diff --git a/Dockerfile.hold b/Dockerfile.hold
index 383fe21..944410f 100644
--- a/Dockerfile.hold
+++ b/Dockerfile.hold
@@ -1,30 +1,28 @@
-# Build stage
-FROM golang:1.24-alpine AS builder
+FROM golang:1.25.2-trixie AS builder
 
-WORKDIR /app
+WORKDIR /build
 
-# Copy go mod files
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Copy source code
 COPY . .
 
-# Build the hold service
-RUN CGO_ENABLED=0 GOOS=linux go build -o atcr-hold ./cmd/hold
+RUN CGO_ENABLED=0 go build \
+    -ldflags="-s -w" \
+    -trimpath \
+    -o atcr-hold ./cmd/hold
 
-# Runtime stage
-FROM alpine:latest
+# ==========================================
+# Stage 2: Minimal FROM scratch runtime
+# ==========================================
+FROM scratch
 
-RUN apk --no-cache add ca-certificates
-
-WORKDIR /root/
-
-# Copy binary from builder
-COPY --from=builder /app/atcr-hold .
-
-# Create directories for storage
-RUN mkdir -p /var/lib/atcr/hold
+# Copy CA certificates for HTTPS (PDS connections)
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+# Copy timezone data for timestamp formatting
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
+# Copy optimized binary
+COPY --from=builder /build/atcr-hold /atcr-hold
 
 # Expose default port
 EXPOSE 8080
@@ -39,6 +37,4 @@ LABEL org.opencontainers.image.title="ATCR Hold Service" \
       org.opencontainers.image.version="0.1.0" \
       io.atcr.icon="https://imgs.blue/evan.jarrett.net/1TpTOdtS60GdJWBYEqtK22y688jajbQ9a5kbYRFtwuqrkBAE"
 
-# Run the hold service
-ENTRYPOINT ["./atcr-hold"]
-CMD ["/etc/atcr/hold.yml"]
+ENTRYPOINT ["/atcr-hold"]