diff --git a/Dockerfile b/Dockerfile
index 14729b6..035d6db 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,10 +28,10 @@ COPY --from=deps /app/node_modules ./node_modules
 COPY package.json ./
 COPY src/ ./src/
 
-# Generated reports are written here. Owned by `node` so the unprivileged
-# process can write, and a volume is mounted over it in compose so files
-# survive a rebuild.
-RUN mkdir -p /app/storage/artifacts && chown -R node:node /app/storage
+# Both of these get a named volume mounted over them in compose. Docker seeds a
+# NEW volume from the image path — including ownership — so they must exist here
+# owned by `node`, or the unprivileged process gets EACCES on first write.
+RUN mkdir -p /app/storage/artifacts /app/.transformers-cache     && chown -R node:node /app/storage /app/.transformers-cache
 
 USER node
 EXPOSE 4000