diff --git a/backend/Dockerfile b/backend/Dockerfile
index 7ca0be1..3861532 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -1,17 +1,26 @@
 FROM node:22-slim
 
 # Install pnpm and build tools required for native modules (sharp, bcrypt).
+# libvips-dev: with a system libvips present, sharp compiles itself against it instead of
+# downloading its prebuilt binaries from GitHub, a download that timed out on every in-build
+# attempt (2026-10-19) and failed the build.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     python3 \
     make \
     g++ \
+    pkg-config \
+    libvips-dev \
   && rm -rf /var/lib/apt/lists/* \
   && corepack enable && corepack prepare pnpm@10.26.0 --activate
 
+# node-gyp compiles against the headers this image already ships rather than downloading them.
+ENV npm_config_nodedir=/usr/local
+
 WORKDIR /app
 
-# Install dependencies first to leverage Docker layer caching.
+# Install dependencies first to leverage Docker layer caching. The native modules' build
+# scripts only run because package.json approves them (pnpm.onlyBuiltDependencies).
 COPY package.json pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile --prod
 
diff --git a/backend/package.json b/backend/package.json
index e90db65..5591654 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -34,5 +34,12 @@
   "engines": {
     "node": ">=22.12"
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "bcrypt",
+      "sharp",
+      "sodium-native"
+    ]
+  },
   "packageManager": "pnpm@10.26.0+sha512.3b3f6c725ebe712506c0ab1ad4133cf86b1f4b687effce62a9b38b4d72e3954242e643190fc51fa1642949c735f403debd44f5cb0edd657abe63a8b6a7e1e402"
 }