diff --git a/docker/Dockerfile b/docker/Dockerfile
index a189958..a8e4815 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,26 @@
 FROM bitnami/haproxy
 
+# The base is Photon OS, and its openssl.cnf reads this variable directly:
+#
+#     [alg_sect]
+#     default_properties = ?fips=$ENV::OPENSSL_FIPS
+#
+# The base image ships "yes", so every algorithm fetch prefers the FIPS
+# provider — and that provider cannot produce an X25519MLKEM768 key:
+# ssl_generate_pkey_group fails. HAProxy offers the group regardless, because
+# OpenSSL 3.5 lists it first and haproxy.cfg sets no `ssl-default-bind-curves`,
+# so it picks a group it then cannot use and answers a fatal illegal_parameter.
+# Every client that offers post-quantum key exchange — curl, browsers, anything
+# on OpenSSL 3.5 — is refused; only a client asking for a classical group gets
+# in. That is how this image closed the public door on 2026-09-02 with no commit
+# behind it: `FROM bitnami/haproxy` is untagged and the daily scheduled build
+# picks up whatever the base is that morning.
+#
+# Nothing here needs FIPS. Flipping the variable the base image itself provides
+# restores the door and the post-quantum exchange both; the FIPS provider stays
+# loaded, only the preference is dropped.
+ENV OPENSSL_FIPS=no
+
 # Copy config
 COPY ./docker/haproxy.cfg /bitnami/haproxy/conf/haproxy.cfg