diff --git a/Dockerfile b/Dockerfile
index 43f8bb8..9752ebc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,9 +12,18 @@
 # ponytail: prebuilt-lib copy, not a from-source build. Add a whisper.cpp build
 # stage if you ever need reproducibility / a different arch than the host libs.
 
-FROM golang:1.23-bookworm AS build
+# trixie, not bookworm: the prebuilt deps/lib/*.so are linked against
+# glibc 2.38 + GLIBCXX 3.4.32 (built on the Arch host). bookworm's glibc 2.36
+# is too old and the link fails on missing symbols. trixie ships glibc 2.40.
+# 1.24 (not 1.23) because golang trixie images start at 1.24; go 1.24 builds the
+# `go 1.23` module fine (the directive is a minimum).
+FROM golang:1.24-trixie AS build
 WORKDIR /src
 
+# libvulkan-dev: libggml-vulkan.so needs libvulkan.so.1 at link time.
+RUN apt-get update && apt-get install -y --no-install-recommends libvulkan-dev \
+    && rm -rf /var/lib/apt/lists/*
+
 # native build inputs (prebuilt libs + headers), then module cache, then source
 COPY deps/lib/ /src/deps/lib/
 COPY deps/piper/ /src/deps/piper/
@@ -37,7 +46,7 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
     go build -o /out/mavcaldav ./cmd/mavcaldav
 
-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime
 RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 && \
     rm -rf /var/lib/apt/lists/*
diff --git a/docker-compose.yml b/docker-compose.yml
index 61374ac..dd7892e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,10 @@ name: maven
 # the bare-metal setup, only paths move to /run/maven.
 
 x-image: &image
-  image: maven:latest
+  # NOT "maven" — that's Apache Maven on Docker Hub and compose will happily
+  # pull it, giving every container `mvn-entrypoint.sh` and exit 127.
+  image: mavenai:latest
+  pull_policy: never   # only ever the locally-built image
   restart: unless-stopped
 
 services: