diff --git a/Dockerfile b/Dockerfile
index 8b62237..ba3b4d2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,14 +3,19 @@ FROM ubuntu:24.04
 ENV DEBIAN_FRONTEND=noninteractive
 ENV APP_DIR=/opt/containers/nats-registration-listener
 ENV DATA_DIR=${APP_DIR}/data
+# venv path and ensure it’s first on PATH for runtime & build steps
+ENV VENV_PATH=/opt/venv
+ENV PATH=${VENV_PATH}/bin:${PATH}
 
-# Minimal deps + Python + dos2unix for CRLF→LF
+# Minimal deps + Python + venv + dos2unix for CRLF→LF
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      bash curl jq ca-certificates tini python3 python3-pip dos2unix \
+      bash curl jq ca-certificates tini python3 python3-venv python3-pip dos2unix \
  && rm -rf /var/lib/apt/lists/*
 
-# Python deps
-RUN pip3 install --no-cache-dir --upgrade nats-py
+# Create a virtual environment and install python deps inside it
+RUN python3 -m venv ${VENV_PATH} \
+ && python -m pip install --no-cache-dir --upgrade pip \
+ && python -m pip install --no-cache-dir --upgrade nats-py
 
 # App payload (immutable inside image)
 RUN mkdir -p ${APP_DIR}/app/bin
@@ -19,7 +24,7 @@ COPY files/entrypoint.sh /usr/local/bin/nats-registration-entrypoint
 COPY files/healthcheck.sh /usr/local/bin/nats-registration-healthcheck
 COPY files/nats_registration_listener.py /usr/local/bin/nats_registration_listener.py
 
-# Normalize line endings (in case files came from Windows) and set exec bits
+# Normalize line endings & set exec bits (Windows-safe)
 RUN dos2unix /usr/local/bin/nats-registration-entrypoint \
              /usr/local/bin/nats-registration-healthcheck \
              ${APP_DIR}/app/bin/nats-registration-listener.sh \
diff --git a/files/entrypoint.sh b/files/entrypoint.sh
index 2390914..e4e5b64 100644
--- a/files/entrypoint.sh
+++ b/files/entrypoint.sh
@@ -5,7 +5,7 @@ log(){ echo "[nats-registration][entrypoint] $*"; }
 err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
 
 # Sanity: tools
-for bin in curl jq python3; do
++for bin in curl jq python; do
   command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; }
 done
 
diff --git a/files/nats-registration-listener.sh b/files/nats-registration-listener.sh
index f5d6546..b7b96d4 100644
--- a/files/nats-registration-listener.sh
+++ b/files/nats-registration-listener.sh
@@ -57,4 +57,4 @@ if [[ -n "${PRINT_RAW:-}" ]]; then
   esac
 fi
 
-exec python3 /usr/local/bin/nats_registration_listener.py "${args[@]}"
+exec python /usr/local/bin/nats_registration_listener.py "${args[@]}"