diff --git a/.woodpecker/fx.yml b/.woodpecker/fx.yml
index b3c45a1..79935c0 100644
--- a/.woodpecker/fx.yml
+++ b/.woodpecker/fx.yml
@@ -38,7 +38,8 @@ steps:
     depends_on: [ version ]
     commands:
       - set -eu
-      - apk add --no-cache bash git build-base protobuf protobuf-dev protoc
+      # protoc + headers; protobuf runtime pkg is not needed for codegen
+      - apk add --no-cache bash git build-base protoc protobuf-dev
       - go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
       - go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
       - export PATH="$(go env GOPATH)/bin:$PATH"
diff --git a/ci/scripts/proto/generate.sh b/ci/scripts/proto/generate.sh
index 9e7fbc7..8bde9ee 100755
--- a/ci/scripts/proto/generate.sh
+++ b/ci/scripts/proto/generate.sh
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
-
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -7,44 +6,53 @@ REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
 API_DIR="${REPO_ROOT}/api"
 PROTO_DIR="./proto"
 PROTOC_BIN="${PROTOC:-protoc}"
-PROTOC_INCLUDE="$("${PROTOC_BIN}" --print_include_path 2>/dev/null)"
 
+# Ensure required tools exist
 if ! command -v "${PROTOC_BIN}" >/dev/null 2>&1; then
-  echo "[proto] protoc binary not found" >&2
-  exit 1
+  echo "[proto] protoc binary not found" >&2; exit 1
 fi
 if ! command -v protoc-gen-go >/dev/null 2>&1; then
-  echo "[proto] protoc-gen-go is not installed" >&2
-  exit 1
+  echo "[proto] protoc-gen-go is not installed" >&2; exit 1
 fi
 if ! command -v protoc-gen-go-grpc >/dev/null 2>&1; then
-  echo "[proto] protoc-gen-go-grpc is not installed" >&2
-  exit 1
+  echo "[proto] protoc-gen-go-grpc is not installed" >&2; exit 1
 fi
 
-info() {
-  printf '[proto] %s\n' "$1"
-}
+info() { printf '[proto] %s\n' "$1"; }
+
+# Try to determine the include path for well-known types (WKT) without hard failing
+PROTOC_INCLUDE=""
+# Prefer known locations on Alpine/Debian-like images
+for cand in /usr/include /usr/local/include; do
+  if [ -f "$cand/google/protobuf/descriptor.proto" ]; then
+    PROTOC_INCLUDE="$cand"
+    break
+  fi
+done
+
+# Build an include-array only when non-empty
+PROTOC_I=()
+if [ -n "${PROTOC_INCLUDE}" ]; then
+  PROTOC_I+=("-I=${PROTOC_INCLUDE}")
+fi
+# Always include our proto tree
+PROTOC_I+=("-I=${PROTO_DIR}")
 
 generate_go() {
-  local out_dir="$1"
-  shift
+  local out_dir="$1"; shift
   mkdir -p "${out_dir}"
   "${PROTOC_BIN}" \
-    -I="${PROTOC_INCLUDE}" \
-    -I="${PROTO_DIR}" \
+    "${PROTOC_I[@]}" \
     --go_out="${out_dir}" \
     --go_opt=paths=source_relative \
     "$@"
 }
 
 generate_go_with_grpc() {
-  local out_dir="$1"
-  shift
+  local out_dir="$1"; shift
   mkdir -p "${out_dir}"
   "${PROTOC_BIN}" \
-    -I="${PROTOC_INCLUDE}" \
-    -I="${PROTO_DIR}" \
+    "${PROTOC_I[@]}" \
     --go_out="${out_dir}" \
     --go_opt=paths=source_relative \
     --go-grpc_out="${out_dir}" \
@@ -61,7 +69,7 @@ clean_pb_files() {
 
 cd "${API_DIR}"
 
-# Messaging / notification protos (top-level files).
+# Messaging (top-level .proto files in ./proto)
 mapfile -t messaging_protos < <(find "${PROTO_DIR}" -maxdepth 1 -type f -name '*.proto' | sort)
 if [ "${#messaging_protos[@]}" -gt 0 ]; then
   info "Compiling messaging protos"
@@ -69,7 +77,7 @@ if [ "${#messaging_protos[@]}" -gt 0 ]; then
   generate_go "./pkg/messaging/internal/generated" "${messaging_protos[@]}"
 fi
 
-# Common shared protos
+# Common shared
 mapfile -t common_protos < <(find "${PROTO_DIR}/common" -type f -name '*.proto' | sort)
 if [ "${#common_protos[@]}" -gt 0 ]; then
   info "Compiling common shared protos"
@@ -77,35 +85,35 @@ if [ "${#common_protos[@]}" -gt 0 ]; then
   generate_go "./pkg/proto" "${common_protos[@]}"
 fi
 
-# Ledger shared protos
+# Ledger
 if [ -f "${PROTO_DIR}/ledger/v1/ledger.proto" ]; then
   info "Compiling ledger protos"
   clean_pb_files "./pkg/proto/ledger"
   generate_go_with_grpc "./pkg/proto/ledger/v1" "${PROTO_DIR}/ledger/v1/ledger.proto"
 fi
 
-# Oracle shared protos
+# Oracle
 if [ -f "${PROTO_DIR}/oracle/v1/oracle.proto" ]; then
   info "Compiling oracle protos"
   clean_pb_files "./pkg/proto/oracle"
   generate_go_with_grpc "./pkg/proto/oracle/v1" "${PROTO_DIR}/oracle/v1/oracle.proto"
 fi
 
-# Chain gateway shared protos
+# Chain gateway
 if [ -f "${PROTO_DIR}/chain/gateway/v1/gateway.proto" ]; then
   info "Compiling chain gateway protos"
   clean_pb_files "./pkg/proto/chain/gateway"
   generate_go_with_grpc "./pkg/proto/chain/gateway/v1" "${PROTO_DIR}/chain/gateway/v1/gateway.proto"
 fi
 
-# Payments orchestrator shared protos
+# Payments orchestrator
 if [ -f "${PROTO_DIR}/payments/orchestrator/v1/orchestrator.proto" ]; then
   info "Compiling payments orchestrator protos"
   clean_pb_files "./pkg/proto/payments/orchestrator"
   generate_go_with_grpc "./pkg/proto/payments/orchestrator/v1" "${PROTO_DIR}/payments/orchestrator/v1/orchestrator.proto"
 fi
 
-# Billing fees shared protos
+# Billing fees
 if [ -f "${PROTO_DIR}/billing/fees/v1/fees.proto" ]; then
   info "Compiling billing fees protos"
   clean_pb_files "./pkg/proto/billing/fees"