diff --git a/.dockerignore b/.dockerignore
index 6f2e1ef..a4826e7 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,14 @@ __pycache__
 *.pyc
 .pytest_cache
 *.log
-.env
 .git
 tests
+
+# .env is deliberately NOT ignored - it carries this deployment's configuration
+# and the Dockerfile copies it into the image. Excluding it here silently undid
+# that: the build succeeded, the container started with no configuration at all,
+# and died on the first required setting.
+#
+# The generated sign-in passwords must never be in the image.
+SIGNIN_PASSWORDS.txt
+.env.local
diff --git a/Dockerfile b/Dockerfile
index 699a8e1..8cafec9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,6 +46,19 @@ COPY scripts ./scripts
 COPY data ./data
 COPY serve.py .
 
+# The deployment's configuration. settings.py loads it from the backend root -
+# app/infrastructure/settings.py resolves parents[2], which is /app here - so it
+# has to land next to app/, not inside it.
+#
+# Easy to leave out, and silent when you do: the image builds, the container
+# starts with no configuration, and exits on the first required setting with the
+# platform reporting only a Bad Gateway. .dockerignore must not exclude it
+# either; that alone is enough to reproduce the same failure.
+#
+# Real environment variables still win over this file (load_dotenv is called
+# without override=True), so Dokploy can override any value without a rebuild.
+COPY .env .
+
 # Pristine copies of everything the app also WRITES to, kept at a path that is
 # never mounted over.
 #