diff --git a/deployment/Dockerfile b/deployment/Dockerfile
index b15e8ca..8480334 100644
--- a/deployment/Dockerfile
+++ b/deployment/Dockerfile
@@ -46,54 +46,10 @@ RUN set -eux; \
     find /opt/venv -path '*/site-packages/wheel*' -print0 | xargs -0 -r rm -rf || true; \
     true
 
-# Download Caddy binary for the build target (multi-arch aware)
-ARG TARGETARCH
-ARG TARGETVARIANT
-RUN set -eux; \
-    DARCH="${TARGETARCH:-$(dpkg --print-architecture)}"; \
-    VARIANT="${TARGETVARIANT:-}"; \
-    case "$DARCH" in \
-        amd64) ARCH=amd64 ;; \
-        arm64) ARCH=arm64 ;; \
-        arm) if [ "${VARIANT}" = "v7" ]; then ARCH=armv7; else ARCH=arm; fi ;; \
-        *) ARCH=amd64 ;; \
-    esac; \
-    echo "Downloading Caddy for arch=${ARCH}"; \
-    # Try multiple candidate arch names for robustness (especially for arm variants)
-    candidates="${ARCH}"; \
-    if [ "${ARCH}" = "armv7" ]; then candidates="armv7 arm armv6"; fi; \
-    if [ "${ARCH}" = "arm" ]; then candidates="arm armv7 armv6"; fi; \
-    downloaded=0; \
-    for a in $candidates; do \
-        echo "Trying caddy download arch=$a"; \
-        if curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=$a" -o /tmp/caddy_dl; then \
-            echo "Downloaded caddy for arch=$a"; downloaded=1; break; \
-        else \
-            echo "No binary for arch=$a"; fi; \
-    done; \
-    if [ "$downloaded" -ne 1 ]; then echo "Failed to download Caddy for any candidate: $candidates" >&2; exit 1; fi; \
-    # If it's a tar.gz archive, extract it; otherwise treat as raw binary
-    if tar -tzf /tmp/caddy_dl >/dev/null 2>&1; then \
-        tar -xzf /tmp/caddy_dl -C /tmp; \
-    else \
-        mv /tmp/caddy_dl /tmp/caddy_raw || true; \
-    fi; \
-    mkdir -p /tmp/caddy_bin_dir; \
-    # Preferred locations
-    if [ -f /tmp/caddy ]; then mv /tmp/caddy /tmp/caddy_bin_dir/caddy; fi; \
-    if [ -f /tmp/caddy_linux_${ARCH} ]; then mv /tmp/caddy_linux_${ARCH} /tmp/caddy_bin_dir/caddy; fi; \
-    if [ -f /tmp/caddy_raw ]; then mv /tmp/caddy_raw /tmp/caddy_bin_dir/caddy; fi; \
-    # Fallback: find any executable named 'caddy' under /tmp
-    if [ ! -f /tmp/caddy_bin_dir/caddy ]; then \
-        found=$(find /tmp -type f -name caddy -perm /111 -print -quit || true); \
-        if [ -n "$found" ]; then mv "$found" /tmp/caddy_bin_dir/caddy; fi; \
-    fi; \
-    if [ ! -f /tmp/caddy_bin_dir/caddy ]; then echo "Caddy binary not found after download" >&2; exit 1; fi; \
-    chmod +x /tmp/caddy_bin_dir/caddy; \
-    # Strip Caddy to reduce size
-    if command -v strip >/dev/null 2>&1; then strip --strip-unneeded /tmp/caddy_bin_dir/caddy || true; fi
+# Stage 2: official multi-arch Caddy image (amd64, arm64, arm/v7) used as the binary source
+FROM caddy:2 AS caddy
 
-# Stage 2: Final - minimal runtime image
+# Stage 3: Final - minimal runtime image
 FROM python:3.11-slim-bookworm
 
 # Install only runtime dependencies (no build tools)
@@ -122,9 +78,8 @@ RUN mkdir -p /app/src/.ssh && chown webssh:webssh /app/src/.ssh
 # Copy entrypoint
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
-# Copy the Caddy binary prepared in the builder stage
-COPY --from=builder /tmp/caddy_bin_dir/caddy /usr/local/bin/caddy
-RUN chmod +x /usr/local/bin/caddy || true
+# Copy the Caddy binary from the official image
+COPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy
 
 # Copy Caddyfile and static assets after package installation to avoid dpkg conffile prompts
 COPY deployment/Caddyfile /etc/caddy/Caddyfile