diff --git a/Dockerfile b/Dockerfile
index 20e20be..58a2470 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,8 +7,17 @@
 FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0
 
 # Cloud tooling the lambda steps call (the bridge base stays minimal on purpose):
-# aws + opentofu (tofu) + gomplate. bash, jq, np, base64 and curl ship in the base.
-RUN apk add --no-cache aws-cli opentofu gomplate
+# aws + gomplate from apk. bash, jq, np, base64 and curl ship in the base.
+RUN apk add --no-cache aws-cli gomplate
+
+# OpenTofu >= 1.10 — the scope inits its S3 backend with use_lockfile=true
+# (lambda/scope/tofu/provider/aws/setup), which needs tofu 1.10+. alpine 3.20
+# only packages 1.7.2, so pull the official static binary for the build arch.
+ARG TOFU_VERSION=1.10.6
+ARG TARGETARCH
+RUN curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \
+      | tar -xz -C /usr/local/bin tofu \
+    && tofu version
 
 # Bake the scope in and point the bridge at the lambda entrypoint + service path.
 COPY . /app/pkg