diff --git a/src/Nocr.TextMatcher.Host/Dockerfile b/src/Nocr.TextMatcher.Host/Dockerfile
index 72cb07b..f842f58 100644
--- a/src/Nocr.TextMatcher.Host/Dockerfile
+++ b/src/Nocr.TextMatcher.Host/Dockerfile
@@ -1,14 +1,12 @@
-FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
+FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
 WORKDIR /app
-RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates
-RUN apt-get install -y curl && rm -rf /var/lib/apt/lists/*
 EXPOSE 80
 EXPOSE 443
 
 FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 WORKDIR /src
 
-# Install and update CA certificates FIRST before any network operations
+# Install CA certificates for custom NuGet source
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates && \
     update-ca-certificates && \
@@ -16,33 +14,31 @@ RUN apt-get update && \
 
 COPY . .
 
-# Create global NuGet.Config with package source mapping
+# Create NuGet.Config using cat with heredoc
 RUN mkdir -p /root/.nuget/NuGet && \
-    echo '<?xml version="1.0" encoding="utf-8"?>' > /root/.nuget/NuGet/NuGet.Config && \
-    echo '<configuration>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  <packageSources>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <add key="musk.fun.nocr" value="https://gitea.musk.fun/api/packages/nocr/nuget/index.json" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  </packageSources>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  <packageSourceMapping>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <packageSource key="musk.fun.nocr">' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '      <package pattern="Nocr.*" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    </packageSource>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <packageSource key="nuget.org">' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '      <package pattern="*" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    </packageSource>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  </packageSourceMapping>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '</configuration>' >> /root/.nuget/NuGet/NuGet.Config
+    cat > /root/.nuget/NuGet/NuGet.Config <<'EOF'
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+    <add key="musk.fun.nocr" value="https://gitea.musk.fun/api/packages/nocr/nuget/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="musk.fun.nocr">
+      <package pattern="Nocr.*" />
+    </packageSource>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>
+EOF
 
-# Restore with verbose logging
-RUN dotnet restore "src/Nocr.TextMatcher.Host/Nocr.TextMatcher.Host.csproj" --verbosity normal
+# Publish directly (restore + build + publish in one step)
 WORKDIR "/src/src/Nocr.TextMatcher.Host"
-RUN dotnet build "Nocr.TextMatcher.Host.csproj" -c Release -o /app/build
-
-FROM build AS publish
 RUN dotnet publish "Nocr.TextMatcher.Host.csproj" -c Release -o /app/publish
 
 FROM base AS final
 WORKDIR /app
-COPY --from=publish /app/publish .
+COPY --from=build /app/publish .
 ENTRYPOINT ["dotnet", "Nocr.TextMatcher.Host.dll"]
diff --git a/src/Nocr.TextMatcher.Migrator/Dockerfile b/src/Nocr.TextMatcher.Migrator/Dockerfile
index db197ab..e35e0ba 100644
--- a/src/Nocr.TextMatcher.Migrator/Dockerfile
+++ b/src/Nocr.TextMatcher.Migrator/Dockerfile
@@ -1,13 +1,10 @@
-FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
+FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
 WORKDIR /app
-RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates
-RUN apt-get install -y curl && rm -rf /var/lib/apt/lists/*
-
 
 FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 WORKDIR /src
 
-# Install and update CA certificates FIRST before any network operations
+# Install CA certificates for custom NuGet source
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates && \
     update-ca-certificates && \
@@ -15,33 +12,31 @@ RUN apt-get update && \
 
 COPY . .
 
-# Create global NuGet.Config with package source mapping
+# Create NuGet.Config using cat with heredoc
 RUN mkdir -p /root/.nuget/NuGet && \
-    echo '<?xml version="1.0" encoding="utf-8"?>' > /root/.nuget/NuGet/NuGet.Config && \
-    echo '<configuration>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  <packageSources>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <add key="musk.fun.nocr" value="https://gitea.musk.fun/api/packages/nocr/nuget/index.json" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  </packageSources>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  <packageSourceMapping>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <packageSource key="musk.fun.nocr">' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '      <package pattern="Nocr.*" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    </packageSource>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    <packageSource key="nuget.org">' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '      <package pattern="*" />' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '    </packageSource>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '  </packageSourceMapping>' >> /root/.nuget/NuGet/NuGet.Config && \
-    echo '</configuration>' >> /root/.nuget/NuGet/NuGet.Config
+    cat > /root/.nuget/NuGet/NuGet.Config <<'EOF'
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+    <add key="musk.fun.nocr" value="https://gitea.musk.fun/api/packages/nocr/nuget/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="musk.fun.nocr">
+      <package pattern="Nocr.*" />
+    </packageSource>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>
+EOF
 
-# Restore with verbose logging
-RUN dotnet restore "src/Nocr.TextMatcher.Migrator/Nocr.TextMatcher.Migrator.csproj" --verbosity normal
+# Publish directly (restore + build + publish in one step)
 WORKDIR "/src/src/Nocr.TextMatcher.Migrator"
-RUN dotnet build "Nocr.TextMatcher.Migrator.csproj" -c Release -o /app/build
-
-FROM build AS publish
 RUN dotnet publish "Nocr.TextMatcher.Migrator.csproj" -c Release -o /app/publish
 
 FROM base AS final
 WORKDIR /app
-COPY --from=publish /app/publish .
+COPY --from=build /app/publish .
 ENTRYPOINT ["dotnet", "Nocr.TextMatcher.Migrator.dll"]