diff --git a/.dockerignore b/.dockerignore
index 29c3b01..2f8c53f 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,21 +1,29 @@
 # VCS / editor / docs — not needed in the image build context.
 .git
 .gitea
-.github
 .idea
 .vscode
 *.md
 LICENSE
 
+# Secrets and env files must never be baked into an image layer.
+.env
+.env.*
+
 # Local build outputs and databases.
 /pansy
 *.db
 *.db-wal
 *.db-shm
 
+# Go workspace files (pansy builds standalone; GOWORK=off).
+go.work
+go.work.sum
+
 # Frontend deps/output are rebuilt inside the image's web stage.
 web/node_modules
 web/dist
+web/.vite
 
 # The embedded web build is produced fresh in the image (web stage → embed
 # directory), so never ship stale local contents. dist.go itself is kept.
diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index 1a0448e..2f53d9a 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -1,7 +1,7 @@
 name: Build image
 
 # Build the single-binary image and push it to the Gitea container registry so
-# it can be deployed with Komodo. Tagging:
+# it can be deployed with Komodo. Tagging (see README for the canonical table):
 #   * main            -> :latest
 #   * any other branch -> :<branch-name>   (sanitized to valid Docker tag chars)
 #   * every build also -> :sha-<short>      (immutable, handy for pinning)
@@ -27,12 +27,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
+        # Untrusted values (branch name) go through env, never inline ${{ }}, so a
+        # crafted branch name can't inject shell. Check out the exact triggering
+        # commit so the sha-<short> tag matches the code that was built.
+        env:
+          REPO: ${{ github.repository }}
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          GIT_TOKEN: ${{ github.token }}
         run: |
-          REPO_URL="https://token:${{ github.token }}@gitea.stevedudenhoeffer.com/${{ github.repository }}.git"
-          git clone --depth=1 --branch "${{ github.ref_name }}" "$REPO_URL" .
+          git init -q .
+          git remote add origin "https://token:${GIT_TOKEN}@gitea.stevedudenhoeffer.com/${REPO}.git"
+          git fetch -q --depth=1 origin "$SHA" || git fetch -q --depth=1 origin "$REF_NAME"
+          git checkout -q FETCH_HEAD
 
       - name: Set up Docker Buildx
-        run: docker buildx create --use --name pansy-builder --driver docker-container 2>/dev/null || docker buildx use pansy-builder
+        # Check first so a genuine create failure surfaces (rather than being
+        # hidden behind a swallowed "already exists").
+        run: |
+          docker buildx inspect pansy-builder >/dev/null 2>&1 \
+            || docker buildx create --name pansy-builder --driver docker-container
+          docker buildx use pansy-builder
 
       - name: Log in to Gitea registry
         env:
@@ -40,34 +55,33 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
 
-      - name: Compute tags
-        id: meta
+      - name: Build and push (linux/amd64)
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
         run: |
-          SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
-          if [ "${GITHUB_REF_NAME}" = "main" ]; then
+          SHA_SHORT=$(echo "$SHA" | cut -c1-7)
+
+          if [ "$REF_NAME" = "main" ]; then
             PRIMARY="latest"
           else
             # Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-].
-            PRIMARY=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g' | sed 's/--*/-/g' | sed 's/^[-.]*//;s/-$//')
+            PRIMARY=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^[-.]*//; s/-*$//')
+            # A non-main branch must never clobber :latest, and the tag can't be empty.
+            [ "$PRIMARY" = "latest" ] && PRIMARY="branch-latest"
+            [ -z "$PRIMARY" ] && PRIMARY="branch-${SHA_SHORT}"
           fi
-          TAGS="${IMAGE_NAME}:${PRIMARY},${IMAGE_NAME}:sha-${SHA_SHORT}"
-          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
-          echo "Building tags: ${TAGS}"
 
-      - name: Build and push (linux/amd64)
-        run: |
-          TAG_FLAGS=""
-          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
-          for tag in "${TAG_ARRAY[@]}"; do
-            TAG_FLAGS="$TAG_FLAGS --tag $tag"
-          done
+          # Build the tag flags as an array so no word-splitting/quoting surprises.
+          TAGS=(--tag "${IMAGE_NAME}:${PRIMARY}" --tag "${IMAGE_NAME}:sha-${SHA_SHORT}")
+          echo "Building ${IMAGE_NAME}:${PRIMARY} and ${IMAGE_NAME}:sha-${SHA_SHORT}"
 
           docker buildx build \
             --push \
             --platform linux/amd64 \
-            $TAG_FLAGS \
-            --build-arg "BUILD_COMMIT=${GITHUB_SHA}" \
-            --build-arg "BUILD_BRANCH=${GITHUB_REF_NAME}" \
+            "${TAGS[@]}" \
+            --build-arg "BUILD_COMMIT=${SHA}" \
+            --build-arg "BUILD_BRANCH=${REF_NAME}" \
             --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
             --file ./Dockerfile \
             .
diff --git a/Dockerfile b/Dockerfile
index 599db53..073c8db 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,13 +8,15 @@
 FROM node:22-alpine AS web
 WORKDIR /web
 COPY web/package.json web/package-lock.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm npm ci
 COPY web/ ./
 RUN npm run build
 
 # ---- stage 2: build the static Go binary (web bundle embedded) --------------
 FROM golang:1.26-alpine AS build
-ENV CGO_ENABLED=0 GOTOOLCHAIN=auto
+# GOWORK=off matches the Makefile: pansy is a standalone module, built without
+# any parent workspace even if one leaks into the build context.
+ENV CGO_ENABLED=0 GOTOOLCHAIN=auto GOWORK=off
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod go mod download
@@ -38,7 +40,7 @@ LABEL org.opencontainers.image.title="pansy" \
       org.opencontainers.image.version="${BUILD_BRANCH}" \
       org.opencontainers.image.created="${BUILD_TIME}"
 
-# ca-certificates: outbound TLS (OIDC discovery, #5). tzdata: correct local time.
+# ca-certificates: outbound TLS (e.g. OIDC discovery). tzdata: correct local time.
 RUN apk add --no-cache ca-certificates tzdata \
     && adduser -D -u 10001 pansy \
     && mkdir -p /data \