diff --git a/.dockerignore b/.dockerignore
index fa9710133..de81c604d 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -32,3 +32,14 @@ images
 **/cert-info/*.srl
 **/*.local.*
 **/dist
+
+# Tests and their helpers. The build bundles only what the client imports, and
+# the server image ships src as-is, so leaving these out keeps them out of the
+# image and keeps a test-only edit from invalidating the build layer.
+**/*.test.ts
+**/*.test.tsx
+**/setupTests.ts
+**/test-setup.ts
+**/testing.ts
+**/testing
+samples
diff --git a/.github/workflows/test_build_docker.yml b/.github/workflows/test_build_docker.yml
index 4ea74a9e7..2af84f637 100644
--- a/.github/workflows/test_build_docker.yml
+++ b/.github/workflows/test_build_docker.yml
@@ -72,6 +72,14 @@ jobs:
               if curl -sfk "$scheme://localhost:$host_port/status"; then
                 echo ""
                 echo "✓ $name responded on /status"
+                # The client build is the file most likely to go missing from the image.
+                ui_status=$(curl -sk -o /dev/null -w '%{http_code}' "$scheme://localhost:$host_port/explorer/")
+                if [ "$ui_status" != 200 ]; then
+                  echo "FAIL: $name returned $ui_status for the UI at /explorer/"
+                  docker rm -f "$name" >/dev/null
+                  return 1
+                fi
+                echo "✓ $name served the UI at /explorer/"
                 docker rm -f "$name" >/dev/null
                 return 0
               fi
diff --git a/Dockerfile b/Dockerfile
index 18c3b2aec..81a7ebcba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,8 +43,21 @@ COPY --from=build --chown=0:0 /tmp/node/LICENSE /usr/local/LICENSE
 
 ENV HOME=/graph-explorer
 WORKDIR /graph-explorer
-COPY --from=deps --chown=0:0 /app ./
-COPY --from=build --chown=0:0 /app ./
+# Only what the entrypoint and the server read. The server runs its TypeScript
+# source directly and loads @graph-explorer/shared from source through the
+# workspace symlink, so both keep src and package.json. The pnpm symlinks in
+# each node_modules point into the root one.
+COPY --from=deps --chown=0:0 /app/node_modules ./node_modules
+COPY --from=deps --chown=0:0 /app/packages/graph-explorer/node_modules ./packages/graph-explorer/node_modules
+COPY --from=deps --chown=0:0 /app/packages/graph-explorer-proxy-server/node_modules ./packages/graph-explorer-proxy-server/node_modules
+COPY --from=build --chown=0:0 /app/docker-entrypoint.sh /app/process-environment.sh /app/setup-ssl.sh /app/LICENSE /app/NOTICE /app/THIRD_PARTY_LICENSES.txt ./
+COPY --from=build --chown=0:0 /app/packages/graph-explorer/.env ./packages/graph-explorer/
+COPY --from=build --chown=0:0 /app/packages/graph-explorer/dist ./packages/graph-explorer/dist
+COPY --from=build --chown=0:0 /app/packages/graph-explorer-proxy-server/package.json ./packages/graph-explorer-proxy-server/
+COPY --from=build --chown=0:0 /app/packages/graph-explorer-proxy-server/cert-info ./packages/graph-explorer-proxy-server/cert-info
+COPY --from=build --chown=0:0 /app/packages/graph-explorer-proxy-server/src ./packages/graph-explorer-proxy-server/src
+COPY --from=build --chown=0:0 /app/packages/shared/package.json ./packages/shared/
+COPY --from=build --chown=0:0 /app/packages/shared/src ./packages/shared/src
 
 EXPOSE 443
 EXPOSE 80