diff --git a/docker/Dockerfile b/docker/Dockerfile
index 980349d..9350db6 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -10,7 +10,8 @@ RUN apt-get update \
 ENV PYTHON=/usr/bin/python3
 
 COPY package.json package-lock.json ./
-RUN --mount=type=cache,target=/root/.npm npm ci --no-audit --no-fund
+RUN --mount=type=cache,target=/root/.npm npm ci --ignore-scripts --no-audit --no-fund
+RUN npm rebuild esbuild sharp better-sqlite3 --no-audit --no-fund
 
 COPY . .
 RUN npm run build:web && npm run build:server
diff --git a/scripts/dev/docker.workflow.test.ts b/scripts/dev/docker.workflow.test.ts
index 9784bc9..2242fb5 100644
--- a/scripts/dev/docker.workflow.test.ts
+++ b/scripts/dev/docker.workflow.test.ts
@@ -26,9 +26,9 @@ describe('docker workflows', () => {
   it('keeps server docker builds isolated from desktop packaging dependencies', () => {
     const dockerfile = readFileSync(resolve(process.cwd(), 'docker/Dockerfile'), 'utf8');
 
-    expect(dockerfile).toContain('npm ci --no-audit --no-fund');
-    expect(dockerfile).not.toContain('npm ci --omit=peer --no-audit --no-fund');
-    expect(dockerfile).not.toContain('npm ci --include=dev --omit=peer --no-audit --no-fund');
+    expect(dockerfile).toContain('npm ci --ignore-scripts --no-audit --no-fund');
+    expect(dockerfile).toContain('npm rebuild esbuild sharp better-sqlite3 --no-audit --no-fund');
+    expect(dockerfile).not.toContain('npm ci --no-audit --no-fund');
     expect(dockerfile).toContain('RUN npm run build:web && npm run build:server');
     expect(dockerfile).toContain('npm prune --omit=dev --no-audit --no-fund');
   });