diff --git a/docs/storage-transfer.md b/docs/storage-transfer.md
index 1dafdb2..cc051b2 100644
--- a/docs/storage-transfer.md
+++ b/docs/storage-transfer.md
@@ -99,7 +99,7 @@ The agent container runs with the following settings:
 
 | Setting | Value |
 |---|---|
-| Image | `gcr.io/cloud-ingest/tsop-agent:latest` |
+| Image | built from `sts-agent/Dockerfile` on `gcr.io/cloud-ingest/tsop-agent:latest` |
 | Mount | `/mnt/ext-storage`, read only |
 | Mount | `/etc/sts-agent`, read only |
 | Environment | `GOOGLE_APPLICATION_CREDENTIALS=/etc/sts-agent/cred.json` |
@@ -117,11 +117,13 @@ STS_AGENT_POOL=my-agents
 HOSTNAME=agent-host
 ```
 
-Start the agent:
+The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. `sts-agent/Dockerfile` adds the glibc 2.27 libraries of Ubuntu 18.04, the glibc version of the agent launcher.
+
+Build the image and start the agent:
 
 ```bash
 cd sts-agent
-sudo docker compose up -d
+sudo docker compose up -d --build
 ```
 
 The directories are mounted at the same paths as on the host. The transfer job refers to the source directory by that path, and `certificate_config.json` holds the host paths of the certificate and key.
diff --git a/sts-agent/Dockerfile b/sts-agent/Dockerfile
new file mode 100644
index 0000000..d66d63f
--- /dev/null
+++ b/sts-agent/Dockerfile
@@ -0,0 +1,11 @@
+FROM ubuntu:18.04 AS glibc
+
+FROM gcr.io/cloud-ingest/tsop-agent:latest
+
+# Shared glibc 2.27 libraries, matching the glibc of the static launcher, needed by the cryptography binding for certificate-based authentication.
+COPY --from=glibc /lib/x86_64-linux-gnu/libc-2.27.so /lib/x86_64-linux-gnu/libc.so.6
+COPY --from=glibc /lib/x86_64-linux-gnu/libm-2.27.so /lib/x86_64-linux-gnu/libm.so.6
+COPY --from=glibc /lib/x86_64-linux-gnu/libpthread-2.27.so /lib/x86_64-linux-gnu/libpthread.so.0
+COPY --from=glibc /lib/x86_64-linux-gnu/ld-2.27.so /lib64/ld-linux-x86-64.so.2
+
+ENV LD_LIBRARY_PATH=/lib/x86_64-linux-gnu
diff --git a/sts-agent/compose.yaml b/sts-agent/compose.yaml
index 41c07cf..1471426 100644
--- a/sts-agent/compose.yaml
+++ b/sts-agent/compose.yaml
@@ -1,6 +1,6 @@
 services:
   sts-agent:
-    image: gcr.io/cloud-ingest/tsop-agent:latest
+    build: .
     ulimits:
       memlock: 64000000
     volumes: