diff --git a/docker/web.Dockerfile b/docker/web.Dockerfile
index d870141..4f8f5c7 100644
--- a/docker/web.Dockerfile
+++ b/docker/web.Dockerfile
@@ -42,14 +42,18 @@ ENV HOSTNAME=0.0.0.0
 COPY --from=build /app/apps/web/.next/standalone ./
 COPY --from=build /app/apps/web/.next/static ./apps/web/.next/static
 COPY --from=build /app/apps/web/public ./apps/web/public
-# Next's standalone tracer copied packages/shared/dist/*.js but
-# missed their transitive deps — packages/shared/dist/rrule.js does
-# require("rrule") and the rrule node_modules entry never landed in
-# the standalone output (pnpm's symlinked layout often confuses the
-# tracer). Copy the workspace packages' node_modules trees in
-# directly so the require chain resolves at runtime.
-COPY --from=build /app/packages/shared/node_modules ./packages/shared/node_modules
-COPY --from=build /app/packages/db/node_modules ./packages/db/node_modules
+# pnpm's workspace layout: each packages/<pkg>/node_modules/<dep> is a
+# symlink into /app/node_modules/.pnpm/<dep>@<ver>/node_modules/<dep>
+# where the real files live. Copying just packages/<pkg>/node_modules
+# ships dangling symlinks. Bring the .pnpm content store across too so
+# every symlink resolves at runtime; this is what unblocks the
+# `Cannot find module 'rrule'` error from
+# packages/shared/dist/rrule.js. Use --link to deduplicate the layer
+# blobs inside docker so the runtime image stays slim despite the
+# dot-pnpm tree being large.
+COPY --link --from=build /app/node_modules/.pnpm ./node_modules/.pnpm
+COPY --link --from=build /app/packages/shared/node_modules ./packages/shared/node_modules
+COPY --link --from=build /app/packages/db/node_modules ./packages/db/node_modules
 # Reuse the `node` user (UID/GID 1000) that node:alpine ships with —
 # `addgroup -g 1000 app` collided with the pre-existing node group.
 RUN chown -R node:node /app