diff --git a/.trivyignore.rego b/.trivyignore.rego
deleted file mode 100644
index e8c125e..0000000
--- a/.trivyignore.rego
+++ /dev/null
@@ -1,12 +0,0 @@
-package trivy
-
-import rego.v1
-
-default ignore := false
-
-# libexpat is a native OS library in the base image that the JVM never loads.
-# Java XML parsing uses the JDK's pure-Java parsers.
-ignore if {
-	input.PkgName == "libexpat"
-	startswith(input.PkgIdentifier.PURL, "pkg:apk/")
-}
diff --git a/Dockerfile b/Dockerfile
index 92205f5..6900c67 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,9 @@
 # sha from https://hub.docker.com/layers/library/eclipse-temurin/21.0.13_9-jre-alpine-3.23/images/sha256-5583e3116cba3393e885b70a4498fc961556fa42afa2d892ecffcd4f689e2107
 FROM eclipse-temurin@sha256:5583e3116cba3393e885b70a4498fc961556fa42afa2d892ecffcd4f689e2107
 
+# Headless service: remove the unused font support (fontconfig brings libexpat, libpng and freetype)
+RUN apk del --no-cache fontconfig ttf-dejavu
+
 WORKDIR /app
 EXPOSE 8088
 
@@ -17,7 +20,7 @@ COPY ./run_tool.sh /app
 COPY ./conf/default-config.json /app/conf/
 COPY ./conf/*.xml /app/conf/
 
-RUN apk add --no-cache --upgrade libpng libcrypto3 libssl3 musl musl-utils gnutls && addgroup --gid 1100 uidusers && adduser -D -G uidusers --uid 1100 uid2-optout && mkdir -p /opt/uid2 && chmod 755 -R /opt/uid2 && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating
+RUN apk add --no-cache --upgrade libcrypto3 libssl3 musl musl-utils gnutls && addgroup --gid 1100 uidusers && adduser -D -G uidusers --uid 1100 uid2-optout && mkdir -p /opt/uid2 && chmod 755 -R /opt/uid2 && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating
 USER uid2-optout
 
 CMD java \