diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6a06b2..c2fbb20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.11.1
+
+- **pip removed from the image:** pip is only needed to build the image. It brought its
+  own copies of urllib3 and msgpack with known vulnerabilities, which the image scan
+  reported. RDAPI never used them; the image now contains no pip at all.
+
 ## 0.11.0
 
 - **Alarms in the history:** a new tab under “History” shows the alarms the RustDesk app
diff --git a/Dockerfile b/Dockerfile
index 2515298..e42f6c4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,11 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /srv
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+# pip wird zur Laufzeit nicht gebraucht und bringt eigene, oft veraltete Pakete mit
+# (urllib3, msgpack …), die der Image-Scan meldet: nach der Installation entfernen.
+RUN pip install --no-cache-dir -r requirements.txt \
+    && pip uninstall -y pip \
+    && rm -rf /usr/local/lib/python3*/ensurepip/_bundled
 COPY rdapi ./rdapi
 
 # Läuft ohne Root; compose kann mit user: PUID:PGID einen anderen Benutzer setzen