diff --git a/blockchain/Dockerfile b/blockchain/Dockerfile
index b9ec867..1f50e27 100644
--- a/blockchain/Dockerfile
+++ b/blockchain/Dockerfile
@@ -25,4 +25,11 @@ RUN chmod 0755 /usr/local/bin/openinfra-authority-entrypoint
 
 USER 10001:10001
 EXPOSE 9944 30333
-ENTRYPOINT ["/usr/local/bin/openinfra-node"]
+# docker/authority-entrypoint.sh inserts this authority's Aura/GRANDPA
+# keys (via OPENINFRA_DEV_AUTHORITY_SEED) before exec'ing openinfra-node
+# with whatever CLI args docker-compose/CMD supplies -- without this, an
+# authority's keystore stays empty and it can never author a block or
+# vote in GRANDPA, no matter what CLI flags (--alice, etc.) are passed to
+# openinfra-node directly. This was previously dead code: the script was
+# copied into the image but never made the entrypoint.
+ENTRYPOINT ["/usr/local/bin/openinfra-authority-entrypoint"]
diff --git a/blockchain/docker/authority-entrypoint.sh b/blockchain/docker/authority-entrypoint.sh
index 337e4a4..2760e0e 100644
--- a/blockchain/docker/authority-entrypoint.sh
+++ b/blockchain/docker/authority-entrypoint.sh
@@ -9,6 +9,20 @@ fi
 base_path="${OPENINFRA_NODE_BASE_PATH:-/var/lib/openinfra}"
 chain="${OPENINFRA_NODE_CHAIN:-openinfra-local}"
 
+# This node's libp2p identity key. Unlike a vanilla substrate-node-
+# template, this build does not auto-generate one on first run when a
+# persistent --base-path is used (observed directly: NetworkKeyNotFound
+# on a fresh volume) -- generate it once, idempotently, so a fresh
+# volume (first boot, or after `make dev-clean`) starts cleanly instead
+# of crash-looping on that error. A subsequent boot with the same
+# volume leaves the existing key (and therefore this node's peer ID)
+# untouched.
+network_key_path="$base_path/chains/$chain/network/secret_ed25519"
+if [ ! -f "$network_key_path" ]; then
+  mkdir -p "$(dirname "$network_key_path")"
+  openinfra-node key generate-node-key --file "$network_key_path"
+fi
+
 openinfra-node key insert \
   --base-path "$base_path" \
   --chain "$chain" \
diff --git a/deployments/docker-compose.yml b/deployments/docker-compose.yml
index b81b7e6..4a88198 100644
--- a/deployments/docker-compose.yml
+++ b/deployments/docker-compose.yml
@@ -44,7 +44,20 @@ services:
     command:
       - --chain=openinfra-dev
       - --base-path=/var/lib/openinfra/data
-      - --consensus=manual-seal-3000
+      # ADR-009: the dev chain spec (openinfra-dev) has exactly one
+      # genesis authority, Alice. --consensus=manual-seal-3000 (pre-
+      # ADR-009) is gone: the node's CLI no longer accepts it at all now
+      # that it runs real Aura block production + GRANDPA finality
+      # instead of manual sealing. --alice sets name=Alice and
+      # role=authority, but does NOT put usable Aura/GRANDPA keys in the
+      # keystore for this image/polkadot-sdk pinning (confirmed directly:
+      # an empty keystore, chain stuck at genesis, no block ever
+      # authored). The actual keys come from OPENINFRA_DEV_AUTHORITY_SEED
+      # below via docker/authority-entrypoint.sh (this image's
+      # ENTRYPOINT) -- that explicit `key insert` step is load-bearing
+      # here, not redundant with --alice.
+      - --alice
+      - --force-authoring
       - --rpc-external
       - --rpc-port=9944
       - --rpc-methods=safe
@@ -52,6 +65,16 @@ services:
       - --prometheus-external
     environment:
       OPENINFRA_DEV_SUDO_PUBLIC_KEY_FILE: /run/openinfra-chain/bridge-public.hex
+      # Consumed by docker/authority-entrypoint.sh (this image's
+      # ENTRYPOINT), not by openinfra-node directly. //Alice is the
+      # well-known dev SURI matching openinfra-dev's genesis authority
+      # (sp_keyring::Sr25519Keyring::Alice / Ed25519Keyring::Alice --
+      # blockchain/node/src/chain_spec.rs). base_path/chain must match
+      # the --base-path/--chain args above exactly, or the script inserts
+      # keys into a keystore path the running node never reads from.
+      OPENINFRA_DEV_AUTHORITY_SEED: "//Alice"
+      OPENINFRA_NODE_BASE_PATH: /var/lib/openinfra/data
+      OPENINFRA_NODE_CHAIN: openinfra-dev
     ports:
       - "127.0.0.1:9944:9944"
       - "127.0.0.1:30333:30333"