diff --git a/.dockerignore b/.dockerignore
index 0972088..807e201 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,3 +1,20 @@
+.git
+.gitignore
+.env
+.env.*
+!.env.example
 .venv
 venv
-.git
+__pycache__
+*.py[cod]
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.claude
+.agents
+.codex
+data
+logs
+drivers
+*.db
+*.swp
diff --git a/Dockerfile b/Dockerfile
index a9a9af1..f599772 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ COPY pyproject.toml uv.lock* ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 # ── Stage 2: runtime ──────────────────────────────────────────────────────────
-FROM python:3.14-slim AS runtime
+FROM python:3.11-slim AS runtime
 
 # ── Chrome + system deps ──────────────────────────────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -33,7 +33,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # ── uv + venv from builder ────────────────────────────────────────────────────
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
-COPY --from=builder /app/.venv /app/.venv
 
 WORKDIR /app
 
@@ -49,6 +48,9 @@ ENV PATH="/app/.venv/bin:$PATH" \
 # ── Application code ──────────────────────────────────────────────────────────
 COPY . .
 
+# Copy this after the application so a host venv can never replace it.
+COPY --from=builder /app/.venv /app/.venv
+
 RUN mkdir -p data logs
 
 # Non-root user for safety