diff --git a/Dockerfile b/Dockerfile
index 6cb5deea3e..df3f5dfd81 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,15 +1,12 @@
-FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine3.23@sha256:732cd42c6f659814c9804ad7b05c7f761e83ef8379c5b2fdc3af673353caff73 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-amd64@sha256:69ff714a42f7931475acfcd2792d69cd4a656e4f3653d520e25c0fbe3c6d0cba AS build
 WORKDIR /source
 
-# Install pre-reqs for SASS compilation
-RUN apk add --no-cache gcompat
-
 COPY . ./
 RUN dotnet tool restore
 RUN dotnet restore
 RUN dotnet publish --no-restore --configuration Release
 
-FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.23@sha256:1201dde897ab436b7c6b386f6dbd4f9a3ca0245f9c5a8aac8f8bcdccb4c7d484
+FROM mcr.microsoft.com/dotnet/aspnet:10.0.8-noble-chiseled-extra-amd64@sha256:d3552fc1bd9b5195f6a397a547975fa1dbfb21870b4710f929eaa9adc5ceee42
 ARG GIT_SHA
 WORKDIR /Apps
 COPY --from=build /source/src/TeachingRecordSystem.Api/bin/Release/net10.0/publish/ ./Api/
@@ -18,20 +15,9 @@ COPY --from=build /source/src/TeachingRecordSystem.SupportUi/bin/Release/net10.0
 COPY --from=build /source/src/TeachingRecordSystem.Worker/bin/Release/net10.0/publish/ ./Worker/
 COPY --from=build /source/src/TeachingRecordSystem.AuthorizeAccess/bin/Release/net10.0/publish/ ./AuthorizeAccess/
 
-# Ensure culture data is available
-RUN apk add --no-cache tzdata icu-data-full icu-libs
-ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false
-
-RUN apk --no-cache add postgresql17-client
-
-# Fix for invoking trscli
-RUN apk --no-cache add libc6-compat
-
 ENV SENTRY_RELEASE=${GIT_SHA}
 ENV GIT_SHA=${GIT_SHA}
 ENV ASPNETCORE_HTTP_PORTS=3000
 ENV PATH="${PATH}:/Apps/TrsCli"
 
-RUN addgroup -S appgroup -g 20001 && adduser -S appuser -G appgroup -u 10001
-
-USER 10001
+USER $APP_UID
diff --git a/global_config/dev.sh b/global_config/dev.sh
index 087e833a25..e91215401b 100644
--- a/global_config/dev.sh
+++ b/global_config/dev.sh
@@ -2,4 +2,4 @@ CONFIG=dev
 CONFIG_SHORT=dv
 AZURE_SUBSCRIPTION=s189-teacher-services-cloud-test
 AZURE_RESOURCE_PREFIX=s189t01
-TERRAFORM_MODULES_TAG=main
+TERRAFORM_MODULES_TAG=chiseled-dotnet
diff --git a/terraform/aks/app.tf b/terraform/aks/app.tf
index 3b07c0c983..27e1759e0c 100644
--- a/terraform/aks/app.tf
+++ b/terraform/aks/app.tf
@@ -23,8 +23,8 @@ module "migrations" {
   environment  = local.app_name_suffix
   service_name = var.service_name
   docker_image = var.docker_image
-  commands     = ["trscli"]
-  arguments    = ["migrate-db", "--connection-string", "$(CONNECTION_STRING)"]
+  commands     = ["dotnet"]
+  arguments    = ["/Apps/TrsCli/trscli.dll", "migrate-db", "--connection-string", "$(CONNECTION_STRING)"]
   job_name     = "migrations"
   enable_logit = var.enable_logit
 
@@ -66,7 +66,8 @@ module "api_application" {
   kubernetes_secret_name     = module.api_application_configuration.kubernetes_secret_name
 
   docker_image    = var.docker_image
-  command         = ["/bin/ash", "-c", "cd /Apps/Api/; dotnet TeachingRecordSystem.Api.dll;"]
+  command         = ["dotnet", "TeachingRecordSystem.Api.dll"]
+  working_dir     = "/Apps/Api"
   web_port        = 3000
   probe_path      = "/health"
   replicas        = var.api_replicas
@@ -109,7 +110,8 @@ module "authz_application" {
   kubernetes_secret_name     = module.authz_application_configuration.kubernetes_secret_name
 
   docker_image    = var.docker_image
-  command         = ["/bin/ash", "-c", "cd /Apps/AuthorizeAccess/; dotnet TeachingRecordSystem.AuthorizeAccess.dll;"]
+  command         = ["dotnet", "TeachingRecordSystem.AuthorizeAccess.dll"]
+  working_dir     = "/Apps/AuthorizeAccess"
   web_port        = 3000
   probe_path      = "/health"
   replicas        = var.authz_replicas
@@ -152,7 +154,8 @@ module "ui_application" {
   kubernetes_secret_name     = module.ui_application_configuration.kubernetes_secret_name
 
   docker_image                 = var.docker_image
-  command                      = ["/bin/ash", "-c", "cd /Apps/SupportUi/; dotnet TeachingRecordSystem.SupportUi.dll;"]
+  command                      = ["dotnet", "TeachingRecordSystem.SupportUi.dll"]
+  working_dir                  = "/Apps/SupportUi"
   web_port                     = 3000
   probe_path                   = "/health"
   replicas                     = var.ui_replicas
@@ -197,7 +200,8 @@ module "worker_application" {
   kubernetes_secret_name     = module.worker_application_configuration.kubernetes_secret_name
 
   docker_image                 = var.docker_image
-  command                      = ["/bin/ash", "-c", "cd /Apps/Worker/; dotnet TeachingRecordSystem.Worker.dll;"]
+  command                      = ["dotnet", "TeachingRecordSystem.Worker.dll"]
+  working_dir                  = "/Apps/Worker"
   replicas                     = var.worker_replicas
   max_memory                   = var.worker_max_memory
   enable_logit                 = var.enable_logit