diff --git a/Dockerfile b/Dockerfile
index 06ece0f0..f56d9277 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,9 +3,10 @@
 # barichello/godot-ci:4.7.1 (linux/amd64), resolved 2026-08-29.
 FROM --platform=linux/amd64 barichello/godot-ci@sha256:622e5ca81b54cd8038ecf7de5d157b47efc800d7cf635af2eec18a6aee4bab7e AS project-imported
 WORKDIR /workspace
-RUN apt-get update \
- && apt-get install -y --no-install-recommends libfontconfig1 \
- && rm -rf /var/lib/apt/lists/*
+# The pinned headless Godot image already runs imports without fontconfig.
+# Do not refresh its old Ubuntu archive here: its historical keyring rejects
+# current Noble signatures, while this source-only import stage needs no OS
+# packages at all.
 COPY Game /workspace/Game
 # `--import` starts the editor, waits for resource import to finish, then
 # exits. Do not combine it with `--quit`, which ends the editor after one
@@ -29,12 +30,11 @@ RUN sed -i 's|^run/main_scene=.*$|run/main_scene="res://scenes/server_boot.tscn"
  && mkdir -p /opt/cosmic-clash \
  && godot --headless --path Game --export-release "Linux Dedicated Server" /opt/cosmic-clash/CosmicClashServer.x86_64
 
-# ubuntu:24.04 multi-architecture index, resolved 2026-09-01. The previous
-# pin (571c2ab1...) no longer resolves from Docker Hub as of this date --
-# `docker pull` by that exact digest returns "not found", meaning
-# make verify-phase6 (and this Dockerfile generally) was currently broken for
-# anyone building from a clean cache. Re-pinned to a digest verified to pull.
-FROM --platform=linux/amd64 ubuntu@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517 AS server
+# ubuntu:noble linux/amd64 manifest, resolved 2026-09-03. The prior pin
+# carried an obsolete archive keyring and rejected current Noble signatures
+# during apt-get update. This remains a digest pin; package verification is
+# deliberately not bypassed.
+FROM --platform=linux/amd64 ubuntu@sha256:1e0a86e57d247923571b75e0aaf48a1449cf8c543d51fb3e07a4a7d7bfa79316 AS server
 RUN apt-get update && apt-get install -y --no-install-recommends libfontconfig1 libgl1 libstdc++6 && rm -rf /var/lib/apt/lists/*
 COPY --from=exporter /opt/cosmic-clash/ /opt/cosmic-clash/
 COPY deploy/cosmic-clash-server /opt/cosmic-clash/cosmic-clash-server