diff --git a/README.md b/README.md
index bd787a8..eab60e4 100644
--- a/README.md
+++ b/README.md
@@ -73,6 +73,9 @@ integration tests) — runs inside the dev container.
   [`ghcr.io/devcontainers/features/docker-in-docker`](https://github.com/devcontainers/features/tree/main/src/docker-in-docker)
   feature via `dependsOn`, which installs the Docker engine, runs a daemon **inside** the
   container, and adds the remote user to the `docker` group (no `sudo` needed).
+- Pins `"moby": false` so the upstream feature installs Docker CE from Docker's own apt
+  repo instead of Microsoft's `moby-*` packages, which don't exist on Debian trixie
+  (the base of current `javascript-node` images) and fail the build.
 - Uses Docker-**in**-Docker rather than docker-outside-of-docker on purpose: testcontainers
   relies on bind mounts and container-to-container networking, both of which break under the
   host-socket approach (path translation) and aren't available in every environment
diff --git a/src/docker/devcontainer-feature.json b/src/docker/devcontainer-feature.json
index 1fea66d..4cec15a 100644
--- a/src/docker/devcontainer-feature.json
+++ b/src/docker/devcontainer-feature.json
@@ -1,11 +1,13 @@
 {
   "id": "docker",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "name": "Docker (Docker-in-Docker, testcontainers-ready)",
   "description": "Provides a self-contained Docker daemon inside the container via the official Docker-in-Docker feature. Picked over docker-outside-of-docker so testcontainers (bind mounts + container networking) works without depending on a host socket, which keeps it portable across Codespaces, CI, and local Docker/Podman/OrbStack hosts.",
   "documentationURL": "https://github.com/rocicorp/devcontainer-features/tree/main/src/docker",
   "dependsOn": {
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {}
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {
+      "moby": false
+    }
   },
   "installsAfter": ["ghcr.io/devcontainers/features/node"]
 }