diff --git a/Dockerfile b/Dockerfile
index d681b65..4537a3b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,5 @@
+ARG DENO_VERSION=2.9.4
+
 FROM golang:1.25 AS builder
 
 ARG TARGETOS
@@ -16,12 +18,17 @@ COPY internal/ internal/
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
 
-FROM gcr.io/distroless/static:nonroot
+FROM denoland/deno:bin-${DENO_VERSION} AS deno
+
+# Deno is dynamically linked against glibc, so the final image cannot be distroless/static.
+FROM gcr.io/distroless/cc-debian12:nonroot
 
-ENV HOME=/tmp
+ENV HOME=/tmp \
+    NELM_DENO_BINARY_PATH=/usr/local/bin/deno
 
 WORKDIR /
 
+COPY --from=deno /deno /usr/local/bin/deno
 COPY --from=builder /nelm-operator/manager .
 
 USER 65532:65532
diff --git a/Makefile b/Makefile
index f1e34e9..cbf9f86 100644
--- a/Makefile
+++ b/Makefile
@@ -136,7 +136,8 @@ docker-push: ## Push docker image with the manager.
 # - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 # - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
 # To adequately provide solutions that are compatible with multiple platforms, you should consider using this option.
-PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
+# Limited to amd64/arm64: Deno, which the image bundles for TypeScript charts, publishes no other linux builds.
+PLATFORMS ?= linux/arm64,linux/amd64
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
 	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
diff --git a/cmd/main.go b/cmd/main.go
index 2b14ac2..b369891 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -82,7 +82,7 @@ func main() {
 	flag.IntVar(&cfg.NetworkParallelism, "network-parallelism", 30, "Limit of network-related tasks to run in parallel per reconcile.")
 
 	// TypeScript / Misc.
-	flag.StringVar(&cfg.DenoBinaryPath, "deno-binary-path", "", "Path to the Deno binary for TypeScript chart rendering.")
+	flag.StringVar(&cfg.DenoBinaryPath, "deno-binary-path", "", "Path to the Deno binary for TypeScript chart rendering. Falls back to $NELM_DENO_BINARY_PATH, then to downloading Deno at runtime.")
 	flag.StringVar(&cfg.TempDir, "temp-dir", "", "Directory for temporary files.")
 
 	// Logging.
@@ -117,6 +117,10 @@ func main() {
 		cfg.ReleaseStorageSQLConnection = v
 	}
 
+	if v := os.Getenv("NELM_DENO_BINARY_PATH"); v != "" && cfg.DenoBinaryPath == "" {
+		cfg.DenoBinaryPath = v
+	}
+
 	cfg.MetricsCertDir = metricsCertDir
 	cfg.MetricsCertName = metricsCertName
 	cfg.MetricsCertKey = metricsCertKey