diff --git a/.cargo/config.toml b/.cargo/config.toml
index f973e9d..dd787e6 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,5 +1,5 @@
 [target.x86_64-unknown-linux-gnu]
-rustflags = ["-C", "link-arg=-fuse-ld=lld"]
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 
 [target.aarch64-unknown-linux-gnu]
-rustflags = ["-C", "link-arg=-fuse-ld=lld"]
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
diff --git a/Dockerfile b/Dockerfile
index ca958bc..af310b9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,43 +1,59 @@
-# ── Builder stage ────────────────────────────────────────────────────────
-FROM rust:1.93-slim-bookworm AS builder
+# syntax=docker/dockerfile:1
 
+# Multi-stage Dockerfile for brewlog.
+# Uses chisel to create a minimal Ubuntu rootfs for the runtime image.
+
+# ---------------------------------------------------------------------------
+# Builder — Ubuntu with Rust toolchain pre-installed
+# ---------------------------------------------------------------------------
+FROM ubuntu/rust:1.93-26.04_edge AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    clang \
-    lld \
-    libssl-dev \
     pkg-config \
+    libssl-dev \
+    mold \
+    binutils \
+    curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Install tailwindcss standalone
-RUN curl -sL https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64 \
+# Install tailwindcss standalone (needed by build.rs)
+RUN mkdir -p /usr/local/bin \
+    && curl -sL https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64 \
     -o /usr/local/bin/tailwindcss && chmod +x /usr/local/bin/tailwindcss
 
 WORKDIR /app
-
-# Copy dependency files first for layer caching
-COPY Cargo.toml Cargo.lock ./
-
-# Create a dummy main.rs to build dependencies
-RUN mkdir src && echo "fn main() {}" > src/main.rs && \
-    cargo build --release && \
-    rm -rf src
-
-# Copy full source and build
 COPY . .
-RUN cargo build --release --locked
 
-# ── Runtime stage ────────────────────────────────────────────────────────
-FROM debian:bookworm-slim
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --locked \
+    && mkdir -p /out \
+    && cp target/release/brewlog /out/brewlog
 
+# ---------------------------------------------------------------------------
+# Chisel — minimal Ubuntu rootfs
+# ---------------------------------------------------------------------------
+FROM ubuntu:26.04 AS chisel
+ARG TARGETARCH=amd64
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    libssl3 \
+    curl ca-certificates \
     && rm -rf /var/lib/apt/lists/*
+RUN curl -sL "https://github.com/canonical/chisel/releases/download/v1.4.1/chisel_v1.4.1_linux_${TARGETARCH}.tar.gz" \
+    | tar xz -C /usr/local/bin
 
-RUN groupadd -g 1000 brewlog && useradd -u 1000 -g brewlog -m brewlog
-
-COPY --from=builder /app/target/release/brewlog /usr/local/bin/brewlog
-
-USER 1000:1000
+RUN mkdir /rootfs && chisel cut --root /rootfs \
+    base-files_base \
+    base-files_release-info \
+    ca-certificates_data \
+    libgcc-s1_libs \
+    libc6_libs \
+    libssl3t64_libs \
+    openssl_bins
 
+# ---------------------------------------------------------------------------
+# Runtime — scratch with chisel rootfs
+# ---------------------------------------------------------------------------
+FROM scratch
+COPY --from=chisel /rootfs /
+COPY --from=builder /out/brewlog /usr/local/bin/brewlog
+USER 65534:65534
 ENTRYPOINT ["brewlog", "serve", "--database-url", "sqlite:///data/brewlog.db"]
diff --git a/fly.toml b/fly.toml
index f84f043..b2f926c 100644
--- a/fly.toml
+++ b/fly.toml
@@ -6,7 +6,7 @@ primary_region = 'lhr'
 [build]
 
 [env]
-BREWLOG_OPENROUTER_MODEL = 'google/gemini-3-flash-preview'
+BREWLOG_OPENROUTER_MODEL = 'google/gemini-3.5-flash'
 BREWLOG_RP_ID = 'coffee.jnsgr.uk'
 BREWLOG_BIND_ADDRESS = '0.0.0.0:3000'
 BREWLOG_RP_ORIGIN = 'https://coffee.jnsgr.uk'