diff --git a/argocd/manifests/kiwix/deployment.yaml b/argocd/manifests/kiwix/deployment.yaml
index ec141dc..7b1f802 100644
--- a/argocd/manifests/kiwix/deployment.yaml
+++ b/argocd/manifests/kiwix/deployment.yaml
@@ -20,9 +20,10 @@ spec:
       containers:
         # Main kiwix-serve container
         - name: kiwix-serve
-          image: ghcr.io/kiwix/kiwix-serve:3.8.1
-          command: ["/bin/sh", "-c"]
+          image: registry.ops.eblu.me/blumeops/kiwix-serve:v1.0.0
           args:
+            - "/bin/sh"
+            - "-c"
             - "kiwix-serve --port=80 /data/complete/*.zim"
           ports:
             - containerPort: 80
diff --git a/containers/kiwix-serve/Dockerfile b/containers/kiwix-serve/Dockerfile
new file mode 100644
index 0000000..c656c30
--- /dev/null
+++ b/containers/kiwix-serve/Dockerfile
@@ -0,0 +1,31 @@
+# kiwix-serve container
+# Downloads pre-built binary from kiwix mirror
+
+FROM alpine:3.21
+
+ARG TARGETPLATFORM
+ARG KIWIX_VERSION=3.8.1
+
+RUN set -e && \
+    apk --no-cache add dumb-init curl && \
+    echo "TARGETPLATFORM: $TARGETPLATFORM" && \
+    if [ "$TARGETPLATFORM" = "linux/arm64/v8" -o "$TARGETPLATFORM" = "linux/arm64" ]; then \
+        ARCH="aarch64"; \
+    elif [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+        ARCH="x86_64"; \
+    else \
+        ARCH="unknown"; \
+    fi && \
+    url="http://mirror.download.kiwix.org/release/kiwix-tools/kiwix-tools_linux-$ARCH-$KIWIX_VERSION.tar.gz" && \
+    echo "URL: $url" && \
+    curl -k -L $url | tar -xz -C /usr/local/bin/ --strip-components 1 && \
+    apk del curl
+
+EXPOSE 80
+
+# Run as non-root
+RUN adduser -D -u 1000 kiwix
+USER kiwix
+
+ENTRYPOINT ["/usr/bin/dumb-init", "--"]
+CMD ["/bin/sh", "-c", "echo 'Use: kiwix-serve [options] <zim-files>' && kiwix-serve --help"]