diff --git a/Dockerfile b/Dockerfile
index 86a13b1..6356e74 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,6 +15,16 @@ ENV PNPM_HOME=/pnpm \
     CHECKPOINT_DISABLE=1
 ENV CI=true
 RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate
+
+# node:*-slim links OpenSSL into the node binary and ships no libssl, so Prisma
+# cannot detect a version and falls back to openssl-1.1.x. It has to live here
+# rather than in `build`: the engine target is resolved once at install time and
+# again at every `prisma` invocation, and the two stages have to agree or the
+# runtime looks for an engine that was never downloaded.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends openssl \
+ && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 
 # ---------------------------------------------------------------------------
@@ -25,7 +35,7 @@ FROM base AS build
 # better-sqlite3's install step is `prebuild-install || node-gyp rebuild`, so a
 # toolchain has to exist for the fallback. It never reaches a runtime stage.
 RUN apt-get update \
- && apt-get install -y --no-install-recommends python3 make g++ openssl \
+ && apt-get install -y --no-install-recommends python3 make g++ \
  && rm -rf /var/lib/apt/lists/*
 
 # Manifests first: dependencies only reinstall when the lockfile actually moves.