diff --git a/Dockerfile b/Dockerfile
index d823881..e663f2f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,11 +26,15 @@ COPY . .
 
 RUN yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 
-# Test phase, same shape and for the same reason.
+# Test phase, same shape and for the same reason. coreutils makes cp GNU
+# cp, which writes into an existing file, as cp does on most hosts.
+# busybox cp makes a new file, so test/commit-upstream-policy-files.sh
+# would pass even if script/write-upstream-policy-files copied straight
+# over the running script/commit-upstream-policy-files.
 #
 # alpine 3.24.3, 2026-11-04
 FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS test
-RUN apk add --no-cache git make nodejs-current yarn
+RUN apk add --no-cache coreutils git make nodejs-current yarn
 ARG CACHEBUST
 
 WORKDIR /app