diff --git a/Dockerfile b/Dockerfile
index 60463412..ecc594e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,6 +63,14 @@ FROM base AS run-system
 ENV NODE_ENV=production
 ENV NUXT_TELEMETRY_DISABLED=1
 
+# The base stage's `COPY . .` puts the whole repo into the runtime WORKDIR (/app),
+# but at runtime only the artifacts copied explicitly below are needed. Drop the
+# inherited `torrential` source dir: the service resolves the binary by scanning
+# the cwd for `torrential`, and a directory there is spawned as ./torrential and
+# fails with EACCES. With it gone, resolution falls through to the `torrential`
+# binary installed on PATH (/usr/bin/torrential) below.
+RUN rm -rf /app/torrential
+
 # RUN --mount=type=cache,target=/root/.yarn YARN_CACHE_FOLDER=/root/.yarn yarn add --network-timeout 1000000 --no-lockfile --ignore-scripts prisma@6.11.1
 ## runtime deps:
 ##  - libarchive13: torrential now links libarchive dynamically (glibc build)