diff --git a/Dockerfile b/Dockerfile
index 20a678c6..fe289a57 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,10 +7,24 @@ FROM composer:2 AS vendor
 WORKDIR /app
 COPY composer.json composer.lock symfony.lock ./
 # --no-scripts: the Symfony kernel isn't fully copied yet; scripts run later in entrypoint.
-RUN composer install \
-        --no-dev --no-scripts --no-interaction \
-        --prefer-dist --optimize-autoloader \
-        --ignore-platform-reqs
+#
+# The Coolify build host intermittently gets HTTP 400 from codeload.github.com
+# when Composer pulls dist zips. Mitigations:
+#   - bump Composer's own HTTP retry count
+#   - wrap the whole install in a retry loop
+#   - on the final attempt, fall back to --prefer-source (git clone) which uses
+#     a different endpoint than codeload dist zips
+ENV COMPOSER_HTTP_RETRIES=5
+RUN set -eu; \
+    for i in 1 2 3 4 5; do \
+        composer install --no-dev --no-scripts --no-interaction \
+            --prefer-dist --optimize-autoloader --ignore-platform-reqs && exit 0; \
+        echo "composer install failed (attempt $i) — retrying in 5s"; \
+        sleep 5; \
+    done; \
+    echo "dist download kept failing — final attempt via --prefer-source"; \
+    composer install --no-dev --no-scripts --no-interaction \
+        --prefer-source --optimize-autoloader --ignore-platform-reqs
 
 # ============================================================
 # Stage 2 — Frontend assets (Webpack Encore / React 19)