diff --git a/Dockerfile b/Dockerfile
index 54d20ef..2788cd8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,11 +10,19 @@ RUN composer install \
     --optimize-autoloader \
     --ignore-platform-reqs
 
-# ── Stage 2a: Vite dev (node_modules only, no build) ─────────────────────────
+# ── Stage 2a: Vite dev (node_modules only, no build) ──────────────────────────
 FROM node:22-alpine AS vite-dev
+# git: needed for npm to install @boboko/core's git+https tagged-VCS form (see
+# package.json's _dependencies and docker/entrypoint-vite.sh). No build-time
+# `npm install` here — package.json's boboko/core path-repo form (../boboko-core)
+# isn't visible in the build context, only once bind-mounted at container start,
+# and entrypoint-vite.sh already runs npm install on every boot, so this would be
+# redundant even if it could work.
+RUN apk add --no-cache git
 WORKDIR /app
-COPY package*.json ./
-RUN npm ci --ignore-scripts
+COPY docker/entrypoint-vite.sh /entrypoint-vite.sh
+RUN chmod +x /entrypoint-vite.sh
+ENTRYPOINT ["/entrypoint-vite.sh"]
 
 # ── Stage 2b: Node / Vite build ──────────────────────────────────────────────
 FROM node:22-alpine AS node-build
diff --git a/docker-compose.core-dev.yml b/docker-compose.core-dev.yml
index 8eb19db..c14cf1a 100644
--- a/docker-compose.core-dev.yml
+++ b/docker-compose.core-dev.yml
@@ -10,3 +10,7 @@ services:
   scheduler:
     volumes:
       - ../boboko-core:/var/www/boboko-core
+
+  vite:
+    volumes:
+      - ../boboko-core:/boboko-core
diff --git a/docker/entrypoint-vite.sh b/docker/entrypoint-vite.sh
new file mode 100644
index 0000000..ee87148
--- /dev/null
+++ b/docker/entrypoint-vite.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+# Mirrors entrypoint.sh's Composer block: node_modules is a named/anonymous
+# volume, not the bind-mounted host directory, so this container needs its
+# own live install on every boot rather than relying on whatever was baked in
+# at image-build time.
+echo "[entrypoint-vite] Installing npm dependencies..."
+npm install
+
+# Re-resolve @boboko/core specifically on every boot, whether it's a local
+# path-repo checkout (file:../boboko-core, needs docker-compose.core-dev.yml's
+# ../boboko-core:/boboko-core mount) or a tagged VCS install
+# (git+https://...#vX.Y.Z) — the same manual toggle composer.json's
+# repositories/_repositories block uses for the PHP side of this same
+# package. A plain `npm install` above only installs what package-lock.json
+# already pins; it won't notice a new commit on the path-repo checkout or a
+# re-pushed tag. `npm update` re-resolves that one package against whatever
+# package.json currently says and rewrites package-lock.json to pin it —
+# exactly like `composer update boboko/* --with-all-dependencies` rewrites
+# composer.lock, which is committed so prod picks up the resolved version via
+# `npm install` alone (no `npm update` in prod's build).
+echo "[entrypoint-vite] Re-resolving @boboko/core..."
+npm update @boboko/core
+
+exec "$@"
diff --git a/resources/js/app.js b/resources/js/app.js
index 82841fb..20084e2 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -10,13 +10,14 @@ window.Turbo.session.drive = false;
 
 import { Application } from "@hotwired/stimulus";
 import { registerControllers } from "./stimulus/index";
-import { registerCheckout } from "./checkout";
+import { registerCheckout } from "@boboko/core";
 
 const application = Application.start();
 application.debug = false;
 
 registerControllers(application);
 
-// Portable cart + checkout module (destined for boboko-core). Owns its own
-// bbk-* Stimulus controllers; this is the only wiring line it needs here.
+// Portable cart + checkout module, installed as a real npm dependency (see
+// package.json). Owns its own bbk-* Stimulus controllers; this is the only
+// wiring line it needs here.
 registerCheckout(application);
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index d693de0..8d26cc9 100644
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -37,7 +37,7 @@
     <link rel="preload" as="font" type="font/woff2" crossorigin href="{{ \Illuminate\Support\Facades\Vite::asset('resources/fonts/manrope/manrope-v20-greek_latin-700.woff2') }}">
     <link rel="preload" as="font" type="font/woff2" crossorigin href="{{ \Illuminate\Support\Facades\Vite::asset('resources/fonts/manrope/manrope-v20-greek_latin-800.woff2') }}">
 
-    @vite(['resources/css/checkout.css', 'resources/css/app.css', 'resources/js/app.js'])
+    @vite(['node_modules/@boboko/core/resources/css/checkout.css', 'resources/css/app.css', 'resources/js/app.js'])
 
     @auth('staff')
         @php($stoicToken = \App\Services\Stoic::token(auth('staff')->user()->email))
diff --git a/vite.config.js b/vite.config.js
index 9274b7e..aa0e1aa 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -1,6 +1,7 @@
 import { defineConfig } from "vite";
 import laravel from "laravel-vite-plugin";
 import tailwindcss from "@tailwindcss/vite";
+import { boboko } from "@boboko/core/vite-plugin";
 
 export default defineConfig({
     build: {
@@ -14,13 +15,18 @@ export default defineConfig({
                 // checkout.css first: it's the portable cart/checkout module's
                 // structural base (@layer bbk-checkout) and must load before
                 // app.css so the host's own .bbk-* theming always wins.
-                "resources/css/checkout.css",
+                // Sourced from the @boboko/core npm package (a local
+                // `file:../boboko-core` dependency — see package.json and
+                // boboko()'s own comments in @boboko/core/vite-plugin for why
+                // this needs no further config here).
+                "node_modules/@boboko/core/resources/css/checkout.css",
                 "resources/css/app.css",
                 "resources/js/app.js",
             ],
             refresh: true,
         }),
         tailwindcss(),
+        boboko(),
     ],
     server: {
         host: "0.0.0.0",