diff --git a/Dockerfile b/Dockerfile
index 2f3cc1e9..55b25105 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,9 @@
 FROM node:22 AS script
 
 WORKDIR /build
+COPY package.json package-lock.json ./
+RUN npm ci
 COPY . .
-RUN npm install
 RUN npm run build
 
 
@@ -10,7 +11,13 @@ FROM python:3.11-alpine3.23 AS server
 
 # Install Node.js for Claude Code CLI (required by claude-agent-sdk)
 RUN apk add --no-cache nodejs npm \
-    && npm install -g @anthropic-ai/claude-code
+    && npm install -g @anthropic-ai/claude-code@2.1.37
+
+# Create managed settings for Claude Code CLI (system-level config)
+# Ensure appuser (UID 1001) can read; chmod before switching to non-root
+RUN mkdir -p /etc/claude-code \
+    && echo '{}' > /etc/claude-code/managed-settings.json \
+    && chmod -R a+rX /etc/claude-code
 
 # set user as non-root with a known UID for Kubernetes
 RUN adduser -D -u 1001 appuser \