diff --git a/services/playout/Dockerfile b/services/playout/Dockerfile
index 9b53179..9321056 100644
--- a/services/playout/Dockerfile
+++ b/services/playout/Dockerfile
@@ -11,31 +11,56 @@
 # the build still succeeds without them (NDI/DeckLink consumers simply won't be
 # available — SRT/RTMP/test output still work).
 
-FROM node:20-bookworm
+# CasparCG 2.5.0 ships Linux builds as Ubuntu .deb packages (noble = 24.04), not
+# a portable tarball, so the base is ubuntu:24.04 and Node is added on top. The
+# server deb pulls its own GL/ffmpeg/openal runtime deps via apt; we add Xvfb +
+# mesa SW-GL drivers for the headless GL context.
+FROM ubuntu:24.04
 
-ARG CASPAR_VERSION=2.3.3-stable
-ARG CASPAR_URL=https://github.com/CasparCG/server/releases/download/v2.3.3-stable/CasparCG-Server-2.3.3-stable-Linux.tar.gz
+ARG CASPAR_VERSION=2.5.0-stable
+# Server + matching CEF deb (HTML template renderer the server depends on). The
+# %2B in the CEF filename is the URL-encoded '+' from the upstream asset name.
+ARG CASPAR_SERVER_DEB_URL=https://github.com/CasparCG/server/releases/download/v2.5.0-stable/casparcg-server-2.5_2.5.0.stable-noble1_amd64.deb
+ARG CASPAR_CEF_DEB_URL=https://github.com/CasparCG/server/releases/download/v2.5.0-stable/casparcg-cef-142_142.0.17.g60aac24%2B2-noble1_amd64.deb
 ARG NDI_SDK_URL=
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# CasparCG 2.3 Linux runtime deps + Xvfb for headless GL + ffmpeg libs for the
-# FFMPEG consumer (SRT/RTMP output).
+# Base tools + Node 20 (nodesource) + Xvfb for headless GL + mesa SW renderer.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates curl tar xz-utils \
-      xvfb libgl1-mesa-glx libgl1-mesa-dri libglu1-mesa \
-      libx11-6 libxext6 libxrandr2 libxcursor1 libxinerama1 libxi6 \
-      libopenal1 libsndfile1 libavformat59 libavcodec59 libavfilter8 \
-      libswscale6 libswresample4 libpostproc56 fonts-dejavu-core \
+      ca-certificates curl gnupg tar xz-utils \
+      xvfb libgl1-mesa-dri libglu1-mesa fonts-dejavu-core \
+  && mkdir -p /etc/apt/keyrings \
+  && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+       | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+  && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" \
+       > /etc/apt/sources.list.d/nodesource.list \
+  && apt-get update && apt-get install -y --no-install-recommends nodejs \
   && rm -rf /var/lib/apt/lists/*
 
-# ── CasparCG Server ──────────────────────────────────────────────────────────
-WORKDIR /opt
-RUN curl -fsSL "$CASPAR_URL" -o caspar.tar.gz \
-  && mkdir -p /opt/casparcg \
-  && tar xzf caspar.tar.gz -C /opt/casparcg --strip-components=1 \
-  && rm caspar.tar.gz \
-  && (test -f /opt/casparcg/casparcg || test -f /opt/casparcg/CasparCG\ Server || true)
+# ── CasparCG Server 2.5.0 (via .deb) ─────────────────────────────────────────
+# apt resolves the server's runtime deps (GL, ffmpeg, openal, sndfile, …). The
+# deb's install dir is discovered from its file list and symlinked to
+# /opt/casparcg so the entrypoint + config (which run from that dir) stay valid.
+WORKDIR /tmp/caspar
+RUN set -eux; \
+  curl -fsSL "$CASPAR_CEF_DEB_URL" -o cef.deb; \
+  curl -fsSL "$CASPAR_SERVER_DEB_URL" -o server.deb; \
+  apt-get update; \
+  apt-get install -y --no-install-recommends ./cef.deb ./server.deb; \
+  PKG=$(dpkg-deb -f server.deb Package); \
+  echo "casparcg server package: $PKG"; \
+  dpkg -L "$PKG"; \
+  BIN=$(dpkg -L "$PKG" | while read -r f; do \
+        [ -x "$f" ] || continue; \
+        case "$f" in */casparcg|*/CasparCG\ Server) echo "$f";; esac; \
+      done | head -1); \
+  test -n "$BIN"; \
+  DIR=$(dirname "$BIN"); \
+  echo "casparcg binary=$BIN dir=$DIR"; \
+  if [ "$DIR" != "/opt/casparcg" ]; then rm -rf /opt/casparcg; ln -sfn "$DIR" /opt/casparcg; fi; \
+  test -x "/opt/casparcg/$(basename "$BIN")"; \
+  cd /; rm -rf /tmp/caspar /var/lib/apt/lists/*
 
 # ── NDI runtime (optional) ───────────────────────────────────────────────────
 # If an NDI SDK tarball URL is provided, extract its libs to /opt/ndi-lib and
diff --git a/services/playout/casparcg.config b/services/playout/casparcg.config
index 961bab5..9a45e88 100644
--- a/services/playout/casparcg.config
+++ b/services/playout/casparcg.config
@@ -2,8 +2,8 @@
 <configuration>
   <paths>
     <media-path>/media/</media-path>
-    <log-path>/opt/casparcg/log/</log-path>
-    <data-path>/opt/casparcg/data/</data-path>
+    <log-path>/media/casparcg/log/</log-path>
+    <data-path>/media/casparcg/data/</data-path>
     <template-path>/media/templates/</template-path>
   </paths>
 
diff --git a/services/playout/entrypoint.sh b/services/playout/entrypoint.sh
index 7f432d5..e26b3d8 100644
--- a/services/playout/entrypoint.sh
+++ b/services/playout/entrypoint.sh
@@ -20,11 +20,18 @@ if [ -n "${CHANNEL_ID:-}" ]; then
   mkdir -p "/media/live/${CHANNEL_ID}"
 fi
 
+# casparcg.config writes log/ + data/ under /media (the install dir is a symlink
+# into a possibly read-only apt location), so make sure those exist + writable.
+mkdir -p /media/casparcg/log /media/casparcg/data /media/templates
+
 # Launch CasparCG Server from its install dir (it reads ./casparcg.config and
-# resolves relative media paths against the configured media folder).
+# resolves relative media paths against the configured media folder). The deb
+# install names the binary either 'casparcg' or 'CasparCG Server' depending on
+# version, so probe both.
 cd /opt/casparcg
 CASPAR_BIN="./casparcg"
 [ -x "$CASPAR_BIN" ] || CASPAR_BIN="./CasparCG Server"
+[ -x "$CASPAR_BIN" ] || CASPAR_BIN="./casparcg-launcher"
 echo "[entrypoint] launching CasparCG: $CASPAR_BIN"
 "$CASPAR_BIN" &
 CASPAR_PID=$!