diff --git a/Dockerfile b/Dockerfile
index a413e63a..062e088b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,12 +47,7 @@ RUN --mount=type=cache,id=epicnext-pnpm,target=/pnpm/store,sharing=locked \
 # Source changes invalidate compilation, but keep the installed dependencies.
 COPY . .
 
-# --- Automatische GitLab Pull ---
-# Vraagt de meest recente commit op van gitlab.epicnabbo.nl (project: remco/EpicNext-Cms).
-# Bij een nieuwe commit breekt Docker hier automatisch de cache en haalt hij direct de nieuwste code binnen.
-# (remco%2FEpicNext-Cms is de URL-encoded variant van remco/EpicNext-Cms)
-ADD https://gitlab.epicnabbo.nl/api/v4/projects/remco%2FEpicNext-Cms/repository/branches/main /tmp/commit.json
-RUN git pull origin main
+# Build only the checked out source; CI owns revision selection and freshness checks.
 
 # Build the production bundle.
 # The .env file is loaded ONLY inside this RUN layer (not persisted as ENV, so no
diff --git a/src/lib/deploy-workflow-contract.test.ts b/src/lib/deploy-workflow-contract.test.ts
index b649a090..343a733f 100644
--- a/src/lib/deploy-workflow-contract.test.ts
+++ b/src/lib/deploy-workflow-contract.test.ts
@@ -31,3 +31,11 @@ it("preserves production runtime configuration and recent cache", () => {
 	);
 	expect(deploy).not.toContain("docker volume prune");
 });
+it("builds the checked out source without fetching a moving remote branch", () => {
+	const dockerfile = readFileSync("Dockerfile", "utf8");
+	expect(dockerfile).toContain("COPY . .");
+	expect(dockerfile).not.toMatch(
+		/^ADD\s+https?:\/\/.*(?:repository|branches)/m,
+	);
+	expect(dockerfile).not.toMatch(/^RUN\s+git\s+(?:pull|fetch|clone)\b/m);
+});