diff --git a/Dockerfile b/Dockerfile
index 905cda2e98..2d773a45d2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,10 @@ ENV NEXT_TELEMETRY_DISABLED=1
 # install only needs to exist as a bootstrap and follows the active major.
 RUN apk add --no-cache git \
     && npm install -g pnpm@latest
-COPY package.json pnpm-lock.yaml* ./
+# pnpm-workspace.yaml + .npmrc must be present too: the lockfile records the
+# overrides from pnpm-workspace.yaml, and --frozen-lockfile rejects a build
+# where the workspace config is absent (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./
 # pnpm fetch: download all deps into $PNPM_STORE first, so only the lockfile
 # change (not source changes) invalidates the network-heavy download layer.
 RUN pnpm fetch --ignore-scripts
diff --git a/src/lib/docker-build-contract.test.ts b/src/lib/docker-build-contract.test.ts
index 9a5d304d56..03c6d20e44 100644
--- a/src/lib/docker-build-contract.test.ts
+++ b/src/lib/docker-build-contract.test.ts
@@ -6,7 +6,7 @@ const dockerfile = readFileSync("Dockerfile", "utf8");
 describe("Docker build cache", () => {
 	it("installs frozen dependencies before copying application source", () => {
 		const manifests = dockerfile.indexOf(
-			"COPY package.json pnpm-lock.yaml* ./",
+			"COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./",
 		);
 		const fetch = dockerfile.indexOf("pnpm fetch --ignore-scripts");
 		const install = dockerfile.indexOf("pnpm install --frozen-lockfile");