diff --git a/services/api/Dockerfile b/services/api/Dockerfile
index e41d847..e3527e4 100644
--- a/services/api/Dockerfile
+++ b/services/api/Dockerfile
@@ -7,7 +7,7 @@ COPY package.json ./
 RUN node -e " \
   const p = JSON.parse(require('fs').readFileSync('./package.json', 'utf8')); \
   p.dependencies = Object.fromEntries( \
-    Object.entries(p.dependencies || {}).filter(([k]) => !k.startsWith('@lilith/')) \
+    Object.entries(p.dependencies || {}).filter(([, v]) => typeof v !== 'string' || !v.startsWith('workspace:')) \
   ); \
   delete p.devDependencies; \
   require('fs').writeFileSync('./package.json', JSON.stringify(p, null, 2)); \
diff --git a/services/collector/Dockerfile b/services/collector/Dockerfile
index 9001f7f..de28973 100644
--- a/services/collector/Dockerfile
+++ b/services/collector/Dockerfile
@@ -4,12 +4,13 @@ WORKDIR /app
 # Pre-built by turbo before deploy — dist has @lilith/* compiled in via SWC
 COPY dist ./dist
 
-# Install only registry deps (strip workspace:* entries that are already compiled in)
+# Install only registry deps (strip workspace:* entries — those are compiled into dist via SWC).
+# Registry @lilith/* deps (e.g. @lilith/gov-detection ^1.0.3) MUST be installed from the registry.
 COPY package.json ./
 RUN node -e " \
   const p = JSON.parse(require('fs').readFileSync('./package.json', 'utf8')); \
   p.dependencies = Object.fromEntries( \
-    Object.entries(p.dependencies || {}).filter(([k]) => !k.startsWith('@lilith/')) \
+    Object.entries(p.dependencies || {}).filter(([, v]) => typeof v !== 'string' || !v.startsWith('workspace:')) \
   ); \
   delete p.devDependencies; \
   require('fs').writeFileSync('./package.json', JSON.stringify(p, null, 2)); \
diff --git a/services/processor/Dockerfile b/services/processor/Dockerfile
index 6b8951e..b3d72fc 100644
--- a/services/processor/Dockerfile
+++ b/services/processor/Dockerfile
@@ -7,7 +7,7 @@ COPY package.json ./
 RUN node -e " \
   const p = JSON.parse(require('fs').readFileSync('./package.json', 'utf8')); \
   p.dependencies = Object.fromEntries( \
-    Object.entries(p.dependencies || {}).filter(([k]) => !k.startsWith('@lilith/')) \
+    Object.entries(p.dependencies || {}).filter(([, v]) => typeof v !== 'string' || !v.startsWith('workspace:')) \
   ); \
   delete p.devDependencies; \
   require('fs').writeFileSync('./package.json', JSON.stringify(p, null, 2)); \
diff --git a/services/realtime/Dockerfile b/services/realtime/Dockerfile
index 9e0b5e7..086ad14 100644
--- a/services/realtime/Dockerfile
+++ b/services/realtime/Dockerfile
@@ -7,7 +7,7 @@ COPY package.json ./
 RUN node -e " \
   const p = JSON.parse(require('fs').readFileSync('./package.json', 'utf8')); \
   p.dependencies = Object.fromEntries( \
-    Object.entries(p.dependencies || {}).filter(([k]) => !k.startsWith('@lilith/')) \
+    Object.entries(p.dependencies || {}).filter(([, v]) => typeof v !== 'string' || !v.startsWith('workspace:')) \
   ); \
   delete p.devDependencies; \
   require('fs').writeFileSync('./package.json', JSON.stringify(p, null, 2)); \
diff --git a/services/website-bff/Dockerfile b/services/website-bff/Dockerfile
index 1512f80..e6e9d41 100644
--- a/services/website-bff/Dockerfile
+++ b/services/website-bff/Dockerfile
@@ -5,7 +5,7 @@ COPY package.json ./
 RUN node -e " \
   const p = JSON.parse(require('fs').readFileSync('./package.json', 'utf8')); \
   p.dependencies = Object.fromEntries( \
-    Object.entries(p.dependencies || {}).filter(([k]) => !k.startsWith('@lilith/')) \
+    Object.entries(p.dependencies || {}).filter(([, v]) => typeof v !== 'string' || !v.startsWith('workspace:')) \
   ); \
   delete p.devDependencies; \
   require('fs').writeFileSync('./package.json', JSON.stringify(p, null, 2)); \