diff --git a/Dockerfile b/Dockerfile
index 82c8abe..b1b831b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/gleam-lang/gleam:v1.17.0-erlang AS build
+FROM ghcr.io/gleam-lang/gleam:v1.18.0-erlang AS build
 WORKDIR /build
 
 # Makes an amd64 build work on an arm64 host. BeamAsm dual-maps its JIT code
@@ -45,4 +45,5 @@ USER app
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
   CMD curl -fsS "http://localhost:${PORT:-8080}/healthz" || exit 1
-CMD ["./entrypoint.sh", "run"]
+# gleam's generated entrypoint puts SPDX headers above the shebang, so exec-form CMD gets ENOEXEC.
+CMD ["/bin/sh", "./entrypoint.sh", "run"]