diff --git a/Dockerfile b/Dockerfile
index a3046f0..9c6f2df 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:stretch-slim
+FROM debian:bookworm-slim
 
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -6,35 +6,77 @@ ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 ENV LANGUAGE=C.UTF-8
 
-# Stretch is EOL -> use archive.debian.org
-RUN sed -i 's|deb.debian.org/debian|archive.debian.org/debian|g' /etc/apt/sources.list && \
-    sed -i 's|security.debian.org/debian-security|archive.debian.org/debian-security|g' /etc/apt/sources.list && \
-    sed -i '/stretch-updates/d' /etc/apt/sources.list 
-
-#RUN printf 'Acquire::Check-Valid-Until "false";\nAcquire::AllowInsecureRepositories "true";\n' > /etc/apt/apt.conf.d/99no-check-valid-until
-
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    apt-transport-https vim ca-certificates curl git unzip rsync \
+    vim ca-certificates curl git unzip rsync \
     gcc build-essential \
-    python2.7 python-pip python-setuptools \
-    python-dev \
+    python3 python3-pip python3-setuptools python3-venv \
+    python3-dev \
     libxml2-dev libxslt1-dev \
     libldap2-dev libsasl2-dev \
     libssl-dev \
     libjpeg-dev zlib1g-dev \
     libpq-dev \
+    # Odoo 19 runtime dependencies (mirrors debian/control Depends)
+    python3-asn1crypto \
+    python3-babel \
+    python3-cbor2 \
+    python3-chardet \
+    python3-cryptography \
+    python3-dateutil \
+    python3-docutils \
+    python3-freezegun \
+    python3-geoip2 \
+    python3-gevent \
+    python3-greenlet \
+    python3-idna \
+    python3-jinja2 \
+    python3-ldap \
+    python3-libsass \
+    python3-lxml \
+    python3-magic \
+    python3-markupsafe \
+    python3-num2words \
+    python3-ofxparse \
+    python3-openpyxl \
+    python3-openssl \
+    python3-passlib \
+    python3-pil \
+    python3-polib \
+    python3-psutil \
+    python3-psycopg2 \
+    python3-pypdf2 \
+    python3-qrcode \
+    python3-renderpm \
+    python3-reportlab \
+    python3-requests \
+    python3-rjsmin \
+    python3-stdnum \
+    python3-tz \
+    python3-urllib3 \
+    python3-vobject \
+    python3-werkzeug \
+    python3-xlrd \
+    python3-xlsxwriter \
+    python3-zeep \
+    # Fonts and web assets shipped with Odoo
+    fonts-dejavu-core \
+    fonts-font-awesome \
+    fonts-freefont-ttf \
+    fonts-inconsolata \
+    fonts-roboto-unhinted \
+    libjs-underscore \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
-# PostgreSQL client from official archive repo (Stretch EOL)
+# PostgreSQL client from the official pgdg repo
 RUN install -d /usr/share/postgresql-common/pgdg && \
         curl -fsSL -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
             https://www.postgresql.org/media/keys/ACCC4CF8.asc && \
-        echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt-archive.postgresql.org/pub/repos/apt stretch-pgdg main" \
+        echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
             > /etc/apt/sources.list.d/pgdg.list && \
         apt-get update && apt-get install -y --no-install-recommends postgresql-client && \
         apt-get clean && rm -rf /var/lib/apt/lists/*
 
-## wkhtmltopdf
+## wkhtmltopdf (patched-Qt build required by Odoo)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     fontconfig libfreetype6 libpng16-16 \
     libx11-6 libxcb1 libxext6 libxrender1 \
@@ -43,31 +85,24 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN set -eux; \
     cd /tmp; \
     curl -fsSL \
-      https://github.com/wkhtmltopdf/packaging/releases/download/0.12.1.4-2/wkhtmltox_0.12.1.4-2.stretch_amd64.deb \
+      https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb \
       -o wkhtml.deb; \
-    dpkg -i wkhtml.deb; \
-    rm -f wkhtml.deb
+    apt-get update && apt-get install -y --no-install-recommends ./wkhtml.deb && \
+    apt-get clean && rm -rf /var/lib/apt/lists/* wkhtml.deb
 
 ENV PYTHONIOENCODING=UTF-8
 
-# ---- Node.js 6.x (official binary) for Odoo 10 ----
-ENV NODE_VERSION=6.17.1
-RUN set -eux; \
-    cd /tmp; \
-    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" -o node.tar.xz; \
-    tar -xJf node.tar.xz; \
-    cp -r node-v${NODE_VERSION}-linux-x64/bin /usr/local/; \
-    cp -r node-v${NODE_VERSION}-linux-x64/lib /usr/local/; \
-    cp -r node-v${NODE_VERSION}-linux-x64/include /usr/local/; \
-    cp -r node-v${NODE_VERSION}-linux-x64/share /usr/local/; \
-    rm -rf /tmp/node*
-RUN npm install -g less@2.7.3 less-plugin-clean-css@1.5.1
-
 # optional: create a fixed user
 ENV HOME=/opt/odoo
 RUN useradd -m -u 99910 -d "$HOME" odoo
 
-ENV PATH=$HOME/scripts/bin:$HOME/.local/bin:$PATH
+# Virtualenv for pip-installed tooling (git-aggregator, click-odoo-contrib,
+# openupgradelib). --system-site-packages lets the venv reuse python3-*
+# packages installed from apt (lxml, psycopg2, reportlab, gevent, ...).
+RUN python3 -m venv --system-site-packages /opt/odoo/venv && \
+    chown -R odoo:odoo /opt/odoo/venv
+
+ENV PATH=/opt/odoo/venv/bin:$HOME/scripts/bin:$HOME/.local/bin:$PATH
 
 # image defaults (baked in)
 COPY --chown=odoo:odoo config/ /opt/odoo/dist/
diff --git a/config/constraints.txt b/config/constraints.txt
index c6bfe13..57bdd78 100644
--- a/config/constraints.txt
+++ b/config/constraints.txt
@@ -1,4 +1,8 @@
-python-stdnum<2.0
-Unidecode<1.3
-isodate<0.7
-zeep<4
+# Pip constraints baked into the image.
+#
+# Odoo 19 ships its own requirements.txt with modern pins, and the
+# base python3-* packages are installed from apt; there are no global
+# constraints needed at image-build time.
+#
+# Add entries here only if a custom addon or OCA repo needs a specific
+# version to be forced during bootstrap (fetchreqs / fetchbasereqs).
diff --git a/config/defaults.env b/config/defaults.env
index f71b7bf..061ac45 100644
--- a/config/defaults.env
+++ b/config/defaults.env
@@ -1,6 +1,6 @@
 # Odoo Docker Image Configuration
 # Default values - can be overridden by instance settings.env (bind-mounted at runtime)
-PYTHON_BIN=/usr/bin/python
+PYTHON_BIN=/opt/odoo/venv/bin/python
 
 # Dist directory (baked into image)
 DIST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
diff --git a/scripts/bin/genaddonspath.py b/scripts/bin/genaddonspath.py
index 5268412..c3bc289 100644
--- a/scripts/bin/genaddonspath.py
+++ b/scripts/bin/genaddonspath.py
@@ -1,15 +1,11 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 """
 Generate addons_path parameter for odoo.conf from repos.yaml and update odoo.conf
 """
 import io
 import re
 import os
-# shlex.quote is Python 3+; fall back to pipes.quote for Python 2
-try:
-    from shlex import quote
-except ImportError:
-    from pipes import quote
+from shlex import quote
 import subprocess
 
 import yaml
diff --git a/scripts/lib/common.sh b/scripts/lib/common.sh
index 2e7f622..af7bf1b 100644
--- a/scripts/lib/common.sh
+++ b/scripts/lib/common.sh
@@ -11,11 +11,12 @@ else
   exit 1
 fi
 
-# Install Python packages with common pip options
+# Install Python packages with common pip options.
+# Runs inside the /opt/odoo/venv virtualenv (first in PATH).
 # Usage: pip_install [pip args...]
 pip_install() {
   # shellcheck disable=SC2154  # DIST_CONSTRAINTS from defaults.env
-  pip install --upgrade --user --no-cache-dir \
+  pip install --upgrade --no-cache-dir \
     --constraint "${DIST_CONSTRAINTS}" \
     "$@"
 }
@@ -66,4 +67,4 @@ safe_remove_dir() {
 debug_pause() {
   echo "DEBUG: Paused at '${1:-}'. Container will stay alive. Attach with 'docker exec'."
   sleep infinity
-}
\ No newline at end of file
+}