diff --git a/templates/web/Dockerfile b/templates/web/Dockerfile
index 0d0fee4..57813e5 100644
--- a/templates/web/Dockerfile
+++ b/templates/web/Dockerfile
@@ -43,15 +43,23 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 # Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
 # Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
 # throwaway container image, so --break-system-packages is the right call
-# instead of forcing every user into a venv for basic prototyping.
-RUN python3 -m pip install --break-system-packages --no-cache-dir --upgrade pip \
-    && python3 -m pip install --break-system-packages --no-cache-dir \
+# instead of forcing every user into a venv for basic prototyping. Not
+# upgrading pip itself first: the Debian-packaged pip 24.0 has no RECORD
+# file (dpkg-installed, not pip-installed), so `pip install --upgrade pip`
+# fails trying to uninstall it in place - and it's unneeded anyway, the
+# packages below install fine under the stock version.
+RUN python3 -m pip install --break-system-packages --no-cache-dir \
         numpy opencv-python-headless onnxruntime \
     && python3 -m pip install --break-system-packages --no-cache-dir \
         torch --index-url https://download.pytorch.org/whl/cpu
 
-# Standard non-root dev user with passwordless sudo.
-RUN useradd --uid 1000 --create-home --shell /bin/bash coder \
+# Standard non-root dev user with passwordless sudo. Ubuntu 24.04's base
+# image already ships a default `ubuntu` user/group at uid/gid 1000, which
+# collides with the explicit --uid 1000 below - drop it first so `coder`
+# can take that uid.
+RUN userdel -r ubuntu 2>/dev/null; \
+    groupdel ubuntu 2>/dev/null; \
+    useradd --uid 1000 --create-home --shell /bin/bash coder \
     && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder \
     && chmod 0440 /etc/sudoers.d/coder
 
@@ -80,8 +88,5 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
 # Bun: global runtime for the ElysiaJS backend and fast scripting.
 RUN curl -fsSL https://bun.sh/install | bash
 
-# Prime the pnpm content-addressable store dir referenced by PNPM_HOME.
-RUN pnpm setup || true
-
 RUN mkdir -p /home/coder/workspace
 WORKDIR /home/coder/workspace