diff --git a/Dockerfile b/Dockerfile
index 57fa443..104b128 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,18 +34,17 @@ ARG TARGETARCH=amd64
 
 WORKDIR /src
 
-# The real console bundle goes in *after* the source tree, so the COPY above
-# (which carries only the .gitkeep placeholder from a fresh clone) cannot
-# clobber it. `all:dist` in the embed directive needs the directory itself to
-# exist, which the placeholder guarantees.
-COPY --from=web /src/internal/web/dist/ internal/web/dist/
-
-# Module cache first, for the same reason.
+# Download modules before copying the application sources.
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
+# Copy the fresh bundle last: the source tree contains a tracked index.html
+# whose hashed asset references can be stale. It must never overwrite the
+# index generated alongside the JavaScript and CSS in the web stage.
+COPY --from=web /src/internal/web/dist/ internal/web/dist/
+
 # CGO off: the resolver, bbolt and the TLS stack are all pure Go, and a static
 # binary is what lets the runtime stage be distroless-static.
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \