diff --git a/.github/workflows/docker-image.yaml b/.github/workflows/docker-image.yaml
index e8e264c0..646d380e 100644
--- a/.github/workflows/docker-image.yaml
+++ b/.github/workflows/docker-image.yaml
@@ -22,6 +22,12 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3.7.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435  # v3.11.1
+
       - name: Log in to the Container registry
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
         with:
@@ -43,5 +49,6 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
index 00f87b66..fe011574 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,9 +31,9 @@ RUN uv sync --locked --no-dev
 COPY . .
 
 # Set executable permissions and prepare runtime
+# Note: /algo must remain root-owned for --cap-drop=all compatibility
+# (root without CAP_DAC_OVERRIDE cannot write to files owned by others)
 RUN chmod 0755 /algo/algo-docker.sh && \
-    chown -R algo:algo /algo && \
-    # Create volume mount point with correct ownership
     mkdir -p /data && \
     chown algo:algo /data