diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..2b5059a8
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,23 @@
+# Build artifacts
+.next/
+node_modules/
+out/
+build/
+dist/
+
+# Local dev / workspace noise
+docs/specs/
+memory/
+reports/
+output/
+skills/
+*.log
+.env*
+!.env.example
+
+# Git / CI
+.git/
+.github/
+coverage/
+*.tsbuildinfo
+next.config.mjs.bak2
diff --git a/.github/workflows/slsa-provenance.yml b/.github/workflows/slsa-provenance.yml
index 0e9a10a8..5733050b 100644
--- a/.github/workflows/slsa-provenance.yml
+++ b/.github/workflows/slsa-provenance.yml
@@ -33,7 +33,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd9f16464e31d5e78d1f2f7e7f4cbd
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3 (repin: SHA anterior truncado a 39 chars, no resolvía)
 
       - name: Log in to GHCR
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
diff --git a/Dockerfile b/Dockerfile
index d6ab0889..cdf02765 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,14 +3,18 @@ FROM node:22-slim
 # Install build dependencies for native modules (better-sqlite3)
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
+# pnpm: el repo es pnpm-first (pnpm-lock.yaml + pnpm-workspace.yaml + CI con pnpm 9).
+# El build anterior moría con "spawn pnpm ENOENT" al usar npm con scripts que invocan pnpm.
+RUN npm install -g pnpm@9
+
 WORKDIR /app
 
-COPY package.json package-lock.json ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY scripts/ ./scripts/
-RUN npm install
+RUN pnpm install --frozen-lockfile
 
 COPY . .
-RUN npm run build
+RUN pnpm build
 
 ENV NODE_ENV=production
 ENV HOSTNAME=0.0.0.0