diff --git a/Dockerfile b/Dockerfile
index ddddb00c4..553de90f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,12 +18,19 @@ ARG UV_VERSION
 # image actually carries `headroom._core`; previously the runtime image
 # shipped without the Rust extension and every compressed request fell
 # back to a Python-only path or no-op.
+#
+# `pkg-config` + `libssl-dev` are required because the workspace
+# transitively pulls `openssl-sys` (via reqwest/native-tls in some
+# dependency chain). Without them, `cargo` fails the maturin build with
+# "Could not find openssl via pkg-config" — observed in PR #350 CI.
 RUN apt-get update && \
   apt-get install -y --no-install-recommends \
     build-essential \
     g++ \
     curl \
     ca-certificates \
+    pkg-config \
+    libssl-dev \
   && rm -rf /var/lib/apt/lists/*
 
 RUN python -m pip install --no-cache-dir uv==${UV_VERSION}
diff --git a/e2e/wrap/Dockerfile b/e2e/wrap/Dockerfile
index 34b8b3765..e46425754 100644
--- a/e2e/wrap/Dockerfile
+++ b/e2e/wrap/Dockerfile
@@ -8,7 +8,14 @@ ENV DEBIAN_FRONTEND=noninteractive \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=1 \
     PYTHONUNBUFFERED=1 \
-    PYTHONDONTWRITEBYTECODE=1
+    PYTHONDONTWRITEBYTECODE=1 \
+    # Hotfix-A0: this image installs headroom in editable mode and does
+    # NOT carry the Rust extension — the wrap-e2e harness exercises CLI
+    # routing only, not compression, so booting the proxy in degraded
+    # Python-only mode is the right scope for this test. Production
+    # images (main Dockerfile + smoke-test) build the wheel; this one
+    # opts out of the fail-loud startup smoke check.
+    HEADROOM_REQUIRE_RUST_CORE=false
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \