diff --git a/docker/Dockerfile b/docker/Dockerfile
index 0d703c7e4..096c7b55b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -88,6 +88,7 @@ RUN apt-get update \
     lsof \
     nano \
     unar \
+    openssl \
     postgresql-client-18 \
     libchromaprint-tools \
     libjemalloc2 \
diff --git a/tests/test_release_supply_chain.py b/tests/test_release_supply_chain.py
index 46dfb6e36..2b5db8fb3 100644
--- a/tests/test_release_supply_chain.py
+++ b/tests/test_release_supply_chain.py
@@ -32,7 +32,7 @@ def _steps_by_name(workflow: dict) -> dict[str, dict]:
 
 
 def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() -> None:
-    """基础镜像允许获得上游更新，构建阶段不得无边界升级整套 Debian。"""
+    """基础镜像允许更新，并仅显式刷新运行时安全包而非整套 Debian。"""
     dockerfile = DOCKERFILE.read_text(encoding="utf-8")
 
     assert 'ARG MOVIEPILOT_PYTHON_VERSION="3.14.7"' in dockerfile
@@ -45,6 +45,7 @@ def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() ->
     assert "ARG MOVIEPILOT_PYTHON_VERSION" in free_threaded_stage
     assert 'uv python install --no-bin "${MOVIEPILOT_PYTHON_VERSION}t"' in free_threaded_stage
     assert "apt-get upgrade" not in dockerfile
+    assert "\n    openssl \\\n" in dockerfile
     assert "\n    util-linux \\\n" in dockerfile