diff --git a/DOCKER.md b/DOCKER.md
index 1cff364..875335f 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -17,7 +17,7 @@ What this produces:
 
 | App | Artifact | Image |
 |---|---|---|
-| API | `apps/api/release/app.js` (+ Prisma under `release/node_modules`) | `docker.arvancloud.ir/node:20-alpine` |
+| API | `apps/api/release/app.js` (+ Prisma under `release/vendor`) | `docker.arvancloud.ir/node:20-bookworm` |
 | Admin | `apps/admin-panel/dist/` | `docker.arvancloud.ir/nginx:latest` |
 | User | `apps/user-app/dist/` | `docker.arvancloud.ir/nginx:latest` |
 
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index 360c1a4..1058fa1 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -1,13 +1,15 @@
-FROM docker.arvancloud.ir/node:20-bookworm-slim
+FROM docker.arvancloud.ir/node:20-bookworm
 
 # Pre-built on the developer machine:
 #   pnpm build:release
+# NOTE: full "bookworm" (not -slim/-alpine) on purpose — Prisma's query engine
+# links against libssl.so.3, which the slim/alpine variants do not ship, and the
+# deploy host cannot reach apt/apk mirrors to install it.
 WORKDIR /app
 
 ENV NODE_ENV=production
 # Vendored Prisma lives in ./vendor (not node_modules — that path is gitignored)
 ENV NODE_PATH=/app/vendor
-# Force Debian OpenSSL 3 engine (bookworm-slim); avoid wrong musl/openssl-1.1 pick
 ENV PRISMA_QUERY_ENGINE_LIBRARY=/app/vendor/.prisma/client/libquery_engine-debian-openssl-3.0.x.so.node
 
 COPY release/ ./
diff --git a/apps/api/release/vendor/.prisma/client/edge.js b/apps/api/release/vendor/.prisma/client/edge.js
index 33a27b9..a685edb 100644
--- a/apps/api/release/vendor/.prisma/client/edge.js
+++ b/apps/api/release/vendor/.prisma/client/edge.js
@@ -434,7 +434,8 @@ const config = {
     "sourceFilePath": "C:\\App\\gold-bank\\apps\\api\\prisma\\schema.prisma"
   },
   "relativeEnvPaths": {
-    "rootEnvPath": null
+    "rootEnvPath": null,
+    "schemaEnvPath": "../../../../../../apps/api/.env"
   },
   "relativePath": "../../../../../../apps/api/prisma",
   "clientVersion": "5.22.0",
diff --git a/apps/api/release/vendor/.prisma/client/index.js b/apps/api/release/vendor/.prisma/client/index.js
index 409be21..0e46ef4 100644
--- a/apps/api/release/vendor/.prisma/client/index.js
+++ b/apps/api/release/vendor/.prisma/client/index.js
@@ -435,7 +435,8 @@ const config = {
     "sourceFilePath": "C:\\App\\gold-bank\\apps\\api\\prisma\\schema.prisma"
   },
   "relativeEnvPaths": {
-    "rootEnvPath": null
+    "rootEnvPath": null,
+    "schemaEnvPath": "../../../../../../apps/api/.env"
   },
   "relativePath": "../../../../../../apps/api/prisma",
   "clientVersion": "5.22.0",
diff --git a/apps/api/release/vendor/.prisma/client/libquery_engine-linux-musl-openssl-3.0.x.so.node b/apps/api/release/vendor/.prisma/client/libquery_engine-linux-musl-openssl-3.0.x.so.node
deleted file mode 100644
index 6e849e2..0000000
Binary files a/apps/api/release/vendor/.prisma/client/libquery_engine-linux-musl-openssl-3.0.x.so.node and /dev/null differ
diff --git a/apps/api/release/vendor/.prisma/client/libquery_engine-linux-musl.so.node b/apps/api/release/vendor/.prisma/client/libquery_engine-linux-musl.so.node
deleted file mode 100644
index fb15dc0..0000000
Binary files a/apps/api/release/vendor/.prisma/client/libquery_engine-linux-musl.so.node and /dev/null differ
diff --git a/apps/api/release/vendor/.prisma/client/query_engine-windows.dll.node b/apps/api/release/vendor/.prisma/client/query_engine-windows.dll.node
deleted file mode 100644
index d46657b..0000000
Binary files a/apps/api/release/vendor/.prisma/client/query_engine-windows.dll.node and /dev/null differ
diff --git a/apps/api/scripts/bundle-release.cjs b/apps/api/scripts/bundle-release.cjs
index b4c66f0..2c6f560 100644
--- a/apps/api/scripts/bundle-release.cjs
+++ b/apps/api/scripts/bundle-release.cjs
@@ -9,9 +9,13 @@ const {
   rmSync,
   cpSync,
   realpathSync,
+  readdirSync,
 } = require('fs');
 const path = require('path');
 
+// Only this engine ships to Docker; see apps/api/Dockerfile (bookworm/OpenSSL 3).
+const RUNTIME_ENGINE = 'libquery_engine-debian-openssl-3.0.x.so.node';
+
 const root = path.join(__dirname, '..');
 const config = require(path.join(root, 'esbuild.release.config.cjs'));
 const releaseDir = path.join(root, 'release');
@@ -44,6 +48,21 @@ function copyPrismaIntoRelease() {
   const prismaEngineDest = path.join(vendorDir, '.prisma', 'client');
   mkdirSync(path.dirname(prismaEngineDest), { recursive: true });
   cpSync(realpathSync(prismaEngineSrc), prismaEngineDest, { recursive: true });
+
+  // Drop engines for other platforms (local Windows dll, stale musl builds) so the
+  // committed artifact stays small.
+  for (const name of readdirSync(prismaEngineDest)) {
+    const isEngine = name.endsWith('.so.node') || name.endsWith('.dll.node');
+    if (isEngine && name !== RUNTIME_ENGINE) {
+      rmSync(path.join(prismaEngineDest, name), { force: true });
+    }
+  }
+
+  if (!existsSync(path.join(prismaEngineDest, RUNTIME_ENGINE))) {
+    throw new Error(
+      `${RUNTIME_ENGINE} تولید نشد. binaryTargets در prisma/schema.prisma را بررسی کنید.`,
+    );
+  }
 }
 
 async function main() {