diff --git a/Dockerfile b/Dockerfile
index d7c225d..68775de 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,10 +27,14 @@ FROM node:20-alpine AS runner
 WORKDIR /app
 
 # curl — /api/health smoke check (Coolify HEALTHCHECK).
-# postgresql-client (pg_dump/pg_restore) + rsync + bash — the nightly DB backup
+# postgresql-client (pg_dump/pg_restore) + rsync + openssh-client + bash — the
+# nightly DB backup. openssh-client (Session 64) is NOT optional: rsync shells
+# out to `ssh` for any remote transport, and without it the off-box push dies
+# with "Failed to exec ssh: No such file or directory" AFTER a successful dump —
+# which reads like a network problem and isn't one.
 # (scripts/backup-db.sh) runs INSIDE this container, where SUPABASE_DB_URL and
 # the Supabase network are available. See docs/BACKUP-RUNBOOK.md.
-RUN apk add --no-cache curl tini bash postgresql-client rsync
+RUN apk add --no-cache curl tini bash postgresql-client rsync openssh-client
 
 # PM2 is installed globally so the entrypoint can call `pm2 start` to
 # boot all three pollers (NBA / WNBA / MLB) alongside the Express API.