diff --git a/runner/Dockerfile b/runner/Dockerfile
index 937d92c..d176715 100644
--- a/runner/Dockerfile
+++ b/runner/Dockerfile
@@ -12,14 +12,17 @@ ENV DEBIAN_FRONTEND=noninteractive \
     WINEDLLOVERRIDES="mscoree,mshtml=" \
     PYTHON_VERSION=3.12.8
 
-# Wine (32-bit + 64-bit: winetricks/regedit needs the 32-bit parts),
+# WineHQ wine-staging (newer than Debian's 8.0, needed for Python 3.12),
 # node + git for JS actions, and build/package tooling.
 RUN dpkg --add-architecture i386 \
     && apt-get update \
-    && apt-get install -y --no-install-recommends \
-        ca-certificates curl wget unzip zip \
-        wine wine64 wine32 xvfb xauth cabextract \
-        nodejs git \
+    && apt-get install -y --no-install-recommends ca-certificates curl wget gnupg2 \
+    && mkdir -p /etc/apt/keyrings \
+    && wget -qO- https://dl.winehq.org/wine-builds/winehq.key | gpg --dearmor -o /etc/apt/keyrings/winehq.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/winehq.gpg] https://dl.winehq.org/wine-builds/debian/ bookworm main" > /etc/apt/sources.list.d/winehq.list \
+    && apt-get update \
+    && apt-get install -y --install-recommends winehq-staging \
+    && apt-get install -y --no-install-recommends unzip zip xvfb xauth cabextract nodejs git \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # winetricks (standalone script; not packaged in Debian main).
@@ -35,20 +38,24 @@ RUN wget -qO /usr/local/bin/act_runner \
 # MSVC runtime required by PySide6's Qt DLLs (also initializes the Wine prefix).
 RUN xvfb-run -a winetricks --unattended vcrun2022
 
-# Windows CPython 3.12 (full installer: bundles pip + OpenSSL; needs wine32 for
-# the 32-bit installer bootstrap, which is installed above).
-RUN wget -qO /tmp/python-installer.exe \
-      "https://www.python.org/ftp/python/${PYTHON_VERSION}/python-${PYTHON_VERSION}-amd64.exe" \
-    && xvfb-run -a wine /tmp/python-installer.exe \
-        /quiet InstallAllUsers=1 PrependPath=1 TargetDir=C:\\Python312 Include_test=0 Include_launcher=0 Shortcuts=0 \
-    && rm -f /tmp/python-installer.exe \
+# Windows CPython 3.12 (embeddable zip) + pip.
+RUN wget -qO /tmp/pyembed.zip \
+      "https://www.python.org/ftp/python/${PYTHON_VERSION}/python-${PYTHON_VERSION}-embed-amd64.zip" \
+    && mkdir -p /root/.wine/drive_c/Python312 \
+    && cd /root/.wine/drive_c/Python312 \
+    && unzip -q /tmp/pyembed.zip \
+    && rm -f /tmp/pyembed.zip \
+    && printf 'python312.zip\n.\nimport site\nLib\\site-packages\n' > python312._pth \
     && wine "C:\\Python312\\python.exe" --version
 
 # Convenience wrapper: winpython -> wine C:\Python312\python.exe
 RUN printf '#!/bin/sh\nexec wine "C:\\Python312\\python.exe" "$@"\n' > /usr/local/bin/winpython \
     && chmod +x /usr/local/bin/winpython
 
-# Pre-install the Windows build deps so CI jobs start fast.
+# Bootstrap pip, then pre-install the Windows build deps so CI jobs start fast.
+RUN wget -qO /tmp/get-pip.py https://bootstrap.pypa.io/get-pip.py \
+    && wine "C:\\Python312\\python.exe" /tmp/get-pip.py \
+    && rm -f /tmp/get-pip.py
 COPY requirements-build.txt /tmp/requirements-build.txt
 RUN winpython -m pip install --upgrade pip \
     && winpython -m pip install -r /tmp/requirements-build.txt \