diff --git a/Dockerfile b/Dockerfile
index b325c673f54e0a488ee52071acb2274fddb46dba..00b23c849d4c82fc64e8f62b5dd4e0c204d472bf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,20 +2,24 @@ # syntax=docker/dockerfile:1.7
 
 FROM node:20-alpine AS web-builder
 
-WORKDIR /web
-COPY web/package.json web/package-lock.json ./
-RUN npm ci
-COPY web/ ./
-RUN npm run build
+# Mirror the host repo layout inside /src so vite's relative
+# `outDir: '../internal/server/web/dist'` resolves to a stable, explicit
+# path (/src/internal/server/web/dist) — not to a path that "happens to
+# land at the container root" because of WORKDIR.
+WORKDIR /src
+COPY web/package.json web/package-lock.json web/
+RUN cd web && npm ci
+COPY web/ web/
+RUN cd web && npm run build
 
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-COPY --from=web-builder /internal/server/web/dist /src/internal/server/web/dist
+COPY --from=web-builder /src/internal/server/web/dist /src/internal/server/web/dist
 RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /out/lethe ./cmd/lethe
 
 FROM gcr.io/distroless/static-debian12:nonroot
diff --git a/go.mod b/go.mod
index 305ac937a3714ecf0f73703533531a33333d4bae..68c12c8d92238687ee44d3bc1d3e85e060c20238 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module sourcecraft.dev/bigbes/lethe
 
-go 1.25.0
+go 1.26.0
 
 require (
 	github.com/coreos/go-oidc/v3 v3.18.0