diff --git a/Dockerfile b/Dockerfile
index f04909cc10..10a4ff2acf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -25,7 +25,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 # hermes process, the dashboard, and per-profile gateways.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-    ca-certificates curl python3 python-is-python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli xz-utils && \
+    ca-certificates curl python3 python-is-python3 ripgrep ffmpeg gcc python3-dev libffi-dev libolm-dev procps git openssh-client docker-cli xz-utils && \
     rm -rf /var/lib/apt/lists/*
 
 # ---------- s6-overlay install ----------
diff --git a/pyproject.toml b/pyproject.toml
index 327088d399..af4e2a98f0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -197,7 +197,9 @@ all = [
   # no native build path on Windows or modern macOS. With matrix in
   # [all], `uv sync --locked` on Windows tried to build it from sdist
   # and failed on `make`. Lazy-install routes that build to first use,
-  # where the user is expected to have a toolchain available.
+  # where the user is expected to have a toolchain available. The Docker
+  # image ships `libolm-dev` so the lazy-install can build python-olm
+  # from source in the container.
   "hermes-agent[cron]",
   "hermes-agent[cli]",
   "hermes-agent[dev]",