diff --git a/containers/jobsync/default.nix b/containers/jobsync/default.nix
index bd3f0a2..8177e84 100644
--- a/containers/jobsync/default.nix
+++ b/containers/jobsync/default.nix
@@ -21,10 +21,8 @@ let
 
     nodejs = pkgs.nodejs_20;
 
-    nativeBuildInputs = [ pkgs.makeWrapper ];
-
-    # Patch out Google Fonts import (nix sandbox blocks network access).
-    # Replace with a simple object that provides the CSS variable class name.
+    # Patch out Google Fonts import (nix sandbox blocks network access at
+    # build time). Replace with a simple object; app uses system sans-serif.
     postPatch = ''
       substituteInPlace src/app/layout.tsx \
         --replace-fail 'import { Inter } from "next/font/google";' "" \
@@ -34,7 +32,7 @@ let
 });' 'const inter = { variable: "" };'
     '';
 
-    # Point Prisma at nixpkgs-built engines (no network download needed)
+    # Point Prisma at nixpkgs-built engines (no network download in sandbox)
     env = {
       PRISMA_QUERY_ENGINE_LIBRARY = "${prismaEngines}/lib/libquery_engine.node";
       PRISMA_QUERY_ENGINE_BINARY = "${prismaEngines}/bin/query-engine";
@@ -57,13 +55,6 @@ let
       runHook postBuild
     '';
 
-    # Skip npm prune — prisma CLI is a devDependency but needed at runtime
-    # for `migrate deploy`, and it has a deep transitive dependency tree
-    # (@prisma/config -> effect, c12, etc.) that's impractical to save/restore
-    # individually.
-    npmPruneFlags = [ ];
-    dontNpmPrune = true;
-
     installPhase = ''
       runHook preInstall
 
@@ -77,26 +68,6 @@ let
       # Copy Prisma schema and migrations for runtime migrate deploy
       cp -r prisma $out/app/prisma
 
-      # Copy prisma and generated client (kept by dontNpmPrune)
-      cp -r node_modules/.prisma $out/app/node_modules/.prisma || true
-      cp -r node_modules/prisma $out/app/node_modules/prisma || true
-      # Copy all @prisma/* packages (engines, config, get-platform, etc.)
-      mkdir -p $out/app/node_modules/@prisma
-      for pkg in node_modules/@prisma/*; do
-        name=$(basename "$pkg")
-        # Don't overwrite @prisma/client from standalone output
-        if [ ! -d "$out/app/node_modules/@prisma/$name" ]; then
-          cp -r "$pkg" "$out/app/node_modules/@prisma/$name"
-        fi
-      done
-      # Copy transitive deps of prisma CLI (effect, c12, etc.)
-      for dep in effect @effect c12 deepmerge-ts empathic confbox defu dotenv \
-                 exsolve giget jiti ohash pathe perfect-debounce chokidar; do
-        if [ -d "node_modules/$dep" ]; then
-          cp -r "node_modules/$dep" "$out/app/node_modules/$dep" 2>/dev/null || true
-        fi
-      done
-
       # Copy entrypoint
       cp ${./entrypoint.sh} $out/app/entrypoint.sh
 
diff --git a/containers/jobsync/entrypoint.sh b/containers/jobsync/entrypoint.sh
index a5e4d70..4dc611f 100644
--- a/containers/jobsync/entrypoint.sh
+++ b/containers/jobsync/entrypoint.sh
@@ -8,8 +8,8 @@ if [ -z "$AUTH_SECRET" ]; then
   echo "AUTH_SECRET was not set — generated a temporary secret for this container."
 fi
 
-# Run Prisma migrations (use local node_modules binary, not npx)
-node node_modules/prisma/build/index.js migrate deploy
+# Run Prisma migrations (npx -y downloads prisma if not in local node_modules)
+npx -y prisma@6.19.0 migrate deploy
 
 # Start the Next.js server
 exec node server.js