diff --git a/DEPLOY.en.md b/DEPLOY.en.md
index a558ae3..2ff3250 100644
--- a/DEPLOY.en.md
+++ b/DEPLOY.en.md
@@ -161,7 +161,7 @@ Docker Compose includes a built-in health check:
 
 ```yaml
 healthcheck:
-  test: ["CMD", "wget", "-qO-", "http://localhost:${PORT:-5001}/healthz"]
+  test: ["CMD", "/usr/local/bin/busybox", "wget", "-qO-", "http://localhost:${PORT:-5001}/healthz"]
   interval: 30s
   timeout: 10s
   retries: 3
diff --git a/DEPLOY.md b/DEPLOY.md
index b07c5a9..d7d74d3 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -161,7 +161,7 @@ Docker Compose 已配置内置健康检查：
 
 ```yaml
 healthcheck:
-  test: ["CMD", "wget", "-qO-", "http://localhost:${PORT:-5001}/healthz"]
+  test: ["CMD", "/usr/local/bin/busybox", "wget", "-qO-", "http://localhost:${PORT:-5001}/healthz"]
   interval: 30s
   timeout: 10s
   retries: 3
diff --git a/Dockerfile b/Dockerfile
index f9e8bf3..c86f82d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,9 +15,14 @@ RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /out/ds2api ./cmd/ds2api
 
+FROM busybox:1.36.1-musl AS busybox-tools
+
 FROM debian:bookworm-slim AS runtime-base
 WORKDIR /app
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/*
+COPY --from=go-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=busybox-tools /bin/busybox /usr/local/bin/busybox
+EXPOSE 5001
+CMD ["/usr/local/bin/ds2api"]
 
 FROM runtime-base AS runtime-from-source
 COPY --from=go-builder /out/ds2api /usr/local/bin/ds2api
@@ -25,7 +30,7 @@ COPY --from=go-builder /app/sha3_wasm_bg.7b9ca65ddd.wasm /app/sha3_wasm_bg.7b9ca
 COPY --from=go-builder /app/config.example.json /app/config.example.json
 COPY --from=webui-builder /app/static/admin /app/static/admin
 
-FROM runtime-base AS runtime-from-dist
+FROM busybox-tools AS dist-extract
 ARG TARGETARCH
 COPY dist/docker-input/linux_amd64.tar.gz /tmp/ds2api_linux_amd64.tar.gz
 COPY dist/docker-input/linux_arm64.tar.gz /tmp/ds2api_linux_arm64.tar.gz
@@ -38,14 +43,16 @@ RUN set -eux; \
     tar -xzf "${ARCHIVE}" -C /tmp; \
     PKG_DIR="$(find /tmp -maxdepth 1 -type d -name "ds2api_*_linux_${TARGETARCH}" | head -n1)"; \
     test -n "${PKG_DIR}"; \
-    install -Dm755 "${PKG_DIR}/ds2api" /usr/local/bin/ds2api; \
-    install -Dm644 "${PKG_DIR}/sha3_wasm_bg.7b9ca65ddd.wasm" /app/sha3_wasm_bg.7b9ca65ddd.wasm; \
-    install -Dm644 "${PKG_DIR}/config.example.json" /app/config.example.json; \
-    mkdir -p /app/static; \
-    cp -R "${PKG_DIR}/static/admin" /app/static/admin; \
-    rm -rf /tmp/ds2api_* /tmp/ds2api_linux_amd64.tar.gz /tmp/ds2api_linux_arm64.tar.gz
+    mkdir -p /out/static; \
+    cp "${PKG_DIR}/ds2api" /out/ds2api; \
+    cp "${PKG_DIR}/sha3_wasm_bg.7b9ca65ddd.wasm" /out/sha3_wasm_bg.7b9ca65ddd.wasm; \
+    cp "${PKG_DIR}/config.example.json" /out/config.example.json; \
+    cp -R "${PKG_DIR}/static/admin" /out/static/admin
 
-EXPOSE 5001
-CMD ["/usr/local/bin/ds2api"]
+FROM runtime-base AS runtime-from-dist
+COPY --from=dist-extract /out/ds2api /usr/local/bin/ds2api
+COPY --from=dist-extract /out/sha3_wasm_bg.7b9ca65ddd.wasm /app/sha3_wasm_bg.7b9ca65ddd.wasm
+COPY --from=dist-extract /out/config.example.json /app/config.example.json
+COPY --from=dist-extract /out/static/admin /app/static/admin
 
 FROM runtime-from-source AS final
diff --git a/docker-compose.yml b/docker-compose.yml
index a3f93f7..2ac83e1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,7 +11,7 @@ services:
       - HOST=0.0.0.0
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:${PORT:-5001}/healthz"]
+      test: ["CMD", "/usr/local/bin/busybox", "wget", "-qO-", "http://localhost:${PORT:-5001}/healthz"]
       interval: 30s
       timeout: 10s
       retries: 3