diff --git a/.github/docker/Dockerfile.web b/.github/docker/Dockerfile.web
index d2a25ab57..6f7a538f2 100644
--- a/.github/docker/Dockerfile.web
+++ b/.github/docker/Dockerfile.web
@@ -63,9 +63,11 @@ RUN if [ -n "$GOOGLE_PLACES_API_KEY" ]; then \
     >> compass.yaml; \
   fi
 
-# Measure boot gzip for logs; deploy must not fail on absolute bundle size.
-ENV COMPASS_BOOT_SIZE_ENFORCE=0
-RUN .github/perf/run-boot-size-check.sh
+# Build with the compass.yaml written above (real API URL, PostHog, OAuth).
+# Never run .github/perf/run-boot-size-check.sh here: it swaps in the
+# placeholder compass.boot-size.yaml, which pointed staging at the wrong API.
+# Boot size is gated per PR in boot-bundle.yml, not at deploy.
+RUN cd apps/calendar-web && bun run build.ts
 
 FROM oven/bun:1.3.14-slim AS runtime
 
diff --git a/self-host/docker-compose.test.ts b/self-host/docker-compose.test.ts
index 267c77703..fb99be57f 100644
--- a/self-host/docker-compose.test.ts
+++ b/self-host/docker-compose.test.ts
@@ -705,8 +705,13 @@ describe("staging deploy workflow", () => {
     expect(bootConfig).toContain("posthog:");
     expect(dockerfile).toContain("nodeEnv: ${NODE_ENV}");
     expect(dockerfile).toContain("'posthog:'");
-    expect(dockerfile).toContain(".github/perf/run-boot-size-check.sh");
-    expect(dockerfile).toContain("COMPASS_BOOT_SIZE_ENFORCE=0");
+    // The image must build with its own deploy compass.yaml. The boot-size
+    // script swaps in placeholder config (fake API URL and PostHog key).
+    expect(dockerfile).toContain(
+      "RUN cd apps/calendar-web && bun run build.ts",
+    );
+    expect(dockerfile).not.toContain("RUN .github/perf/run-boot-size-check.sh");
+    expect(dockerfile).not.toContain("COMPASS_CONFIG_FILE");
   });
 
   it("builds cloud deploy web images from a GitHub-only Dockerfile with PostHog config", () => {