diff --git a/Dockerfile b/Dockerfile
index f313556..e50fb62 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,8 @@
 # Stage 1: Build patched Rust FFI with HKDF support for Element Call E2EE
 # Fork: onestacked/livekit-rust-sdks branch EC-compat-changes
 # PR: https://github.com/livekit/rust-sdks/pull/904
-FROM rust:bookworm AS rust-build
+# Must use rust:latest (trixie/sid) — bookworm GCC 12 can't compile webrtc C++20 code
+FROM rust:latest AS rust-build
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git cmake g++ libssl-dev pkg-config protobuf-compiler \
     libva-dev libglib2.0-dev nasm make clang \
@@ -40,7 +41,9 @@ RUN mkdir -p /gen && \
     done
 
 # Stage 3: Final image
-FROM python:3.11-slim-bookworm
+# Must use trixie (GLIBC 2.38+) — patched FFI from rust:latest needs CXXABI_1.3.15
+# which requires libstdc++6 from GCC 14, which in turn needs GLIBC 2.38
+FROM python:3.11-slim-trixie
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ffmpeg libolm-dev \