diff --git a/Dockerfile.debian b/Dockerfile.debian
index e3b196d5..da41aad0 100755
--- a/Dockerfile.debian
+++ b/Dockerfile.debian
@@ -135,6 +135,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     procps \
     gosu \
     jq \
+    ipcalc \
     && wget -qO /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg \
     && echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list \
     && apt-get update \
diff --git a/install/production-filesystem/entrypoint.d/20-first-run-config.sh b/install/production-filesystem/entrypoint.d/20-first-run-config.sh
index 3a5d5b2a..e568eee3 100755
--- a/install/production-filesystem/entrypoint.d/20-first-run-config.sh
+++ b/install/production-filesystem/entrypoint.d/20-first-run-config.sh
@@ -13,7 +13,14 @@ get_scan_subnets() {
     while read -r _cidr _iface; do
         [[ "$_iface" =~ ^(lo|docker|veth) ]] && continue
         
-        _net=$(ipcalc -n "$_cidr" | awk -F= '{print $2}')
+        # Robustly get network address regardless of ipcalc version
+        if ipcalc -n "$_cidr" | grep -q '^Network:'; then
+            # Debian-style
+            _net=$(ipcalc -n "$_cidr" | grep '^Network:' | awk '{print $2}' | cut -d/ -f1)
+        else
+            # Alpine-style (Busybox)
+            _net=$(ipcalc -n "$_cidr" | awk -F= '{print $2}' | awk '{print $1}')
+        fi
         _mask=$(echo "$_cidr" | cut -d/ -f2)
         _entry="${_net}/${_mask} --interface=${_iface}"
 
@@ -66,7 +73,7 @@ if [ ! -f "${NETALERTX_CONFIG}/app.conf" ]; then
         exit 2
     }
 	# Generate the dynamic subnet list
-    SCAN_LIST=$(get_scan_subnets)
+    SCAN_LIST=$(get_scan_subnets | tr -d '\n\r')
 
     # Inject into the newly deployed config
     sed -i "s|^SCAN_SUBNETS=.*|SCAN_SUBNETS=$SCAN_LIST|" "${NETALERTX_CONFIG}/app.conf" ||true