diff --git a/Dockerfile b/Dockerfile
index 9c986b0..b94967d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,25 +1,51 @@
-FROM python:3.12-slim
+FROM python:3.12-alpine
 
-# Install system dependencies for WeasyPrint
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpango-1.0-0 \
-    libpangocairo-1.0-0 \
-    libgdk-pixbuf-2.0-0 \
-    libffi-dev \
-    shared-mime-info \
-    && rm -rf /var/lib/apt/lists/*
+# Runtime-Pakete für WeasyPrint (Pango/Cairo) und PDF-Pipeline.
+# Alpine-Pakete sind kleiner als die Debian-slim-Pendants und der
+# Base-Image hat aktuell 0 CRITICAL CVEs (vs. 3 in python:3.12-slim,
+# Stand Mai 2026 / Security-Audit).
+RUN apk add --no-cache \
+        pango \
+        cairo \
+        gdk-pixbuf \
+        shared-mime-info \
+        fontconfig \
+        ttf-dejavu \
+        libffi \
+        libxml2 \
+        libxslt
+
+# Build-Toolchain temporär für pip-Wheels (musllinux-fallbacks bauen
+# pymupdf, cffi, lxml, cryptography ggf. lokal).
+RUN apk add --no-cache --virtual .build-deps \
+        build-base \
+        gcc \
+        musl-dev \
+        libffi-dev \
+        jpeg-dev \
+        zlib-dev \
+        cairo-dev \
+        pango-dev \
+        gdk-pixbuf-dev \
+        libxml2-dev \
+        libxslt-dev \
+        openssl-dev \
+        rust \
+        cargo
 
 WORKDIR /app
 
 # Install Python dependencies
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-cache-dir --upgrade pip wheel \
+    && pip install --no-cache-dir -r requirements.txt \
+    && apk del .build-deps
 
 # Copy application code only (data/reports are mounted as volumes)
 COPY app/ ./app/
 
 # Create non-root user and directories (#119 Security)
-RUN adduser --disabled-password --gecos '' --uid 1000 appuser \
+RUN adduser -D -u 1000 appuser \
     && mkdir -p /app/data /app/reports \
     && chown -R appuser:appuser /app