diff --git a/.dockerignore b/.dockerignore
index ddaa9ab..a0b9c01 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -4,6 +4,7 @@ worktrees/
 .github/
 .claude/
 docs/
-web/
+web/node_modules/
+web/dist/
 *.md
 .env*
diff --git a/Dockerfile b/Dockerfile
index b8b77b0..75f4284 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,9 +9,22 @@
 # set MAESTRO_REGISTRY_BIND_ADDR to), and set MAESTRO_TOKEN as a secret env.
 # No persistent volume is required when MAESTRO_TOKEN is provided.
 
+# 1. Build the web client bundle. Output lands in /web/dist and is consumed
+#    by the Rust builder below via `rust-embed`.
+FROM node:20-bookworm AS web-builder
+WORKDIR /web
+RUN corepack enable
+COPY web/package.json web/pnpm-lock.yaml* ./
+RUN pnpm install --frozen-lockfile || pnpm install
+COPY web/ ./
+RUN pnpm build
+
+# 2. Build the registry binary. `rust-embed` picks up the bundle that the
+#    previous stage produced.
 FROM rust:1-bookworm AS builder
 WORKDIR /build
 COPY . .
+COPY --from=web-builder /web/dist /build/web/dist
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/build/target \
     cargo build --release -p maestro-registry \
diff --git a/crates/maestro-registry/src/web_assets.rs b/crates/maestro-registry/src/web_assets.rs
index 478cffe..490e43f 100644
--- a/crates/maestro-registry/src/web_assets.rs
+++ b/crates/maestro-registry/src/web_assets.rs
@@ -17,8 +17,7 @@ use rust_embed::RustEmbed;
 #[folder = "../../web/dist/"]
 struct WebAssets;
 
-const FALLBACK_INDEX: &str =
-    "<!doctype html><meta charset=utf-8><title>maestro</title>\
+const FALLBACK_INDEX: &str = "<!doctype html><meta charset=utf-8><title>maestro</title>\
      <h1>maestro registry</h1>\
      <p>Web bundle not built. Run <code>pnpm --dir web install</code> \
      then <code>pnpm --dir web build</code>, then rebuild the registry.</p>";