpeg-dev \
-    libgif-dev \
-    librsvg2-dev \
-    && rm -rf /var/lib/apt/lists/*
+FROM gcr.io/distroless/cc-debian12
 
 WORKDIR /app
 
-# Copy sibling dependencies referenced by package.json ("file:../dashdbschema", "file:../llmorbiter")
+# Copy sibling dependencies referenced by package.json
 COPY dashdbschema /dashdbschema
 COPY llmorbiter /llmorbiter
 
-# Copy dashback package manifests
-COPY dashback/package*.json ./
-
-# Install all dependencies (including devDependencies required by OpenAPI live docs generator)
-RUN npm install
-
-# Copy application source code
+# Copy application runtime files and SEA binary
+COPY dashback/node_modules ./node_modules
+COPY dashback/package.json ./package.json
 COPY dashback/src ./src
-COPY dashback/scripts ./scripts
+COPY dashback/dist/dashback ./dist/dashback
 
-# Set production defaults
+# Set production defaults: port 4202 only, localhost only
 ENV NODE_ENV=production \
-    HOST=0.0.0.0 \
-    PORT=4208 \
+    HOST=127.0.0.1 \
+    PORT=4202 \
     HTTPS_PORT=0 \
     SQLITE_PATH=/app/data/dash.db \
     STORAGE_DIR=/app/data/storage \
     BACKUP_DIR=/app/data/backups
 
-EXPOSE 4208
+EXPOSE 4202
 
-CMD ["node", "src/index.js"]
+CMD ["./dist/dashback"]