diff --git a/Dockerfile.nginx b/Dockerfile.nginx
new file mode 100644
index 0000000..7420252
--- /dev/null
+++ b/Dockerfile.nginx
@@ -0,0 +1,14 @@
+FROM nginx:1.27-alpine
+
+# The php-dynamic-qrcode container builds the full app (incl. composer/vendor) into its
+# own image at /var/www/html. nginx runs as a separate container and has no access to
+# that filesystem, so it needs its own copy of just the static assets it serves directly
+# via try_files - everything else (*.php) is proxied to php-fpm regardless. Without this,
+# every static asset request (CSS/JS/manifest) falls through nginx's try_files to
+# index.php, which requires a login and silently redirects there instead of serving the
+# file.
+COPY src/dist /var/www/html/dist
+COPY src/plugins /var/www/html/plugins
+COPY src/manifest.json /var/www/html/manifest.json
+COPY src/service-worker.js /var/www/html/service-worker.js
+COPY src/favicon.ico /var/www/html/favicon.ico
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index ce73de0..ffa7dac 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -1,6 +1,8 @@
 services:
   nginx:
-    image: "nginx:1.27-alpine"
+    build:
+      context: .
+      dockerfile: Dockerfile.nginx
     restart: "unless-stopped"
     ports:
       - "80:80"