diff --git a/Dockerfile b/Dockerfile
index 0b317d2..636a8cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -64,6 +64,12 @@ RUN npm prune --omit=dev
 FROM compiling AS toolchain
 COPY --from=lean /app/node_modules /app/runtime/node_modules
 RUN printf '{"type":"module","private":true}\n' > /app/runtime/package.json
+# **git, because a pull request's merge check runs in this image too** (novox/hq ADR 0237): a repository's
+# own merge-check.sh that declares this toolchain runs here, and a suite that reads a repository's history
+# (the lab's last-run record) ran into "spawnSync git ENOENT". Nothing compiled here calls it.
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends git \
+      && rm -rf /var/lib/apt/lists/*
 
 # ---- runtime: what a module's own service may run in ------------------------------------------
 FROM ${NODE_BASE} AS runtime