diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..bfe1caa
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+**/node_modules
+.git
+.env
+*.log
+docker-compose.yml
+.dockerignore
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index d90d2c5..fc6d226 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -14,11 +14,17 @@ COPY --from=typst /usr/bin/typst /usr/local/bin/typst
 
 WORKDIR /app
 
-# Install production dependencies only
+# Workspace manifests first (cache-friendly), then a filtered install —
+# pnpm needs every workspace package's manifest present to resolve the
+# graph even though only apps/api's deps get installed here.
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN pnpm install --frozen-lockfile
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+RUN pnpm install --frozen-lockfile --filter api...
 
-COPY . .
+COPY apps/api ./apps/api
+
+WORKDIR /app/apps/api
 
 RUN chmod +x docker-entrypoint.sh
 
diff --git a/docker-compose.yml b/docker-compose.yml
index d3a5086..d40f757 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,9 +2,9 @@
 #  $APP_NAME — Docker Compose (self-hosted)
 #
 #  Prerequisites:
-#    1. Backend  → cp .env-production .env  and fill in all CHANGE_ME values
-#    2. Frontend → cd ../new_starr_app && cp .env.example .env → fill in values
-#                  → npm run build   (must run BEFORE building the Docker image)
+#    1. Backend  → cp apps/api/.env-production apps/api/.env  and fill in all CHANGE_ME values
+#    2. Frontend → cd apps/web && cp .env.example .env → fill in values
+#                  → pnpm --filter web build   (must run BEFORE building the Docker image)
 #    3. Run: docker compose up -d
 #
 #  ⚠  SSL NOTE — db.config.js and the session store both require SSL from
@@ -30,10 +30,12 @@ services:
 
   # ── Backend (Express) ───────────────────────────────────────────────────────
   backend:
-    build: .
+    build:
+      context: .
+      dockerfile: apps/api/Dockerfile
     ports:
       - "3024:3024"
-    env_file: .env
+    env_file: apps/api/.env
     depends_on:
       postgres:
         condition: service_healthy
@@ -44,9 +46,9 @@ services:
     restart: unless-stopped
 
   # ── Frontend (React / Nginx) ─────────────────────────────────────────────────
-  # Run `npm run build` inside ../new_starr_app before starting this service.
+  # Run `pnpm --filter web build` before starting this service.
   frontend:
-    build: ../new_starr_app
+    build: ./apps/web
     ports:
       - "80:80"
     restart: unless-stopped
@@ -86,13 +88,13 @@ services:
     image: dxflrs/garage
     entrypoint: ["/bin/sh", "/garage-init.sh"]
     volumes:
-      - ./config/garage.toml:/etc/garage.toml:ro
-      - ./scripts/garage-init.sh:/garage-init.sh:ro
+      - ./apps/api/config/garage.toml:/etc/garage.toml:ro
+      - ./apps/api/scripts/garage-init.sh:/garage-init.sh:ro
       - garage_meta:/var/lib/garage/meta
       - garage_data:/var/lib/garage/data
     ports:
       - "3900:3900"
-    env_file: .env
+    env_file: apps/api/.env
     healthcheck:
       test: ["CMD-SHELL", "test -f /var/lib/garage/meta/.ready && garage status > /dev/null 2>&1"]
       interval: 10s