diff --git a/Dockerfile.service b/Dockerfile.service
index a7800ae..ece64a5 100644
--- a/Dockerfile.service
+++ b/Dockerfile.service
@@ -43,7 +43,7 @@ RUN pnpm turbo build --filter='./packages/shared/*' --filter=@it0/${SERVICE_NAME
 FROM node:18-alpine
 
 # Install bash (required by Claude Agent SDK Bash tool) + openssh-client (for SSH to managed servers) + su-exec (for privilege drop)
-RUN apk add --no-cache bash openssh-client su-exec
+RUN apk add --no-cache bash openssh-client su-exec openssl
 
 RUN corepack enable
 
@@ -85,11 +85,18 @@ COPY --from=builder /app/packages/shared/database/src/migrations packages/servic
 
 # Copy Prisma schema and generate client if this service uses @prisma/client.
 # prisma is kept in dependencies so it is available after --prod install.
+# NOTE: use /app/node_modules/.bin/prisma (workspace root) — pnpm does not hoist
+# binaries into each service's node_modules/.bin in a workspace setup.
 ARG SERVICE_NAME
 COPY --from=builder /app/packages/services/${SERVICE_NAME}/prisma packages/services/${SERVICE_NAME}/prisma/
-RUN test -f packages/services/${SERVICE_NAME}/prisma/schema.prisma && \
-    cd packages/services/${SERVICE_NAME} && \
-    node_modules/.bin/prisma generate --schema prisma/schema.prisma || true
+RUN if [ -f "packages/services/${SERVICE_NAME}/prisma/schema.prisma" ]; then \
+      echo "Running prisma generate for ${SERVICE_NAME}..." && \
+      /app/node_modules/.bin/prisma generate \
+        --schema /app/packages/services/${SERVICE_NAME}/prisma/schema.prisma && \
+      echo "Prisma generate completed."; \
+    else \
+      echo "No prisma/schema.prisma found — skipping prisma generate."; \
+    fi
 
 WORKDIR /app/packages/services/${SERVICE_NAME}