diff --git a/src/Nocr.TelegramListener.Host/Dockerfile b/src/Nocr.TelegramListener.Host/Dockerfile
index a6da13e..3e9e4ae 100644
--- a/src/Nocr.TelegramListener.Host/Dockerfile
+++ b/src/Nocr.TelegramListener.Host/Dockerfile
@@ -7,7 +7,13 @@ EXPOSE 443
 
 FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 WORKDIR /src
-RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates
+
+# Install and update CA certificates FIRST before any network operations
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    update-ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
 COPY . .
 
 # Create NuGet.Config with package source mapping to avoid NU1507 warnings
@@ -26,8 +32,10 @@ RUN mkdir -p /root/.nuget/NuGet && \
     echo '      <package pattern="*" />' >> /root/.nuget/NuGet/NuGet.Config && \
     echo '    </packageSource>' >> /root/.nuget/NuGet/NuGet.Config && \
     echo '  </packageSourceMapping>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '</configuration>' >> /root/.nuget/NuGet/NuGet.Config 
-RUN dotnet restore "src/Nocr.TelegramListener.Host/Nocr.TelegramListener.Host.csproj"
+    echo '</configuration>' >> /root/.nuget/NuGet/NuGet.Config
+
+# Restore with verbose logging to see what's happening
+RUN dotnet restore "src/Nocr.TelegramListener.Host/Nocr.TelegramListener.Host.csproj" --verbosity normal
 WORKDIR "/src/src/Nocr.TelegramListener.Host"
 RUN dotnet build "Nocr.TelegramListener.Host.csproj" -c Release -o /app/build