diff --git a/Dockerfile b/Dockerfile
index 00282f87..01aa7e46 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,21 +41,24 @@ COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/dist/server.js ./server-custom.js
-# server-custom.js is CJS (esbuild --packages=external) and require()s its
-# deps at runtime — socket.io's full closure (engine.io→accepts/ws/cors),
-# drizzle-orm's CJS entry (index.cjs), zod, etc. The Next standalone trace
-# builds node_modules for the APP's ESM imports, so it omits the socket
-# server's deps entirely (MODULE_NOT_FOUND 'accepts') AND ships ESM-only
-# entries for shared packages (drizzle-orm/index.cjs missing). A NODE_PATH
-# fallback can't fix the latter — Node finds the incomplete package in the
-# standalone tree and errors instead of falling through. So replace the
-# traced node_modules with the complete hoisted prod tree: every external
-# the custom server requires resolves. Next's standalone .next runs fine
-# on the full `next` package (same version, superset of the trace); the
-# one thing the standalone bootstrap would set — globalThis.AsyncLocalStorage
+# The Next standalone node_modules is a MATCHED SET with the turbopack
+# server chunks — it resolves turbopack's externalized packages (better-auth,
+# postgres, pino, minio, ...) by their hashed ids, so REPLACING it makes
+# every route that uses them 500 with "Failed to load external module".
+# But the custom server (server-custom.js, CJS via esbuild --packages=external)
+# require()s deps the trace omits or ships ESM-only: socket.io's closure
+# (accepts/ws/engine.io/cors) and drizzle-orm's CJS entry (index.cjs). So
+# MERGE the complete hoisted prod tree INTO the standalone node_modules with
+# rsync --ignore-existing: it ADDS the missing packages/files and SKIPS
+# everything the trace already provides (and unlike COPY/cp it tolerates the
+# trace's pnpm symlinks instead of erroring on symlink-vs-dir). The one
+# thing the standalone server bootstrap would set — globalThis.AsyncLocalStorage
 # — is handled up-front by src/server-runtime-preamble.ts.
-RUN rm -rf ./node_modules
-COPY --from=prod-deps --chown=nextjs:nodejs /app/node_modules ./node_modules
+COPY --from=prod-deps --chown=nextjs:nodejs /app/node_modules /opt/prod-node-modules
+RUN apk add --no-cache --virtual .merge-deps rsync \
+ && rsync -a --ignore-existing /opt/prod-node-modules/ ./node_modules/ \
+ && rm -rf /opt/prod-node-modules \
+ && apk del .merge-deps
 USER nextjs
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \