diff --git a/blockchain-vks/Dockerfile b/blockchain-vks/Dockerfile
index 389157450..8edd94542 100644
--- a/blockchain-vks/Dockerfile
+++ b/blockchain-vks/Dockerfile
@@ -1,8 +1,28 @@
-FROM 278380418400.dkr.ecr.eu-west-2.amazonaws.com/aztec-connect-cpp-x86_64-linux-clang
+# ==========================================
+# Stage 1: Source Extraction
+# We name this stage 'cpp-source' to avoid brittle index referencing (like --from=0)
+# ==========================================
+FROM 278380418400.dkr.ecr.eu-west-2.amazonaws.com/aztec-connect-cpp-x86_64-linux-clang AS cpp-source
+
+# ==========================================
+# Stage 2: Builder / Runtime
+# Upgraded to Node 20 (Active LTS) and newer Alpine for better security and performance.
+# ==========================================
+FROM node:20-alpine
+
+# Install system dependencies
+# Using --no-cache eliminates the need for 'apk update' and keeps the image small.
+RUN apk add --no-cache bash curl
+
+# Copy artifacts from the named stage (cpp-source)
+COPY --from=cpp-source /usr/src/aztec-connect-cpp/ /usr/src/aztec-connect-cpp
 
-FROM node:16-alpine3.15
-RUN apk update && apk add --no-cache bash curl
-COPY --from=0 /usr/src/aztec-connect-cpp/ /usr/src/aztec-connect-cpp
 WORKDIR /usr/src/blockchain-vks
+
+# Copy project files
+# IMPORTANT: Ensure you have a .dockerignore file to exclude node_modules, .git, etc.
 COPY . .
-RUN ./generate_vks.sh
\ No newline at end of file
+
+# Grant execution permissions and run the generation script
+# This prevents "permission denied" errors if the file mode was lost during copy.
+RUN chmod +x generate_vks.sh && ./generate_vks.sh