diff --git a/.dockerignore b/.dockerignore
index 244e60340..0e4a88fd2 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -14,3 +14,6 @@ node_modules
 .env
 
 *.md
+
+# Runtime data (bind-mounted at /opt/data; must not leak into build context)
+data/