diff --git a/Dockerfile b/Dockerfile
index e0c0602..5b6d150 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,24 +1,40 @@
 # ---------- Build stage ----------
-# glibc (Debian) base: the lockfile's native binaries (@rollup/rollup-linux-x64-gnu,
-# @esbuild/linux-x64) are built against glibc. alpine uses musl and would fail to load them.
-FROM node:22-slim AS build
+ARG NODE_VERSION=22
+FROM node:${NODE_VERSION}-slim AS build
+LABEL stage=builder
+
 WORKDIR /app
 
-# Install dependencies first (better layer caching)
+# Use production env for deterministic builds of the static site
+ENV NODE_ENV=production
+
+# Copy package manifests and install deps for the build. We include optional
+# native deps so Rollup/Vite/esbuild native binaries are resolved for the
+# builder platform.
 COPY package.json package-lock.json ./
 COPY apps/web/package.json apps/web/package.json
-# --include=optional installs the platform-native Rollup/esbuild binaries Vite needs.
-# Never use --no-optional / --omit=optional here: it omits @rollup/rollup-linux-x64-gnu
-# and the Vite build crashes with "Cannot find module @rollup/rollup-linux-x64-gnu".
-RUN npm ci --include=optional
+RUN npm ci --include=optional --no-audit --no-fund
 
 # Copy source and build the static site
-COPY apps/web apps/web
+COPY . .
 RUN npm run build --workspace apps/web
 
 # ---------- Production stage ----------
 FROM nginx:stable-alpine
+LABEL stage=production
+
+# Prevent index leaks via autoindex
+RUN rm -f /etc/nginx/conf.d/default.conf || true
 COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Copy built static assets from the build stage
 COPY --from=build /app/dist/apps/web /usr/share/nginx/html
+
+# Expose standard HTTP port
 EXPOSE 80
+
+# Lightweight healthcheck: wget is present in alpine's busybox
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+	CMD wget -qO- --spider http://127.0.0.1:80/ || exit 1
+
 CMD ["nginx", "-g", "daemon off;"]