diff --git a/Dockerfile b/Dockerfile
index d96207b..5c3c3e1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,11 +51,18 @@ FROM node:22-alpine AS runtime
 # Install tini for proper PID 1 signal handling
 RUN apk add --no-cache tini su-exec
 
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
 WORKDIR /app
 
-# No native deps — runtime only needs node_modules for pure-JS packages (express, cors, etc.)
-# pnpm hoists everything to the root node_modules (shamefully-hoist=true in .npmrc)
-COPY --from=server-builder /build/node_modules ./node_modules
+# Copy workspace manifests and lockfile — pnpm needs these to install correctly
+COPY pnpm-workspace.yaml package.json pnpm-lock.yaml* .npmrc ./
+COPY apps/server/package.json ./apps/server/
+COPY apps/client/package.json ./apps/client/
+
+# Install production dependencies only — fresh install avoids broken symlinks
+# from COPY-ing pnpm's virtual store between stages
+RUN pnpm install --prod --frozen-lockfile
 
 # Copy compiled server output (includes dist/db/migrations/*.js compiled by tsc)
 COPY --from=server-builder /build/apps/server/dist ./apps/server/dist