diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41545c3..f8636da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 2.4.1
+
+### Added: pyenv in the Docker image
+
+- The `socketdev/cli` Docker image now bundles [pyenv](https://github.com/pyenv/pyenv)
+  (pinned to `v2.7.1`) along with the Alpine build dependencies needed to compile
+  CPython from source, so the image can build/install arbitrary Python versions on
+  demand.
+- The CLI itself is unchanged — this release only affects the published Docker image.
+
 ## 2.4.0
 
 ### Changed: license details are no longer requested on the full-scan diff
diff --git a/Dockerfile b/Dockerfile
index 0d9f2cb..7511078 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -88,6 +88,29 @@ ENV GOPATH="/go"
 # Install uv
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
+# Install pyenv
+# pyenv lets us build/install arbitrary Python versions on demand. We install
+# the build dependencies needed to compile CPython on Alpine, then install
+# pyenv itself. We deliberately only symlink the `pyenv` binary onto the PATH
+# and do NOT add pyenv's shims directory, so its shims don't shadow the system
+# Python that the CLI runs on.
+RUN apk add --no-cache \
+        bash \
+        bzip2-dev \
+        ca-certificates \
+        libffi-dev \
+        libxslt-dev \
+        linux-headers \
+        ncurses-dev \
+        openssl-dev \
+        readline-dev \
+        sqlite-dev \
+        xz-dev \
+        zlib-dev
+RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/pyenv-installer | PYENV_GIT_TAG="v2.7.1" bash && \
+    ln -s ~/.pyenv/bin/pyenv /bin/pyenv && \
+    pyenv --version
+
 # Install CLI based on build mode
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
         echo "Using local development install"; \
diff --git a/pyproject.toml b/pyproject.toml
index c88ce43..4d5f098 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.0"
+version = "2.4.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 55d08d9..4c6871c 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.0'
+__version__ = '2.4.1'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index 957202f..06d1578 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1270,7 +1270,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.0"
+version = "2.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },