diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6997d4c..ca83862 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+- remove setuptools, wheel and pip from production Docker image
+
 ## [1.0.10] - 2025-11-21
 - rename helmfile.yaml for compatibility with helmfile 1.x
 
diff --git a/Dockerfile b/Dockerfile
index 125974f..dba7d2f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -68,7 +68,8 @@ COPY ./src/satosa /app/
 
 WORKDIR /app
 
-RUN pip install .
+# Uninstall pip, setuptools and wheel after installation to reduce attack surface
+RUN pip install . && pip uninstall -y setuptools wheel pip
 
 # Switch to unprivileged user
 USER ${DOCKER_USER}