diff --git a/.dockerignore b/.dockerignore
index 4018f08a..70a02164 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,13 +1,53 @@
-.env
-.venv
+# Git and repository metadata
 .git
 .gitignore
 .dockerignore
-compose.yml
-compose.testing.yml
-.todo
 .github
 .vscode
 .DS_Store
-**/node_modules
+.todo
+
+# Local configuration and secrets
+**/.env
+**/.env.*
+**/routstr_secret.key
+
+# Python environments, caches, and build artifacts
+**/.venv
+**/__pycache__
+**/*.py[cod]
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
+**/.coverage
+**/htmlcov
+**/*.egg-info
+**/build
+**/dist
+
+# Runtime state must never be baked into the image
+logs
+logs.*
+**/*.log
+**/.wallet*
+**/.cashu
+**/*.db
+**/*.db-*
+**/*.sqlite3
+**/*.sqlite3-*
+**/keys
+**/proof_backups
+**/relay-data
+
+# The UI output is built by its own service and mounted at runtime
+ui_out
 ui/.next
+ui/out
+**/node_modules
+
+# Compose and local development files
+compose.yml
+compose.testing.yml
+compose.override.yml
+plans
+.worktrees
diff --git a/tests/unit/test_docker_build_context.py b/tests/unit/test_docker_build_context.py
new file mode 100644
index 00000000..922819ef
--- /dev/null
+++ b/tests/unit/test_docker_build_context.py
@@ -0,0 +1,48 @@
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_backend_docker_context_excludes_generated_and_runtime_state() -> None:
+    patterns = {
+        line.strip()
+        for line in (REPO_ROOT / ".dockerignore").read_text().splitlines()
+        if line.strip() and not line.lstrip().startswith("#")
+    }
+
+    required_patterns = {
+        "**/.env",
+        "**/.env.*",
+        "**/routstr_secret.key",
+        "**/.venv",
+        "**/__pycache__",
+        "**/*.py[cod]",
+        "**/.pytest_cache",
+        "**/.mypy_cache",
+        "**/.ruff_cache",
+        "**/.coverage",
+        "**/htmlcov",
+        "**/*.egg-info",
+        "**/build",
+        "**/dist",
+        "logs",
+        "logs.*",
+        "**/*.log",
+        "**/.wallet*",
+        "**/.cashu",
+        "**/*.db",
+        "**/*.db-*",
+        "**/*.sqlite3",
+        "**/*.sqlite3-*",
+        "**/keys",
+        "**/proof_backups",
+        "**/relay-data",
+        "ui_out",
+        "ui/.next",
+        "ui/out",
+    }
+
+    assert required_patterns <= patterns, (
+        "The backend Docker context must exclude local build artifacts and "
+        f"runtime state; missing patterns: {sorted(required_patterns - patterns)}"
+    )