diff --git a/.dockerignore b/.dockerignore
index cdfdf13..75a4d69 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -8,4 +8,5 @@ coverage
 *.log
 Dockerfile
 .env
-.env.local
+.env.*
+!.env.example
diff --git a/Dockerfile.selfhost b/Dockerfile.selfhost
index bb0b6e7..020c7ef 100644
--- a/Dockerfile.selfhost
+++ b/Dockerfile.selfhost
@@ -15,4 +15,9 @@ COPY . .
 
 EXPOSE 3001
 
-CMD ["sh", "-c", "pnpm run db:migrate:local && pnpm run build && pnpm exec vite preview --host 0.0.0.0 --port ${PORT:-3001}"]
+# The build MUST run at container start, not image-build time: AUTH_MODE (and the
+# other client envs) are inlined into the client bundle by `vite build`, and the
+# self-hoster only chooses AUTH_MODE at runtime via Compose. Building here lets
+# that runtime value bake into the bundle. NODE_OPTIONS raises the V8 heap ceiling
+# so the SSR build of ~7400 modules doesn't OOM under Node's ~2GB default.
+CMD ["sh", "-c", "pnpm run db:migrate:local && NODE_OPTIONS=--max-old-space-size=4096 pnpm run build && pnpm exec vite preview --host 0.0.0.0 --port ${PORT:-3001}"]