diff --git a/Dockerfile b/Dockerfile
index 1eb99be..1168d8c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,20 +1,32 @@
+# Patched from upstream kind-0/nsecbunkerd Dockerfile to use pnpm — the
+# upstream version uses `npm install` but package.json declares
+# `@nostr-dev-kit/ndk` as `workspace:*`, which only pnpm understands.
+# A clean clone of upstream fails to build with `EUNSUPPORTEDPROTOCOL`
+# under npm. Switching to pnpm matches the lockfile that ships in-repo.
+# Also drops `--frozen-lockfile` because the upstream pnpm-lock.yaml is
+# out of date vs. package.json (ERR_PNPM_OUTDATED_LOCKFILE) — bug to
+# file upstream once we've verified the rest of the stack works.
+
 FROM node:20.11-bullseye AS build
 
 WORKDIR /app
 
-# Copy package files and install dependencies
-COPY package*.json ./
-RUN npm install
+RUN npm install -g pnpm@9
+
+# Copy lockfile + manifest first so the install layer caches across
+# source changes.
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --no-frozen-lockfile
 
 # Copy application files
 COPY . .
 
 # Generate prisma client and build the application
 RUN npx prisma generate
-RUN npm run build
+RUN pnpm run build
 
 # Runtime stage
-FROM node:20.11-alpine as runtime
+FROM node:20.11-alpine AS runtime
 
 WORKDIR /app
 
@@ -22,11 +34,13 @@ RUN apk update && \
     apk add --no-cache openssl && \
     rm -rf /var/cache/apk/*
 
+RUN npm install -g pnpm@9
+
 # Copy built files from the build stage
 COPY --from=build /app .
 
-# Install only runtime dependencies
-RUN npm install --only=production
+# Install only runtime dependencies (pnpm respects the workspace protocol)
+RUN pnpm install --prod --no-frozen-lockfile
 
 EXPOSE 3000