diff --git a/deploy/docker/backend.Dockerfile b/deploy/docker/backend.Dockerfile
index 6f9ed857..0d666042 100644
--- a/deploy/docker/backend.Dockerfile
+++ b/deploy/docker/backend.Dockerfile
@@ -1,42 +1,117 @@
-FROM node:22-bookworm
+# ============================================================================
+# Production Backend Dockerfile — Multi-stage Build
+# Optimized from ~3.5GB down to ~800MB–1.2GB
+# ============================================================================
+# Stage 1 (builder): Full node:22-bookworm — install everything needed for building
+# Stage 2 (runtime): node:22-bookworm-slim — minimal runtime only
+# ============================================================================
+
+# --------------------------- Builder Stage -----------------------------------
+FROM node:22-bookworm AS builder
 
 ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
 ARG UV_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple
 
+# NOTE: Use HTTP (not HTTPS) for apt mirrors — OrbStack BuildKit cannot verify
+# TLS certs during build.  Apt packages are GPG-signed so HTTP is safe.
 ENV DEBIAN_FRONTEND=noninteractive
-ENV TZ=Asia/Shanghai
-ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
 ENV PIP_INDEX_URL=${UV_INDEX_URL}
 ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
 
+# --- System packages for building ---
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    sed -i "s|http://deb.debian.org/debian|https://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
-  && sed -i "s|http://security.debian.org/debian-security|https://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+    sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
+  && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
   && apt-get update \
-  && apt-get install -y --no-install-recommends curl ca-certificates python3 python3-pip tzdata xauth x11vnc novnc websockify \
-  && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
-  && echo ${TZ} > /etc/timezone
+  && apt-get install -y --no-install-recommends \
+       python3 python3-pip python3-venv curl ca-certificates tzdata
 
+# --- Node dependencies (full, including devDeps for postinstall scripts) ---
 COPY apps/backend/package.json apps/backend/package-lock.json ./
-RUN --mount=type=cache,target=/root/.npm npm ci
+RUN --mount=type=cache,target=/root/.npm \
+    npm ci
 
+# --- Prune devDependencies after install ---
+RUN npm prune --omit=dev
+
+# --- Playwright — install Chromium with system deps (builder has full apt) ---
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
 RUN --mount=type=cache,target=/ms-playwright-cache,sharing=locked \
     PLAYWRIGHT_BROWSERS_PATH=/ms-playwright-cache \
     PLAYWRIGHT_DOWNLOAD_HOST=https://npmmirror.com/mirrors/playwright/ \
     npx playwright install --with-deps chromium \
   && cp -r /ms-playwright-cache /ms-playwright
 
+# --- Python venv for OCR worker ---
+# Use a virtual environment instead of --break-system-packages
 COPY apps/backend/subservices/ocr-worker/ ./subservices/ocr-worker/
-RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
-    python3 -m pip install --break-system-packages ./subservices/ocr-worker
+RUN python3 -m venv /app/venv \
+  && /app/venv/bin/pip install --no-cache-dir -U pip \
+  && /app/venv/bin/pip install --no-cache-dir ./subservices/ocr-worker
 
+# --- Copy application source ---
 COPY apps/backend/ ./
 
-RUN mkdir -p /app/data /app/data/browser-sessions /app/data/redeem-screenshots
+# --------------------------- Runtime Stage -----------------------------------
+FROM node:22-bookworm-slim AS runtime
+
+ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+
+# HTTP mirrors — see builder note about OrbStack TLS
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=Asia/Shanghai
+ENV NODE_ENV=production
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
+ENV OCR_PROJECT_ROOT=/app/subservices/ocr-worker
+
+WORKDIR /app
+
+# --- Minimal runtime apt packages ---
+# - curl: health check (docker-compose uses `curl -fsS http://127.0.0.1:3000/health/ready`)
+# - ca-certificates: TLS for outbound HTTPS calls
+# - python3: needed by venv (links to system libpython)
+# - tzdata: timezone data for TZ=Asia/Shanghai
+# - Chromium runtime libs: minimal set for headless Chromium on slim
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
+  && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends \
+       curl ca-certificates python3 tzdata \
+       libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 \
+       libcups2 libdrm2 libxkbcommon0 libatspi2.0-0 libxcomposite1 \
+       libxdamage1 libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 \
+       libcairo2 libasound2 \
+  && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
+  && echo ${TZ} > /etc/timezone \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# --- Copy artefacts from builder ---
+# Pruned node_modules (no devDeps)
+COPY --from=builder /app/node_modules ./node_modules
+# Application source (no build step — runs directly via `node src/index.js`)
+COPY --from=builder /app/package.json ./package.json
+COPY --from=builder /app/src ./src
+COPY --from=builder /app/config ./config
+# Playwright browsers
+COPY --from=builder /ms-playwright /ms-playwright
+# Python venv for OCR worker
+COPY --from=builder /app/venv ./venv
+COPY --from=builder /app/subservices ./subservices
+
+# --- Non-root user for security ---
+RUN groupadd -g 1001 appuser \
+  && useradd -m -u 1001 -g appuser appuser \
+  && mkdir -p /app/data /app/data/browser-sessions /app/data/redeem-screenshots \
+  && chown -R appuser:appuser /app/data /ms-playwright
+
+USER appuser
 
 EXPOSE 3000