diff --git a/docker/Dockerfile b/docker/Dockerfile
index 48ee76ad409..7929ce8e92d 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -240,21 +240,22 @@ ARG BUILD_OS
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Install protoc (used by tonic-build/prost-build) and a basic C toolchain
-# (some rust crates compile C in their build.rs scripts).
+# Install a basic C toolchain (some rust crates compile C in their build.rs
+# scripts) and unzip (used to extract the pinned protoc release below).
 RUN if [ "${BUILD_OS}" = "manylinux" ]; then \
         dnf install -y --setopt=install_weak_deps=False \
-            ca-certificates curl git gcc gcc-c++ make \
-            protobuf-compiler protobuf-devel \
+            ca-certificates curl git gcc gcc-c++ make unzip \
         && dnf clean all && rm -rf /var/cache/dnf; \
     else \
         apt-get update -y \
         && apt-get install -y --no-install-recommends \
-            ca-certificates curl git build-essential \
-            protobuf-compiler libprotobuf-dev \
+            ca-certificates curl git build-essential unzip \
         && rm -rf /var/lib/apt/lists/*; \
     fi
 
+COPY tools/install_protoc.sh /tmp/install_protoc.sh
+RUN /tmp/install_protoc.sh && rm /tmp/install_protoc.sh
+
 # Install rustup; the toolchain itself is pinned by rust/rust-toolchain.toml.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal --default-toolchain none
diff --git a/docker/Dockerfile.cpu b/docker/Dockerfile.cpu
index 1b02340e8d9..86a076976d3 100644
--- a/docker/Dockerfile.cpu
+++ b/docker/Dockerfile.cpu
@@ -90,10 +90,12 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
-        ca-certificates curl git build-essential \
-        protobuf-compiler libprotobuf-dev \
+        ca-certificates curl git build-essential unzip \
     && rm -rf /var/lib/apt/lists/*
 
+COPY tools/install_protoc.sh /tmp/install_protoc.sh
+RUN /tmp/install_protoc.sh && rm /tmp/install_protoc.sh
+
 # Install rustup; the toolchain itself is pinned by rust/rust-toolchain.toml.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal --default-toolchain none
diff --git a/docker/Dockerfile.nightly_torch b/docker/Dockerfile.nightly_torch
index f1f19af5307..3aa328a5fc3 100644
--- a/docker/Dockerfile.nightly_torch
+++ b/docker/Dockerfile.nightly_torch
@@ -102,10 +102,12 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
-        ca-certificates curl git build-essential \
-        protobuf-compiler libprotobuf-dev \
+        ca-certificates curl git build-essential unzip \
     && rm -rf /var/lib/apt/lists/*
 
+COPY tools/install_protoc.sh /tmp/install_protoc.sh
+RUN /tmp/install_protoc.sh && rm /tmp/install_protoc.sh
+
 # Install rustup; the toolchain itself is pinned by rust/rust-toolchain.toml.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal --default-toolchain none
diff --git a/docker/Dockerfile.rocm b/docker/Dockerfile.rocm
index ecbab02ebb4..a391c192c80 100644
--- a/docker/Dockerfile.rocm
+++ b/docker/Dockerfile.rocm
@@ -130,11 +130,13 @@ RUN if [ ! -f ${COMMON_WORKDIR}/vllm/rust/Cargo.toml ]; then \
         exit 1; \
     fi
 
-# protoc is used by tonic-build/prost-build.
 RUN apt-get update -q -y && apt-get install -q -y --no-install-recommends \
-        protobuf-compiler libprotobuf-dev \
+        ca-certificates curl unzip \
     && rm -rf /var/lib/apt/lists/*
 
+COPY tools/install_protoc.sh /tmp/install_protoc.sh
+RUN /tmp/install_protoc.sh && rm /tmp/install_protoc.sh
+
 # Install rustup; the toolchain itself is pinned by rust/rust-toolchain.toml.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal --default-toolchain none
diff --git a/docker/Dockerfile.xpu b/docker/Dockerfile.xpu
index 3b34b2e6e54..5432f85feb0 100644
--- a/docker/Dockerfile.xpu
+++ b/docker/Dockerfile.xpu
@@ -6,10 +6,12 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
-        ca-certificates curl git build-essential \
-        protobuf-compiler libprotobuf-dev \
+        ca-certificates curl git build-essential unzip \
     && rm -rf /var/lib/apt/lists/*
 
+COPY tools/install_protoc.sh /tmp/install_protoc.sh
+RUN /tmp/install_protoc.sh && rm /tmp/install_protoc.sh
+
 # Install rustup; the toolchain itself is pinned by rust/rust-toolchain.toml.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal --default-toolchain none
diff --git a/tools/install_protoc.sh b/tools/install_protoc.sh
new file mode 100755
index 00000000000..a995fdb6f6a
--- /dev/null
+++ b/tools/install_protoc.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Install a pinned protoc binary from upstream GitHub releases.
+#
+# Distro protobuf-compiler packages vary widely in version (e.g.
+# AlmaLinux/RHEL 8 ships protoc 3.5, predating the
+# --experimental_allow_proto3_optional flag the rust frontend's build.rs
+# passes), so we pin the protoc version here instead.
+#
+# Override the version via the PROTOC_VERSION env var.
+# Requires: curl, unzip, root privileges.
+
+if [[ $(id -u) -ne 0 ]]; then
+  echo "Must be run as root" >&2
+  exit 1
+fi
+
+VERSION="${PROTOC_VERSION:-34.2}"
+
+ARCH="$(uname -m)"
+case "${ARCH}" in
+    # protoc release archives use "aarch_64" (with an underscore), not
+    # "aarch64". Don't "fix" this.
+    aarch64|arm64) URL_ARCH="aarch_64" ;;
+    x86_64|amd64)  URL_ARCH="x86_64" ;;
+    *) echo "Unsupported arch for protoc binary: ${ARCH}" >&2; exit 1 ;;
+esac
+
+URL="https://github.com/protocolbuffers/protobuf/releases/download/v${VERSION}/protoc-${VERSION}-linux-${URL_ARCH}.zip"
+TMPDIR="$(mktemp -d)"
+trap 'rm -rf "${TMPDIR}"' EXIT
+
+echo "Downloading: ${URL}"
+curl -fsSL -o "${TMPDIR}/protoc.zip" "${URL}"
+unzip -q -o "${TMPDIR}/protoc.zip" -d /usr/local
+echo "Installed $(protoc --version)"