diff --git a/docker/docker/Dockerfile.windows.amd64.ltsc2025 b/docker/docker/Dockerfile.windows.amd64.ltsc2025
index f117b71..67cee9f 100644
--- a/docker/docker/Dockerfile.windows.amd64.ltsc2025
+++ b/docker/docker/Dockerfile.windows.amd64.ltsc2025
@@ -26,7 +26,9 @@ RUN mkdir C:\bin
 # Install cosign for container image signing
 ADD https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-windows-amd64.exe C:/bin/cosign.exe
 
-COPY --from=download /windows/system32/netapi32.dll /windows/system32/netapi32.dll
+# nanoserver:ltsc2025 ships netapi32.dll natively (unlike 1809/ltsc2022 where we
+# had to copy it in from servercore). Overwriting the ltsc2025 copy fails with
+# "Access is denied" because system32 files are locked, so we skip that COPY.
 COPY --from=download /app/docker.exe C:/bin/docker.exe
 ADD release/windows/amd64/drone-docker.exe C:/bin/drone-docker.exe
 ENTRYPOINT [ "C:\\bin\\drone-docker.exe" ]