diff --git a/.dockerignore b/.dockerignore
index e3c99575..ae84fa66 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -7,7 +7,6 @@ build
 .git
 .gitignore
 
-# Env files (use build args instead; .env.template is copied for defaults)
-.env
+# Env files (keep .env for build; exclude local overrides)
 .env.local
 .env.*.local
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index f8738184..e71c9fce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,30 +1,31 @@
-# Pass the build hash as an argument:
-# docker build --build-arg VITE_BUILD_HASH=$(git rev-parse --short HEAD) -t flotilla .
+# Stage 1: Build
+# Uses .env from build context for config (logo, branding, etc.)
+# Optional: docker build --build-arg VITE_BUILD_HASH=$(git rev-parse --short HEAD) -t flotilla .
 
-FROM node:20-slim
+FROM node:20-slim AS builder
 
-# Install pnpm
 RUN npm install -g pnpm@latest
 
-# Set working directory
 WORKDIR /app
 
-# Copy package files
 COPY package.json pnpm-lock.yaml ./
-
-# Install dependencies
 RUN pnpm i
 
-# Copy the rest of the application
+# Copy everything (including .env when present) - build.sh will source it
 COPY . .
 
 ARG VITE_BUILD_HASH
 ENV VITE_BUILD_HASH=${VITE_BUILD_HASH}
 
-# Build the application
 ENV NODE_OPTIONS=--max_old_space_size=16384
 RUN pnpm run build
 
-# Default to serving the build directory
-CMD ["npx", "serve", "build"]
+# Stage 2: Runtime
+FROM node:20-alpine
 
+WORKDIR /app
+
+# Copy only the built output - no source, no .env, no dev deps
+COPY --from=builder /app/build ./build
+
+CMD ["npx", "serve", "build"]
diff --git a/build.sh b/build.sh
index 252fde49..142ba981 100755
--- a/build.sh
+++ b/build.sh
@@ -5,6 +5,9 @@ temp_env=$(declare -p -x)
 if [ -f .env.template ]; then
   source .env.template
 fi
+if [ -f .env ]; then
+  source .env
+fi
 
 # Avoid overwriting env vars provided directly
 # https://stackoverflow.com/a/69127685/1467342