diff --git a/Dockerfile b/Dockerfile
index 28f7d89..739e93b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,7 +48,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         procps \
         supervisor \
         tzdata \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && cp /etc/keepalived/keepalived.config-opts /usr/sbin/keepalived.config-opts
+
+# Debian 13 builds Keepalived reproducibly, which moves its build-options
+# string out of the binary into /etc/keepalived/keepalived.config-opts, and
+# Keepalived refuses to start without that file. /etc/keepalived is a volume,
+# so the copy above keeps an image-only version next to the binary (a
+# location Keepalived also accepts) and the entrypoint puts it back into the
+# volume on every start -- a volume created by an older image never had it.
 
 # acme.sh is installed into an image-only directory. The entrypoint seeds
 # $HAM_ACME_HOME (a volume) from it, so account keys and issued certificates
diff --git a/VERSION b/VERSION
index acbb747..4d00f49 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.97.0
+1.97.1
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 064b4c7..f251537 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -11,6 +11,16 @@ mkdir -p "$DATA_DIR" "$CERT_DIR" "$ACME_HOME" /run/haproxy \
          "$(dirname "${HAM_KEEPALIVED_CFG:-/etc/keepalived/keepalived.conf}")"
 chmod 0700 "$DATA_DIR" "$ACME_HOME" "$CERT_DIR"
 
+# Keepalived (Debian 13's reproducible build) will not start without the
+# build-options file its package installs in /etc/keepalived -- a volume, so a
+# volume created by an older image hides it. Refresh it from the image copy on
+# every start so it always matches the binary. Keepalived reads this fixed
+# path regardless of HAM_KEEPALIVED_CFG.
+if [ -f /usr/sbin/keepalived.config-opts ]; then
+    mkdir -p /etc/keepalived
+    cp -f /usr/sbin/keepalived.config-opts /etc/keepalived/keepalived.config-opts
+fi
+
 # Refresh acme.sh's program files inside the (persisted) home on every start,
 # without touching account keys, issued certificates or account.conf.
 for item in acme.sh dnsapi deploy notify; do