diff --git a/Dockerfile b/Dockerfile
index 40d57e3..d90d2c5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,5 @@
+FROM pandoc/typst:latest-alpine AS typst
+
 FROM node:22-alpine
 
 # Enable corepack and activate pnpm
@@ -6,6 +8,10 @@ RUN corepack enable && corepack prepare pnpm@11.3.0 --activate
 # pm2 manages the process; sequelize-cli runs migrations on startup
 RUN npm install -g pm2 sequelize-cli
 
+# Typst — compiles certificate.typ into the downloadable PDF certificate.
+# Not available as an apk package, so lift the binary out of pandoc/typst.
+COPY --from=typst /usr/bin/typst /usr/local/bin/typst
+
 WORKDIR /app
 
 # Install production dependencies only