diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..51dc879
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,17 @@
+# The build copies the whole tree so the gates run against the same files the
+# repository gates do — see the Dockerfile. These are the ones that must not
+# come with it: build caches, the local virtualenv (wrong platform inside the
+# image), and git history the wheel build does not need.
+.git
+.github
+.venv
+dist
+build
+*.egg-info
+__pycache__
+*.py[cod]
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.coverage
+htmlcov
diff --git a/Dockerfile b/Dockerfile
index c03b142..fbdd6b1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,9 +63,14 @@ WORKDIR /app
 COPY pyproject.toml uv.lock README.md ./
 RUN uv sync --frozen --no-install-project --all-extras
 
-COPY src ./src
-COPY tests ./tests
-COPY examples ./examples
+# The whole tree, not a hand-listed subset. The `test` stage below runs the
+# repository's own gates, and those gates read the repository: the suite
+# asserts against `docs/DEPLOYMENT.md`, builds a wheel from `pyproject.toml`,
+# and reads `README.md`. A curated COPY list makes that a build failure every
+# time a test starts reading a file nobody remembered to add — which is
+# exactly how the first build of this image failed. `.dockerignore` names what
+# must stay out.
+COPY . .
 RUN uv sync --frozen --all-extras
 
 # ---------------------------------------------------------------- test