diff --git a/.dockerignore b/.dockerignore
index a60105d..b84d7f9 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -13,9 +13,10 @@
 # Xcode project (not used by the Linux build)
 *.xcodeproj
 
-# OS / editor cruft
+# OS / editor / tooling cruft
 **/.DS_Store
 .vscode
+.claude
 
 # Local environment overrides and secrets (Compose still reads these from the
 # host at runtime; ignoring them here only keeps them out of the image build).
diff --git a/Services/Website/Dockerfile b/Services/Website/Dockerfile
index 6f3f1d4..98ac38a 100644
--- a/Services/Website/Dockerfile
+++ b/Services/Website/Dockerfile
@@ -3,9 +3,15 @@
 # ================================
 FROM node:22-alpine AS assets
 
-# Install the minifiers in their own layer, so they are cached across asset changes
-RUN apk add --no-cache oxipng \
-    && npm install --global esbuild svgo
+ARG ESBUILD_VERSION=0.28.1
+ARG OXIPNG_VERSION=9.1.5
+ARG SVGO_VERSION=4.0.2
+
+# Install the minifiers in their own layer, so they are cached across asset changes.
+# The oxipng pin is fuzzy (=~) so Alpine package revision bumps (-r0, -r1, ...) do
+# not break the build when the base image advances.
+RUN apk add --no-cache "oxipng=~${OXIPNG_VERSION}" \
+    && npm install --global "esbuild@${ESBUILD_VERSION}" "svgo@${SVGO_VERSION}"
 
 # Copy the static files and minify the JS/CSS/SVG sources and losslessly recompress
 # the PNG images in place, keeping their names so the URL paths derived from the
@@ -15,7 +21,7 @@ COPY ./Services/Website/Resources/Static .
 RUN esbuild --minify --allow-overwrite --outdir=css css/*.css \
     && esbuild --minify --allow-overwrite --outdir=js js/*.js \
     && oxipng --opt max --strip safe *.png \
-    && svgo icon.svg
+    && svgo --recursive --folder .
 
 # Export stage: `docker build --target assets-export --output <dir>` writes the
 # minified static files to <dir> for local inspection.
@@ -47,8 +53,13 @@ COPY ./Packages/Web/Package.swift ./Packages/Web/
 COPY ./Services/Website/Package.swift ./Services/Website/Package.resolved ./Services/Website/
 RUN swift package --package-path ./Services/Website resolve
 
-# Copy entire repo into container
-COPY . .
+# Copy only the Swift inputs needed for a release build. Static assets are built
+# in the assets stage and copied into staging after the binary is produced.
+COPY ./Packages/Localization/Sources ./Packages/Localization/Sources
+COPY ./Packages/Persistence/Sources ./Packages/Persistence/Sources
+COPY ./Packages/Web/Sources ./Packages/Web/Sources
+COPY ./Services/Website/Sources ./Services/Website/Sources
+COPY ./Services/Website/Tests ./Services/Website/Tests
 
 # Build the application, with optimizations, with static linking, and using jemalloc
 RUN swift build --package-path ./Services/Website -c release \
@@ -68,10 +79,9 @@ RUN cp "/usr/libexec/swift/linux/swift-backtrace-static" ./
 # Copy resources bundled by SPM to staging area
 RUN find -L "$(swift build --package-path /build/Services/Website -c release --show-bin-path)/" -regex '.*\.resources$' -exec cp -Ra {} ./ \;
 
-# Copy the static files directory (served by FileMiddleware) if it exists
-RUN [ -d /build/Services/Website/Resources ] && mv /build/Services/Website/Resources ./Resources || true
-
-# Overwrite the static files with the minified copies from the assets stage
+# Create the static files directory (served by FileMiddleware) and fill it with
+# the minified copies from the assets stage
+RUN mkdir -p ./Resources/Static
 COPY --from=assets /static ./Resources/Static
 
 # Ensure that by default, neither the directory nor any of its contents are writable.
@@ -89,6 +99,7 @@ RUN export DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
     && apt-get -q install -y \
       libjemalloc2 \
       ca-certificates \
+      curl \
       tzdata \
 # If your app or its dependencies import FoundationNetworking, also install `libcurl4`.
       # libcurl4 \
diff --git a/Services/Website/README.md b/Services/Website/README.md
index 7e410c7..ccaa62c 100644
--- a/Services/Website/README.md
+++ b/Services/Website/README.md
@@ -166,6 +166,8 @@ DATABASE_DRIVER=mysql make site-mount   # run the site against MariaDB
 ### Health checks
 `GET /health` is a liveness check (process is up, no dependency check). `GET /health/ready` is a readiness check that runs `SELECT 1` against the database and returns `200` when reachable or `503` otherwise — so an orchestrator restarts on liveness failure but only withholds traffic on readiness failure.
 
+`docker-compose.yml` configures the `website` container healthcheck against `GET /health`, so Compose reports process liveness without coupling container health to database reachability.
+
 ## Testing
 ```sh
 make pkg-test
@@ -201,13 +203,15 @@ docker compose -f docker-compose.yml up -d
 ```
 
 ### Static assets
-The image build optimizes the files under `Resources/Static` in its `assets` stage, in place:
+The image build optimizes the files under `Resources/Static` in its `assets` stage, in place, with pinned optimizer versions so asset output is reproducible for a given Dockerfile commit:
 - CSS and JS are minified with [esbuild](https://esbuild.github.io).
 - PNG images are losslessly recompressed with [oxipng](https://github.com/oxipng/oxipng) — the output is pixel-identical, only encoded smaller.
 - The SVG icon is minified with [svgo](https://github.com/svg/svgo).
 
 Files keep their names and paths, so the URLs derived from the `StaticFile` enumeration are unaffected. The sources in the repository stay readable and unminified: a direct `swift run` serves them as-is, while any image build — including the local `make site-mount` one, which builds the same Dockerfile — serves the optimized copies.
 
+The Dockerfile copies only package manifests and Swift source inputs into the release build stage. Static assets are copied from the separate `assets` stage after the binary is built, so editing a CSS/JS/image file does not invalidate the release binary build cache.
+
 Preview the optimized output locally — requires only Docker and writes to the git-ignored `.build/minified`:
 ```sh
 make ast-minify
diff --git a/Services/Website/Sources/App/Extensions/App+Build.swift b/Services/Website/Sources/App/Extensions/App+Build.swift
index 1096740..45814b8 100644
--- a/Services/Website/Sources/App/Extensions/App+Build.swift
+++ b/Services/Website/Sources/App/Extensions/App+Build.swift
@@ -140,7 +140,12 @@ private func router(
     logLevel: Logger.Level,
     probe: Probe
 ) -> Router<AppRequestContext> {
-    let router = Router(context: AppRequestContext.self)
+    // HEAD siblings are generated for every GET route, so uptime monitors and crawlers probing
+    // with HEAD requests get the page's status and headers instead of a 404.
+    let router = Router(
+        context: AppRequestContext.self,
+        options: .autoGenerateHeadEndpoints
+    )
 
     router.addMiddleware {
         LogRequestsMiddleware(logLevel)
diff --git a/Services/Website/Sources/Library/Internal/Protocols/Page.swift b/Services/Website/Sources/Library/Internal/Protocols/Page.swift
index e05eb45..e8bc515 100644
--- a/Services/Website/Sources/Library/Internal/Protocols/Page.swift
+++ b/Services/Website/Sources/Library/Internal/Protocols/Page.swift
@@ -47,9 +47,11 @@ extension Page {
     }
 
     /// The metadata, ``stylesheets``, icon, and manifest links placed in the document head.
+    ///
+    /// The charset declaration is omitted: Elementary's `HTMLDocument` scaffolding already
+    /// emits `<meta charset="UTF-8">` before this markup, and HTML5 allows only one.
     @HTMLBuilder
     var head: some HTML {
-        meta(.charset(.utf8))
         meta(
             .name(.viewport),
             .content("width=device-width, initial-scale=1")
diff --git a/Services/Website/Tests/App/AppTests.swift b/Services/Website/Tests/App/AppTests.swift
index 23fe521..1b45edb 100644
--- a/Services/Website/Tests/App/AppTests.swift
+++ b/Services/Website/Tests/App/AppTests.swift
@@ -48,6 +48,22 @@ struct AppTests {
         }
     }
 
+    @Test
+    func `landing page to answer a head request`() async throws {
+        try await app(
+            staticFilesPath: staticFilesPath
+        ).test(.router) { client in
+            try await client.execute(
+                uri: "/",
+                method: .head
+            ) { response in
+                #expect(response.status == .ok)
+                #expect(response.headers[.contentType] == "text/html; charset=utf-8")
+                #expect(response.body.readableBytes == 0)
+            }
+        }
+    }
+
     @Test
     func `health check to be served at the health path`() async throws {
         try await app(
diff --git a/Services/Website/docker-compose.yml b/Services/Website/docker-compose.yml
index 81c40d5..0aa0ffb 100644
--- a/Services/Website/docker-compose.yml
+++ b/Services/Website/docker-compose.yml
@@ -31,3 +31,9 @@ services:
       DATABASE_USERNAME: ${DATABASE_USERNAME:-loud-ams}
       DATABASE_PASSWORD: ${DATABASE_PASSWORD:-}
       DATABASE_TLS: ${DATABASE_TLS:-require}
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:8080/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s