diff --git a/.gitignore b/.gitignore
index 1c277c16b3..a654e577cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,6 +92,7 @@ opencode.json
 /playwright/.cache/
 /render-wasm/target/
 /media-processor/dist/
+/media-processor/target/
 /**/node_modules
 /**/.yarn/*
 /.pnpm-store
diff --git a/docker/images/Dockerfile.media-processor b/docker/images/Dockerfile.media-processor
index 3a1c15e9ae..4d7ab21a1b 100644
--- a/docker/images/Dockerfile.media-processor
+++ b/docker/images/Dockerfile.media-processor
@@ -1,17 +1,16 @@
-FROM ubuntu:26.04
+# syntax=docker/dockerfile:1
+FROM dhi.io/node:24.20.0-debian13-dev
 LABEL maintainer="Penpot <docker@penpot.app>"
 
 ENV LANG=en_US.UTF-8 \
     LC_ALL=en_US.UTF-8 \
-    NODE_VERSION=v24.20.0 \
-    DEBIAN_FRONTEND=noninteractive \
-    PATH=/opt/node/bin:$PATH
+    DEBIAN_FRONTEND=noninteractive
 
+# passwd provides useradd, not preinstalled on the DHI base image.
 RUN set -ex; \
-    useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
-    mkdir -p /etc/resolvconf/resolv.conf.d; \
-    echo "nameserver 127.0.0.11" > /etc/resolvconf/resolv.conf.d/tail; \
     apt-get -qq update; \
+    apt-get -qqy --no-install-recommends install passwd; \
+    useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
     apt-get -qq dist-upgrade; \
     apt-get -qqy --no-install-recommends install \
       curl \
@@ -34,7 +33,7 @@ RUN set -ex; \
       \
       libgomp1 \
       libheif1 \
-      libjpeg-turbo8 \
+      libjpeg62-turbo \
       liblcms2-2 \
       libopenexr-3-1-30 \
       libopenjp2-7 \
@@ -44,34 +43,12 @@ RUN set -ex; \
       libwebp7 \
       libwebpdemux2 \
       libwebpmux3 \
-      libxml2-16 \
+      libxml2 \
       libzip5 \
       libzstd1 \
     ; \
     apt-get clean; \
-    rm -rf /var/lib/apt/lists/*;
-
-RUN set -eux; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-arm64.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    curl -LfsSo /tmp/nodejs.tar.gz ${BINARY_URL}; \
-    mkdir -p /opt/node; \
-    cd /opt/node; \
-    tar -xf /tmp/nodejs.tar.gz --strip-components=1; \
-    chown -R root /opt/node; \
-    rm -rf /tmp/nodejs.tar.gz; \
-    corepack enable; \
+    rm -rf /var/lib/apt/lists/*; \
     mkdir -p /opt/penpot; \
     chown -R penpot:penpot /opt/penpot;
 
@@ -79,8 +56,11 @@ ARG BUNDLE_PATH="./bundle-media-processor/"
 COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/media-processor/
 
 WORKDIR /opt/penpot/media-processor
+
+# Runs as root: this base image installs Node system-wide (symlinked into
+# /usr/bin), so ./setup's internal `corepack enable` needs write access there.
+RUN ./setup && chown -R penpot:penpot /opt/penpot/media-processor
+
 USER penpot:penpot
 
-RUN ./setup
-
 CMD ["node", "dist/index.js"]
diff --git a/manage.sh b/manage.sh
index 76ef2b1415..d635054af7 100755
--- a/manage.sh
+++ b/manage.sh
@@ -1231,6 +1231,22 @@ function build-mcp-bundle {
 }
 
 
+function build-media-processor-bundle {
+    echo ">> bundle media-processor start";
+
+    mkdir -p ./bundles
+    local version=$(print-current-version);
+    local bundle_dir="./bundles/media-processor";
+
+    build "media-processor";
+
+    rm -rf $bundle_dir;
+    mv ./media-processor/target $bundle_dir;
+    echo $version > $bundle_dir/version.txt;
+    put-license-file $bundle_dir;
+    echo ">> bundle media-processor end";
+}
+
 function build-backend-bundle {
     echo ">> bundle backend start";
 
@@ -1346,6 +1362,10 @@ function build-mcp-docker-image {
     _build-release-docker-image mcp bundle-mcp Dockerfile.mcp "$@"
 }
 
+function build-media-processor-docker-image {
+    _build-release-docker-image media-processor bundle-media-processor Dockerfile.media-processor "$@"
+}
+
 function build-storybook-docker-image {
     _build-release-docker-image storybook bundle-storybook Dockerfile.storybook "$@"
 }
@@ -1424,6 +1444,7 @@ function usage {
     echo "- build-backend-bundle             Build backend bundle."
     echo "- build-exporter-bundle            Build exporter bundle."
     echo "- build-mcp-bundle                 Build mcp bundle."
+    echo "- build-media-processor-bundle     Build media-processor bundle."
     echo "- build-storybook-bundle           Build storybook bundle."
     echo "- build-docs-bundle                Build docs bundle."
     echo ""
@@ -1435,6 +1456,7 @@ function usage {
     echo "- build-backend-docker-image [--tag TAG]    Build backend docker image."
     echo "- build-exporter-docker-image [--tag TAG]   Build exporter docker image."
     echo "- build-mcp-docker-image [--tag TAG]         Build mcp docker image."
+    echo "- build-media-processor-docker-image [--tag TAG]  Build media-processor docker image."
     echo "- build-storybook-docker-image [--tag TAG]  Build storybook docker image."
     echo "- build-imagemagick-docker-image [--tag TAG] [--push]"
     echo "                                   Build the imagemagick docker image. Local-only by default (single-"
@@ -1490,6 +1512,7 @@ case $1 in
     build-bundle)
         build-frontend-bundle;
         build-mcp-bundle;
+        build-media-processor-bundle;
         build-backend-bundle;
         build-exporter-bundle;
         build-storybook-bundle;
@@ -1503,6 +1526,10 @@ case $1 in
         build-mcp-bundle;
         ;;
 
+    build-media-processor-bundle)
+        build-media-processor-bundle;
+        ;;
+
     build-backend-bundle)
         build-backend-bundle;
         ;;
@@ -1524,6 +1551,7 @@ case $1 in
         build-backend-docker-image "${@:2}"
         build-exporter-docker-image "${@:2}"
         build-mcp-docker-image "${@:2}"
+        build-media-processor-docker-image "${@:2}"
         build-storybook-docker-image "${@:2}"
         ;;
 
@@ -1543,6 +1571,10 @@ case $1 in
         build-mcp-docker-image "${@:2}"
         ;;
 
+    build-media-processor-docker-image)
+        build-media-processor-docker-image "${@:2}"
+        ;;
+
     build-storybook-docker-image)
         build-storybook-docker-image "${@:2}"
         ;;
diff --git a/mcp/scripts/build b/mcp/scripts/build
index 09523164fe..2e33318460 100755
--- a/mcp/scripts/build
+++ b/mcp/scripts/build
@@ -35,7 +35,7 @@ cp pnpm-lock.yaml ./dist/;
 touch ./dist/pnpm-workspace.yaml;
 
 cat <<EOF | tee ./dist/setup
-#/usr/bin/env bash
+#!/usr/bin/env bash
 set -e;
 corepack enable;
 corepack install;
diff --git a/media-processor/scripts/build b/media-processor/scripts/build
index 94ec8e856c..e04a402c09 100755
--- a/media-processor/scripts/build
+++ b/media-processor/scripts/build
@@ -1,4 +1,31 @@
 #!/bin/bash
 set -e
 cd "$(dirname "$0")/.."
+
+# package.json pins pnpm via "packageManager", so the first build on a fresh
+# devenv makes corepack fetch it. Without this it asks for confirmation on
+# stdin, which hangs a CI build (and aborts an interactive one); `corepack
+# install` then fetches the pinned version explicitly.
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+corepack install
+
 pnpm run build
+
+# Assemble the release bundle under target/, the way the other modules do.
+# esbuild leaves the runtime dependencies external (sharp, pino, pino-pretty,
+# pino-loki), so the image has to install them on build: ship the manifests
+# next to dist/ plus a setup script for Dockerfile.media-processor to run.
+rm -rf target
+mkdir -p target
+rsync -avr --delete dist/ target/dist/
+cp package.json pnpm-lock.yaml pnpm-workspace.yaml target/
+
+cat <<SETUP | tee target/setup > /dev/null
+#!/usr/bin/env bash
+set -e;
+corepack enable;
+corepack install;
+pnpm install -P;
+SETUP
+
+chmod +x target/setup