diff --git a/Dockerfile b/Dockerfile
index a4d0733..9374348 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,6 +54,13 @@ RUN apt-get update \
 COPY --from=ghcr.io/amacneil/dbmate:2 /usr/local/bin/dbmate /usr/local/bin/dbmate
 COPY db/migrations/ /app/db/migrations/
 
+# debian:*-slim ships without /etc/nsswitch.conf, and glibc then cannot turn a
+# uid back into a user record. libvirt does exactly that lookup before connecting
+# and gives up with "Failed to find user record for uid", whatever the socket
+# permissions are. Restore the plain file-based lookup.
+RUN printf 'passwd: files\ngroup: files\nshadow: files\nhosts: files dns\n' \
+    > /etc/nsswitch.conf
+
 # Unprivileged, but it must land in the host's libvirt group to reach the
 # socket: `group_add` in the compose file does that at run time.
 RUN useradd --system --create-home --uid 10001 app