diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile
index 8ee6a3d206..a247e0dff1 100644
--- a/contrib/docker/minimal-hardened-image/Dockerfile
+++ b/contrib/docker/minimal-hardened-image/Dockerfile
@@ -9,53 +9,79 @@
 #
 # Once the commands have been run, you can build the image using `yarn docker-build`
 
-FROM cgr.dev/chainguard/wolfi-base:latest
+# syntax = docker/dockerfile:1.4
 
-ENV NODE_VERSION 18=~18.19
-ENV PYTHON_VERSION 3.12=~3.12
+# Build Python environment in a separate builder stage
+FROM cgr.dev/chainguard/python:latest-dev as python-builder
 
-RUN apk add nodejs-$NODE_VERSION yarn
+ENV PATH=/venv/bin:$PATH
 
-# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
-# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
-# Additionally, we install dependencies for `techdocs.generator.runIn: local`.
-# https://backstage.io/docs/features/techdocs/getting-started#disabling-docker-in-docker-situation-optional
-RUN --mount=type=cache,target=/var/cache/apk,sharing=locked \
-    --mount=type=cache,target=/var/lib/apk,sharing=locked \
-    apk update && \
-    apk add sqlite-dev python-$PYTHON_VERSION py3-pip python-3-dev py3-setuptools build-base gcc libffi-dev glibc-dev openssl-dev brotli-dev c-ares-dev nghttp2-dev icu-dev zlib-dev gcc-12 libuv-dev && \
-    yarn config set python /usr/bin/python3
+RUN --mount=type=cache,target=/home/nonroot/.cache/pip,uid=65532,gid=65532 \
+    python3 -m venv /home/nonroot/venv && \
+    /home/nonroot/venv/bin/pip install mkdocs-techdocs-core==1.3.3
 
-# Set up a virtual environment for mkdocs-techdocs-core.
-ENV VIRTUAL_ENV=/opt/venv
-RUN python3 -m venv $VIRTUAL_ENV
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+# Build Node environment in a separate builder stage
+FROM cgr.dev/chainguard/wolfi-base:latest as node-builder
 
-RUN pip3 install mkdocs-techdocs-core==1.3.3
-
-# From here on we use the least-privileged `node` user to run the backend.
-WORKDIR /app
-RUN chown nonroot:nonroot /app
-USER nonroot
-
-# This switches many Node.js dependencies to production mode.
+ENV NODE_VERSION 20=~20.11
 ENV NODE_ENV production
 
-# Copy over Yarn 3 configuration, release, and plugins
-COPY --chown=nonroot:nonroot .yarn ./.yarn
-COPY --chown=nonroot:nonroot .yarnrc.yml ./
+RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,uid=65532,gid=65532 \
+    --mount=type=cache,target=/var/lib/apk,sharing=locked,uid=65532,gid=65532 \
+    apk update && \
+    apk add nodejs-$NODE_VERSION yarn \
+    # Install isolate-vm dependencies, these are needed by the @backstage/plugin-scaffolder-backend.
+    openssl-dev brotli-dev c-ares-dev nghttp2-dev icu-dev zlib-dev gcc-12 libuv-dev build-base
 
-# Copy repo skeleton first, to avoid unnecessary docker cache invalidation.
-# The skeleton contains the package.json of each package in the monorepo,
-# and along with yarn.lock and the root package.json, that's enough to run yarn install.
-COPY --chown=nonroot:nonroot yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
+WORKDIR /app
+RUN chown -R nonroot:nonroot /app
+
+RUN mkdir -p /home/nonroot/.yarn/berry && chown -R 65532:65532 /home/nonroot/.yarn/berry
+
+USER nonroot
+
+COPY --chown=65532:65532 .yarn ./.yarn
+COPY --chown=65532:65532 .yarnrc.yml ./
+
+COPY --chown=65532:65532 yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
 RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz
 
-RUN --mount=type=cache,target=/home/node/.yarn/berry/cache,sharing=locked,uid=1000,gid=1000 \
-    yarn workspaces focus --all --production
+RUN --mount=type=cache,target=/home/nonroot/.yarn/berry/cache,sharing=locked,uid=65532,gid=65532 \
+    yarn workspaces focus --all --production && yarn cache clean --all
 
-# Then copy the rest of the backend bundle, along with any other files we might want.
-COPY --chown=nonroot:nonroot packages/backend/dist/bundle.tar.gz app-config*.yaml ./
-RUN tar xzf bundle.tar.gz && rm bundle.tar.gz
+# Final stage to build the application image
+FROM cgr.dev/chainguard/wolfi-base:latest
 
+ENV PYTHON_VERSION 3.12=~3.12
+ENV NODE_VERSION 20=~20.14
+ENV NODE_ENV production
+
+RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,uid=65532,gid=65532 \
+    --mount=type=cache,target=/var/lib/apk,sharing=locked,uid=65532,gid=65532 \
+    apk update && \
+    apk add \
+    # add node for backstage
+        nodejs-$NODE_VERSION \
+    # add python for backstage techdocs
+        python-$PYTHON_VERSION \
+    # add tini for init process
+        tini
+
+WORKDIR /app
+
+COPY package.json app-config.yaml ./
+ADD packages/backend/dist/skeleton.tar.gz packages/backend/dist/bundle.tar.gz ./
+
+RUN chown -R 65532:65532 /app
+RUN chown -R 65532:65532 /tmp
+USER 65532:65532
+
+COPY --from=node-builder --chown=65532:65532 /app/node_modules ./node_modules
+COPY --from=python-builder --chown=65532:65532 /home/nonroot/venv /home/nonroot/venv
+ENV PATH=/home/nonroot/venv/bin:$PATH
+
+ENV NODE_OPTIONS="--no-node-snapshot"
+ENV GIT_PYTHON_REFRESH="quiet"
+
+ENTRYPOINT ["tini", "--"]
 CMD ["node", "packages/backend", "--config", "app-config.yaml"]
diff --git a/contrib/docker/minimal-hardened-image/README.md b/contrib/docker/minimal-hardened-image/README.md
index 62045a4ded..191c77986c 100644
--- a/contrib/docker/minimal-hardened-image/README.md
+++ b/contrib/docker/minimal-hardened-image/README.md
@@ -4,6 +4,19 @@ DockerHub images in general did not seem ideal for Backstage as the number of vu
 
 The `Dockerfile` in this directory uses a [wolfi-base](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners.
 
+## Steps taken
+
+When converting, I utilized the upstream Dockerfile as a starting point.
+
+- Multi-stage build - The Dockerfile has been split up into a multistage build which reduces the files, packages, executables, and directories in the final image.
+  - Size savings = ~900mb
+  - Reduced attack surface
+- Base Image - Swap to [wolfi-base](https://github.com/wolfi-dev) image from Chainguard Images
+  - Vulnerability Savings = ~239 at the time of updating this README
+- Entrypoint - Swap from `node` to `tini` as entrypoint to ensure that the default signal handlers work and zombie processes are handled properly
+- Use `ADD` instead of `COPY` in dockerfile to reduce copied compressed files
+  - When a `rm` is used to remove a compressed file it still makes its way into the final image. Using `ADD` is safe with local files.
+
 ## Pinning Digest
 
 To reduce maintenance, the digest of the image has been removed from the `./Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest.