diff --git a/Dockerfile b/Dockerfile
index be048a4..affd011 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,10 @@ WORKDIR /src
 COPY annonet-arrowstack-ready.zip /tmp/annonet.zip
 RUN unzip -q /tmp/annonet.zip -d /src
 COPY mcpAuthMiddleware.js /src/src/auth/mcpAuthMiddleware.js
+# Arrowstack's database-per-tenant runtime role intentionally cannot install
+# extensions. PostgreSQL 13+ provides gen_random_uuid() in core, and annoNet
+# does not use any other pgcrypto functions.
+RUN sed -i '/^CREATE EXTENSION IF NOT EXISTS pgcrypto;$/d' /src/sql/001_init.sql
 
 FROM node:22-alpine AS frontend-build
 WORKDIR /build/frontend-astro