diff --git a/deploy/.dockerignore b/deploy/.dockerignore
new file mode 100644
index 0000000..16ad94a
--- /dev/null
+++ b/deploy/.dockerignore
@@ -0,0 +1,48 @@
+# deploy/.dockerignore — prune the build context for `docker buildx build`
+# invocations against deploy/Dockerfile. Without this, the context would
+# ship target/ (~5 GB on warm dev), .git/, docs/, .github/, etc. — minutes
+# of pointless context-transfer before the first RUN step.
+#
+# IMPORTANT: patterns are relative to the build context root (the path
+# passed to `docker buildx build`, which is the repo root for this Dockerfile
+# since we use `-f deploy/Dockerfile .`). So `target/` matches
+# /target/ at the repo root AND `**/target/` catches /crates/*/target/.
+
+# Rust build artifacts.
+target/
+**/target/
+
+# Git history + CI configuration.
+.git/
+.github/
+
+# Editor + agent working state.
+.vscode/
+.idea/
+.opencode/
+*.swp
+*.swo
+.DS_Store
+
+# Environment files (never ship secrets — .env.example is the ONLY .env*
+# file that should reach the build context, and it has no secrets by design).
+.env
+.env.local
+.env.*.local
+
+# Documentation (the Dockerfile doesn't read any .md file but README).
+docs/
+*.md
+!README.md
+
+# Plans + specs (not needed at image build time — operator reads from the
+# repo, not the container).
+docs/superpowers/
+
+# Logs + OS junk.
+*.log
+tmp/
+*.tmp
+
+# Tmp artifacts from cargo-deny / cargo-cache.
+deny.toml.lock