diff --git a/Services/Website/.dockerignore b/Services/Website/.dockerignore
index 1f3233b..2a1db0d 100644
--- a/Services/Website/.dockerignore
+++ b/Services/Website/.dockerignore
@@ -1,7 +1,16 @@
+# Applies only when this directory is itself the build context. The Dockerfile
+# builds from the repository root (it copies the sibling Packages/), so today's
+# builds read the root .dockerignore instead — keep the two in step.
+
 .build
 .swiftpm
-.DS_Store
 .env.local
 docker-compose.*
 Makefile
-README.md
\ No newline at end of file
+README.md
+
+# The double star matches at every depth; a bare pattern only covers the context root.
+**/.DS_Store
+
+# Local database data directory (bind-mounted by Compose)
+Tests/DB
diff --git a/Services/Website/README.md b/Services/Website/README.md
index a5d5378..acdeba3 100644
--- a/Services/Website/README.md
+++ b/Services/Website/README.md
@@ -285,7 +285,7 @@ The production image is built in release mode with a statically linked Swift run
 
 `IMAGE_PLATFORM` is the single source of truth for the deployment architecture: `make img-check` and `make img-release` both build for it, and `docker-compose.yml` runs the pulled image with it. Keep it matched to the deployment host — the three have to agree, or a release builds for one architecture and the production Compose file refuses to run it. Local development builds are separate and follow `BUILD_PLATFORM` (see `docker-compose.override.yml`), since they target your machine rather than the deployment.
 
-The test sources are deliberately absent from the image. SPM validates the path of every target in the root package — including the test targets — even when only the executable product is built, so the Dockerfile creates those two directories empty rather than copying them. That keeps test edits from invalidating the release-build layer, and keeps the local database bind mount under `Tests/DB` out of the build context entirely (`.dockerignore` excludes `**/Tests` for the same reason).
+The test sources are deliberately absent from the image. SPM validates the path of every target in the root package — including the test targets — even when only the executable product is built, so the Dockerfile creates those two directories empty rather than copying them. That keeps test edits from invalidating the release-build layer, and keeps the local database bind mount under `Tests/DB` out of the build context entirely (the root `.dockerignore` excludes `**/Tests/DB` for the same reason).
 
 ### Base images
 All three stages pin their base by digest as well as tag, so a rebuild of an old commit resolves the same bases it originally used. The trade-off is that they no longer pick up upstream rebuilds on their own: **refresh the digests deliberately**, on whatever cadence you patch on, with