diff --git a/.devcontainer/setup.sh b/.devcontainer/setup.sh
index e9eca45..d237524 100644
--- a/.devcontainer/setup.sh
+++ b/.devcontainer/setup.sh
@@ -96,11 +96,9 @@ echo "--- Syncing canonical flows ---"
 cd "$REPO/backend"
 as_vscode "uv run python scripts/sync_flows.py --sync" || echo "WARN: flow sync failed (check backend/flows and LFX)"
 
-# Git Credential Manager (GCM) for HTTPS git auth inside the container.
-# Tokens are stored in GCM's encrypted store (not in URLs or plain text).
-# First-run device-code prompt appears on first git op; open the printed
-# URL on the host to complete auth.
 echo "--- Installing Git Credential Manager ---"
+# GCM (Linux) depends on libicu (.NET runtime) — runtime libs only.
+apt-get install -y -qq libicu76 2>/dev/null || true
 GCM_DEB_URL="https://github.com/git-ecosystem/git-credential-manager/releases/download/v2.9.1/gcm-linux-x64-2.9.1.deb"
 GCM_DEB="/tmp/gcm-linux-x64-2.9.1.deb"
 curl -fsSL "$GCM_DEB_URL" -o "$GCM_DEB"