diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 7937eee..8fcebbe 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -17,13 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # ── Build WASM artifacts inside an Emscripten container ──
-      - name: Build WASM
-        uses: docker://emscripten/emsdk:3.1.51
-        with:
-          args: make web
-
-      # ── Build container image and push to Gitea registry ──
+      # ── Build container image (includes WASM build stage) and push ──
       - name: Build and push container image
         run: |
           IMAGE_TAG="${{ env.IMAGE }}:sha-${GITHUB_SHA::8}"
diff --git a/Containerfile b/Containerfile
index cedb234..2d41c4c 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,7 +1,4 @@
-# JNR Web — static file server for the Emscripten build
-#
-# Prerequisites:
-#   make web          (produces dist-web/)
+# JNR Web — multi-stage build: compile WASM then serve static files
 #
 # Build:
 #   podman build -t jnr-web .
@@ -15,9 +12,21 @@
 #   podman save jnr-web | sudo k3s ctr images import -
 #   sudo k3s kubectl apply -f k8s/
 
+# ── Stage 1: Build WASM artifacts ──
+FROM docker.io/emscripten/emsdk:3.1.51 AS builder
+
+WORKDIR /src
+COPY Makefile ./
+COPY include/ include/
+COPY src/ src/
+COPY assets/ assets/
+COPY web/ web/
+RUN make web
+
+# ── Stage 2: Serve static files ──
 FROM docker.io/joseluisq/static-web-server:2
 
-COPY dist-web/ /public/
+COPY --from=builder /src/dist-web/ /public/
 
 # Disable the default cache-control headers which cache .js for 1 year.
 # The .js and .wasm files must always be fetched together (EM_ASM address