diff --git a/Dockerfile b/Dockerfile
index 928c6b0..4c9df7d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,13 +3,17 @@ FROM node:20-alpine
 
 WORKDIR /app
 
+# Fix Alpine OS CVEs: upgrade all packages first (libcrypto3, libssl3, etc.)
+RUN apk update && apk upgrade --no-cache
+
 # Install libvips build deps for sharp (removed after npm ci for smaller image)
 RUN apk add --no-cache build-base python3
 
 # Copy package files first for better layer caching
 COPY package*.json ./
 RUN npm ci --omit=dev && \
-    apk del build-base python3
+    apk del build-base python3 && \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack
 
 # Copy application code
 COPY server.js ./
@@ -26,5 +30,5 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
   CMD wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1
 
-# Start the application
-CMD ["npm", "start"]
+# Start directly with node (npm stripped to reduce attack surface)
+CMD ["node", "server.js"]