diff --git a/Dockerfile b/Dockerfile
index 672d13b..34bffe6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,9 +40,13 @@ RUN \
   && install -d -o weblate -g weblate -m 755 /app/cache
 
 # Install dependencies
+# Ubuntu ships Pebble outside dpkg; downstream containers use their own entrypoints.
+# Keep archive tools for manual backups: https://github.com/WeblateOrg/docker/issues/1152
 # hadolint ignore=DL3008,DL3013,SC2046,DL3003
 RUN \
   export DEBIAN_FRONTEND=noninteractive \
+  && rm -f /usr/bin/pebble \
+  && rm -rf /var/lib/pebble \
   && apt-get update \
   && apt-get upgrade -y \
   && apt-get install --no-install-recommends -y \
@@ -57,7 +61,6 @@ RUN \
     gettext \
     gnupg \
     subversion \
-    file \
     locales \
     libldap-common \
     unzip \
diff --git a/tests/test-content b/tests/test-content
index 6a7a59d..82af43f 100755
--- a/tests/test-content
+++ b/tests/test-content
@@ -23,13 +23,20 @@ echo "Listing container content..."
 docker export "$CONTAINER" | tar t > "$STORAGE"
 echo "Checking expected content..."
 
-for ENTRY in app/ app/cache/ app/data/; do
+for ENTRY in app/ app/cache/ app/data/ usr/bin/unzip usr/bin/xz; do
     if ! grep -Fqx "$ENTRY" "$STORAGE"; then
         echo "/$ENTRY is missing!"
         exit 1
     fi
 done
 
+echo "Checking unused components are absent..."
+
+if grep -E '^(usr/bin/(pebble|file)|var/lib/pebble)(/|$)' "$STORAGE"; then
+    echo "Unused components are present!"
+    exit 1
+fi
+
 echo "Checking empty runtime directories..."
 
 # /app/data is not checked because it contains a stub for customization.