diff --git a/Dockerfile b/Dockerfile
index 7de56462..afdfaf22 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,15 +27,16 @@ ARG G2C_VERSION=1.9.0
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
      build-essential gfortran cmake wget ca-certificates pkg-config \
-     zlib1g-dev libaec-dev libpng-dev \
+     zlib1g-dev libaec-dev libpng-dev libopenjp2-7-dev \
   && rm -rf /var/lib/apt/lists/*
 
-# NCEPLIBS-g2c: wgrib2 >= 3.x requires this via find_package whenever
-# PNG / JPEG2000 decoders are enabled (wgrib2 CMakeLists:94). We only
-# need PNG (MRMS PrecipRate / native HRRR) + AEC — Jasper/OpenJPEG
-# default to ON in g2c and must be explicitly disabled since libjasper
-# isn't installed in this stage and would pull another runtime dep
-# into the debian-slim runner.
+# NCEPLIBS-g2c: wgrib2 >= 3.x delegates GRIB2 decompression to this
+# library via find_package whenever any of JASPER / OPENJPEG / PNG
+# is enabled (wgrib2 CMakeLists:94). Build g2c with all the
+# decoders we care about — PNG (MRMS PrecipRate / HRRR native),
+# OpenJPEG (modern JPEG2000 replacement for the CVE-riddled Jasper),
+# and AEC (CCSDS) — and disable Jasper so we don't need libjasper,
+# which Debian dropped years ago.
 WORKDIR /tmp/g2c
 RUN wget -q --content-disposition "https://github.com/NOAA-EMC/NCEPLIBS-g2c/archive/refs/tags/v${G2C_VERSION}.tar.gz" \
       -O g2c.tar.gz \
@@ -46,21 +47,31 @@ RUN wget -q --content-disposition "https://github.com/NOAA-EMC/NCEPLIBS-g2c/arch
               -DCMAKE_BUILD_TYPE=Release \
               -DUSE_PNG=ON \
               -DUSE_AEC=ON \
+              -DUSE_OpenJPEG=ON \
               -DUSE_Jasper=OFF \
-              -DUSE_OpenJPEG=OFF \
-              -DBUILD_G2C=OFF \
   && make -j$(nproc) \
   && make install
 
 WORKDIR /tmp/wgrib2
 
+# wgrib2 flag notes:
+#   * USE_OPENJPEG is what wgrib2's own CI (Linux_options.yml) tests
+#     — it triggers the g2c linkage and is known to build cleanly. An
+#     earlier attempt with -DUSE_PNG=ON alone got all the way to
+#     linking libwgrib2.so and then died with Error 2 on the wgrib2_exe
+#     link step (wgrib2 doesn't gate every jpeg_pk.c path properly
+#     when USE_PNG is set without USE_JASPER/USE_OPENJPEG).
+#   * wgrib2 delegates actual decompression to g2c, and g2c above was
+#     built with USE_PNG=ON, so PNG-packed GRIB2 (DRT 5.41, e.g. MRMS
+#     PrecipRate) still decodes correctly through this link even
+#     though wgrib2's own USE_PNG knob stays off.
 RUN wget -q --content-disposition "https://github.com/NOAA-EMC/wgrib2/archive/refs/tags/v${WGRIB2_VERSION}.tar.gz" \
       -O wgrib2.tar.gz \
   && tar xzf wgrib2.tar.gz \
   && cd wgrib2-${WGRIB2_VERSION} \
   && mkdir build && cd build \
   && cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release \
-       -DUSE_PNG=ON -DUSE_AEC=ON \
+       -DUSE_OPENJPEG=ON -DUSE_AEC=ON \
   && make -j$(nproc) \
   && make install \
   && strip /usr/local/bin/wgrib2
@@ -125,7 +136,7 @@ FROM ${RUNNER_IMAGE} AS final
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
      libstdc++6 openssl libncurses6 locales ca-certificates snmp \
-     libgfortran5 libaec0 zlib1g libpng16-16t64 \
+     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 \
   && rm -rf /var/lib/apt/lists/*
 
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen