diff --git a/Dockerfile.reproducible b/Dockerfile.reproducible
index 76eb931f49..e98442c7ad 100644
--- a/Dockerfile.reproducible
+++ b/Dockerfile.reproducible
@@ -17,11 +17,21 @@ WORKDIR /app
 # Build the project with the reproducible settings
 RUN make build-reproducible
 
-# Move the binary to a standard location
+# Move the binary and runtime libs to fixed paths for arch-independent copying below.
 RUN mv /app/target/${RUST_TARGET}/release/lighthouse /lighthouse
+# libssl and libcrypto live under an arch-specific triplet dir; normalise to /libs/.
+RUN mkdir /libs \
+    && find /usr/lib -maxdepth 2 \( -name "libssl.so.1.1" -o -name "libcrypto.so.1.1" \) \
+       -exec cp {} /libs/ \;
 
-# Create a minimal final image with just the binary
-FROM gcr.io/distroless/cc-debian12:nonroot-6755e21ccd99ddead6edc8106ba03888cbeed41a
+# Final image: distroless/cc-debian11 (Bullseye) — matches builder OS for ABI compatibility.
+# The cc variant already includes libc + libgcc; we copy libssl/libcrypto from the builder
+# so the runtime layer is fully pinned with no package manager invocations.
+# gcr.io/distroless/cc-debian11:nonroot
+FROM gcr.io/distroless/cc-debian11:nonroot@sha256:f7fa4923556853754e9ff647df410d5711fc4d99a8dafa777ec617cf4a6700f6
+
+COPY --from=builder /libs/libssl.so.1.1    /usr/lib/
+COPY --from=builder /libs/libcrypto.so.1.1 /usr/lib/
 COPY --from=builder /lighthouse /lighthouse
 
 ENTRYPOINT [ "/lighthouse" ]