diff --git a/.gitea/workflows/docker-publish.yaml b/.gitea/workflows/docker-publish.yaml
index b058a3d5..3966365e 100644
--- a/.gitea/workflows/docker-publish.yaml
+++ b/.gitea/workflows/docker-publish.yaml
@@ -81,6 +81,22 @@ jobs:
             --max-workers=4 \
             -Dkotlin.daemon.jvm.options="-Xmx4g"
 
+      - name: Stage Web Assets for Docker build
+        if: matrix.service == 'web-app'
+        run: |
+          set -e
+          DIST_DIR="frontend/shells/meldestelle-web/build/dist/wasmJs/productionExecutable"
+          if [ ! -d "$DIST_DIR" ]; then
+            echo "❌ Erwarteter Build-Ordner nicht gefunden: $DIST_DIR" >&2
+            echo "Hinweis: Prüfe Gradle-Ausgabe und Modulpfad (:frontend:shells:meldestelle-web)" >&2
+            ls -la frontend/shells/meldestelle-web/build || true
+            exit 1
+          fi
+          mkdir -p config/docker/caddy/web-app/_site
+          rsync -a --delete "$DIST_DIR/" config/docker/caddy/web-app/_site/
+          echo "✓ Assets gestaged: config/docker/caddy/web-app/_site"
+          ls -la config/docker/caddy/web-app/_site | sed -n '1,200p'
+
       # Pangolin-Bypass: Credentials direkt in config.json schreiben.
       # Kein "docker login" → kein Daemon-Ping → kein HTTPS-Fehler.
       # BuildKit liest ~/.docker/config.json und verwendet diese Credentials beim Push.
diff --git a/config/docker/caddy/web-app/Dockerfile b/config/docker/caddy/web-app/Dockerfile
index 4af273ba..e8859a2b 100644
--- a/config/docker/caddy/web-app/Dockerfile
+++ b/config/docker/caddy/web-app/Dockerfile
@@ -32,8 +32,12 @@ COPY config/docker/caddy/web-app/config.json /usr/share/caddy/config.json.tmpl
 RUN chmod +x /entrypoint.sh
 
 # Copy Pre-built Static Assets from Host (WasmJs)
-# NOTE: You must run `./gradlew :frontend:shells:meldestelle-web:wasmJsBrowserDistribution -Pproduction=true` locally first!
-COPY frontend/shells/meldestelle-web/build/dist/wasmJs/productionExecutable/ /usr/share/caddy/
+# NOTE: CI (docker-publish.yaml) kopiert die gebauten Artefakte nach
+#       config/docker/caddy/web-app/_site/ bevor dieses Image gebaut wird.
+#       Lokal musst du vorher bauen:
+#       ./gradlew :frontend:shells:meldestelle-web:wasmJsBrowserDistribution -Pproduction=true
+#       und die Dateien ebenfalls nach _site/ kopieren.
+COPY config/docker/caddy/web-app/_site/ /usr/share/caddy/
 # index.html wird als Template abgelegt; der Entrypoint erzeugt daraus zur Laufzeit die finale index.html
 RUN mv /usr/share/caddy/index.html /usr/share/caddy/index.html.tmpl