diff --git a/docker/docker/Dockerfile.windows.amd64.ltsc2025 b/docker/docker/Dockerfile.windows.amd64.ltsc2025
index 67cee9f..d91895d 100644
--- a/docker/docker/Dockerfile.windows.amd64.ltsc2025
+++ b/docker/docker/Dockerfile.windows.amd64.ltsc2025
@@ -3,15 +3,17 @@ FROM mcr.microsoft.com/windows/servercore:ltsc2025 as download
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
 
-ENV DOCKER_VERSION 19.03.1
-
-RUN Invoke-WebRequest 'http://constexpr.org/innoextract/files/innoextract-1.7-windows.zip' -OutFile 'innoextract.zip' -UseBasicParsing ; `
-    Expand-Archive innoextract.zip -DestinationPath C:\ ; `
-    Remove-Item -Path innoextract.zip
+# Modernized for ltsc2025: fetch the standalone Docker CLI matching the daemon
+# generation used on Windows Server 2025 hosts (28.x). Replaces the 1809/ltsc2022
+# pattern of extracting docker.exe from DockerToolbox 19.03.1 via innoextract.
+ENV DOCKER_VERSION 28.4.0
 
 RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; `
-    Invoke-WebRequest $('https://github.com/docker/toolbox/releases/download/v{0}/DockerToolbox-{0}.exe' -f $env:DOCKER_VERSION) -OutFile 'dockertoolbox.exe' -UseBasicParsing
-RUN /innoextract.exe dockertoolbox.exe
+    Invoke-WebRequest -UseBasicParsing `
+      $('https://download.docker.com/win/static/stable/x86_64/docker-{0}.zip' -f $env:DOCKER_VERSION) `
+      -OutFile docker.zip ; `
+    Expand-Archive docker.zip -DestinationPath C:\ ; `
+    Remove-Item docker.zip
 
 FROM mcr.microsoft.com/windows/nanoserver:ltsc2025
 USER ContainerAdministrator
@@ -29,6 +31,6 @@ ADD https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-windows-a
 # nanoserver:ltsc2025 ships netapi32.dll natively (unlike 1809/ltsc2022 where we
 # had to copy it in from servercore). Overwriting the ltsc2025 copy fails with
 # "Access is denied" because system32 files are locked, so we skip that COPY.
-COPY --from=download /app/docker.exe C:/bin/docker.exe
+COPY --from=download /docker/docker.exe C:/bin/docker.exe
 ADD release/windows/amd64/drone-docker.exe C:/bin/drone-docker.exe
 ENTRYPOINT [ "C:\\bin\\drone-docker.exe" ]