diff --git a/services/playout/Dockerfile b/services/playout/Dockerfile
index b5f2667..de02af1 100644
--- a/services/playout/Dockerfile
+++ b/services/playout/Dockerfile
@@ -1,11 +1,4 @@
 # Wild Dragon Playout sidecar — CasparCG Server + Node AMCP control shim.
-#
-# NDI + DeckLink SDKs are NOT redistributable. They are fetched at build time
-# from URLs supplied as build args; the build still succeeds without them.
-
-# CasparCG 2.4.0 ubuntu22 zip — last release with a generic x86-64 tarball.
-# 2.4.1+ and 2.5.x ship as .deb compiled with AVX2 which crash on Sandy Bridge
-# (AVX only, no AVX2). The ubuntu22 zip ships its own bundled libs under lib/.
 FROM ubuntu:22.04
 
 ARG CASPAR_VERSION=2.4.0-stable
@@ -14,9 +7,14 @@ ARG NDI_SDK_URL=
 
 ENV DEBIAN_FRONTEND=noninteractive
 
+# CEF (HTML producer) needs libnss3 + chromium runtime deps. Without these the
+# server starts fine but SIGABRTs ~30s in when it lazy-inits CEF (NSS -8023).
 RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates curl unzip tar xz-utils gnupg \
       xvfb libgl1-mesa-dri libglu1-mesa fonts-dejavu-core \
+      libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
+      libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
+      libgbm1 libpango-1.0-0 libcairo2 libasound2 libatspi2.0-0 \
   && mkdir -p /etc/apt/keyrings \
   && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
        | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
@@ -25,7 +23,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   && apt-get update && apt-get install -y --no-install-recommends nodejs \
   && rm -rf /var/lib/apt/lists/*
 
-# Zip layout: casparcg_server/{bin/casparcg, lib/*.so, casparcg.config, ...}
 WORKDIR /tmp/caspar
 RUN set -eux; \
   curl -fsSL "$CASPAR_URL" -o caspar.zip; \