diff --git a/Dockerfile b/Dockerfile
index 298e729..5b2598b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,6 +26,9 @@ ENTRYPOINT ["/entrypoint-vite.sh"]
 
 # ── Stage 2b: Node / Vite build ──────────────────────────────────────────────
 FROM node:22-alpine AS node-build
+# git: same reason as vite-dev above — npm needs it to resolve @boboko/core's
+# git+https tagged-VCS form.
+RUN apk add --no-cache git
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --ignore-scripts
@@ -91,16 +94,14 @@ COPY . .
 RUN chown -R www-data:www-data storage bootstrap/cache \
     && chmod -R 775 storage bootstrap/cache
 
-# Package discovery and asset publishing are fully determined by composer.lock + code,
-# so they belong in the image, not in every container's entrypoint. Only asset-type
-# tags are force-republished here — config tags (core-config, lunar) are a deliberate
-# one-time `vendor:publish` step you run and commit by hand, since re-running them would
-# silently overwrite any local edits to config/core.php or config/lunar/*.php.
-RUN php artisan package:discover --ansi \
-    && php artisan vendor:publish --tag=core-assets --force --ansi \
-    && php artisan vendor:publish --tag=public --force --ansi \
-    && php artisan filament:assets --ansi
-
+# No package:discover/vendor:publish/filament:assets here. Asset-publish
+# output (public/vendor/*, etc.) is generated locally and committed, so
+# `COPY . .` above already ships it. package:discover would only pre-warm
+# bootstrap/cache/packages.php — Laravel discovers providers live from
+# vendor/composer/installed.json on first boot if that cache is absent, so
+# it's not required — and some provider queries the DB during discovery,
+# which this build stage has no connection for (no .env in the build
+# context), so running it here would need a database that doesn't exist yet.
 COPY docker/entrypoint.sh /entrypoint.sh
 COPY docker/entrypoint-worker.sh /entrypoint-worker.sh
 RUN chmod +x /entrypoint.sh /entrypoint-worker.sh