diff --git a/paseo/Dockerfile b/paseo/Dockerfile
index 00b7544..3e8640e 100644
--- a/paseo/Dockerfile
+++ b/paseo/Dockerfile
@@ -9,9 +9,14 @@ FROM ghcr.io/getpaseo/paseo:latest
 # --- system packages -------------------------------------------------------
 # Everyday shell tooling. git and curl are already in the base image; sudo is
 # not, despite Debian's base-passwd shipping an (empty) sudo group.
+#
+# build-essential is the C toolchain the language layers below assume but do
+# not ship: cgo, npm's node-gyp addons and Python C extensions all shell out to
+# gcc and make. Kept in this layer so there is only one apt-get update.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       less nano jq unzip zip lsof psmisc ugrep bfs zsh sudo \
+      build-essential \
  && rm -rf /var/lib/apt/lists/* \
  && usermod -aG sudo paseo
 
diff --git a/paseo/README.md b/paseo/README.md
index e9057c8..89c6322 100644
--- a/paseo/README.md
+++ b/paseo/README.md
@@ -2,7 +2,7 @@
 
 [Paseo](https://paseo.sh) — self-hosted daemon and web UI for running coding
 agents. Built from a local `Dockerfile` that adds six agent CLIs, `gh`, Go,
-Python, and shell tooling to the
+Python, a C toolchain, and shell tooling to the
 [official image](https://paseo.sh/docs/docker), which ships none of it.
 
 ## Setup
@@ -92,6 +92,7 @@ oh-my-zsh install persists. Anything written outside `$HOME` (`chsh`,
 | Go (`GO_VERSION`) | Official go.dev tarball | Debian 12 ships 1.19 |
 | Python (`PYTHON_VERSION`) | `uv python install` | Debian 12 ships 3.11 |
 | `less nano jq unzip zip lsof psmisc ugrep bfs zsh sudo` | apt | — |
+| `build-essential` | apt | — |
 
 Bump a language with a build arg, e.g. `--build-arg GO_VERSION=1.27.1`. `uv`
 itself is installed too.