diff --git a/Dockerfile b/Dockerfile
index 89e7f04..cc77f12 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -231,17 +231,17 @@ RUN curl -fsSL https://bun.sh/install | bash
 # ============================================================
 RUN python3 -m pip install --user --break-system-packages --no-cache-dir pipx \
     && python3 -m pipx ensurepath \
-    && pipx install uv \
-    && pipx install ruff \
-    && pipx install mypy \
-    && pipx install pytest \
-    && pipx install pip-audit \
-    && pipx install semgrep \
+    && python3 -m pipx install uv \
+    && python3 -m pipx install ruff \
+    && python3 -m pipx install mypy \
+    && python3 -m pipx install pytest \
+    && python3 -m pipx install pip-audit \
+    && python3 -m pipx install semgrep \
     # mypy needs the third-party stub packages injected into its own pipx
     # venv (mypy-isolated, not the system site-packages). Without these,
     # `mypy --strict` against any project that imports requests/PyYAML/etc.
     # fails with "Library stubs not installed for X" exit 1.
-    && pipx inject mypy types-requests types-PyYAML types-setuptools
+    && python3 -m pipx inject mypy types-requests types-PyYAML types-setuptools
 
 # ============================================================
 # Reset GOPATH to crafter-owned path BEFORE the go install runs as crafter.