diff --git a/bin/disinto b/bin/disinto
index 4b8e3e2..56619d1 100755
--- a/bin/disinto
+++ b/bin/disinto
@@ -204,6 +204,7 @@ services:
       - project-repos:/home/agent/repos
       - ./:/home/agent/disinto:ro
       - claude-auth:/home/agent/.claude:ro
+      - CLAUDE_BIN_PLACEHOLDER:/usr/local/bin/claude:ro
     environment:
       FORGE_URL: http://forgejo:3000
       WOODPECKER_SERVER: http://woodpecker:8000
@@ -228,6 +229,18 @@ networks:
     driver: bridge
 COMPOSEEOF
 
+  # Patch the Claude CLI binary path — resolve from host PATH at init time.
+  local claude_bin
+  claude_bin="$(command -v claude 2>/dev/null || true)"
+  if [ -n "$claude_bin" ]; then
+    # Resolve symlinks to get the real binary path
+    claude_bin="$(readlink -f "$claude_bin")"
+    sed -i "s|CLAUDE_BIN_PLACEHOLDER|${claude_bin}|" "$compose_file"
+  else
+    echo "Warning: claude CLI not found in PATH — update docker-compose.yml volumes manually" >&2
+    sed -i "s|CLAUDE_BIN_PLACEHOLDER|/usr/local/bin/claude|" "$compose_file"
+  fi
+
   # Patch the forgejo port mapping into the file if non-default
   if [ "$forge_port" != "3000" ]; then
     # Add port mapping to forgejo service so it's reachable from host during init
diff --git a/docker/agents/Dockerfile b/docker/agents/Dockerfile
index 18cc7f2..3ad7ef3 100644
--- a/docker/agents/Dockerfile
+++ b/docker/agents/Dockerfile
@@ -4,10 +4,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     bash curl git jq tmux cron python3 openssh-client ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Claude CLI — install and verify
-RUN curl -fsSL https://cli.anthropic.com/install.sh | sh \
-    && cp "$(find /root -name claude -type f 2>/dev/null | head -1)" /usr/local/bin/claude \
-    && claude --version
+# Claude CLI is mounted from the host via docker-compose volume.
+# No internet access to cli.anthropic.com required at build time.
 
 # Non-root user
 RUN useradd -m -u 1000 -s /bin/bash agent
diff --git a/docker/agents/entrypoint.sh b/docker/agents/entrypoint.sh
index ce36e89..d84c64a 100644
--- a/docker/agents/entrypoint.sh
+++ b/docker/agents/entrypoint.sh
@@ -44,6 +44,17 @@ with open(sys.argv[1], 'rb') as f:
 }
 
 log "Agent container starting"
+
+# Verify Claude CLI is available (expected via volume mount from host).
+if ! command -v claude &>/dev/null; then
+  log "FATAL: claude CLI not found in PATH."
+  log "Mount the host binary into the container, e.g.:"
+  log "  volumes:"
+  log "    - /usr/local/bin/claude:/usr/local/bin/claude:ro"
+  exit 1
+fi
+log "Claude CLI: $(claude --version 2>&1 || true)"
+
 install_project_crons
 
 # Run cron in the foreground.  Cron jobs execute as the agent user.