diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index b07e8be..96bbb58 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -69,6 +69,8 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          # NOTE: type=gha cache is intentionally omitted. Gitea's act_runner cache
+          # service is not reachable from the buildx container on this instance, so
+          # cache import timed out (~30s) on every run. The Dockerfile's BuildKit
+          # cache mounts still speed up dependency installs within a build.
           platforms: linux/amd64
diff --git a/CLAUDE.md b/CLAUDE.md
index d8a7c92..0125dcc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -112,6 +112,24 @@ npx shadcn@latest add [component-name]
 
 Components are installed to `components/ui/`. Do not manually edit these files; they can be regenerated.
 
+## pnpm / sharp build (CI gotcha)
+
+pnpm 11 hard-fails `pnpm install --frozen-lockfile` with
+`[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: sharp@0.34.5` (exit 1) unless
+sharp's native build script is explicitly accounted for. sharp ships prebuilt
+binaries, so its build script is unnecessary and should stay skipped.
+
+- `pnpm-workspace.yaml` records the decision as `allowBuilds:\n  sharp: false`.
+  This **must be a real boolean** (`false`/`true`). A non-boolean value (e.g. the
+  placeholder string `set this to true or false`) does NOT count as a decision and
+  breaks CI. `onlyBuiltDependencies` / `ignoredBuiltDependencies` are NOT honored
+  for this in pnpm 11 — only `allowBuilds`. Verify before pushing:
+  `git show HEAD:pnpm-workspace.yaml`.
+- Because that value is easy to corrupt, the Docker build is made resilient: the
+  `pnpm install` step in the `Dockerfile` passes `--config.strictDepBuilds=false`,
+  which downgrades the ignored-builds error to a warning regardless of the
+  workspace file. Keep that flag in place.
+
 ## Important Notes
 
 - Contact email: contact@cloudrite.co.nz
diff --git a/Dockerfile b/Dockerfile
index ac7a0a5..3b6db88 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,7 +24,12 @@ RUN --mount=type=cache,target=/root/.npm \
   elif [ -f yarn.lock ]; then \
     corepack enable yarn && yarn install --frozen-lockfile --production=false; \
   elif [ -f pnpm-lock.yaml ]; then \
-    corepack enable pnpm && pnpm install --frozen-lockfile; \
+    # --config.strictDepBuilds=false: pnpm 11 hard-fails (ERR_PNPM_IGNORED_BUILDS)
+    # when a dependency with a build script (e.g. sharp) isn't explicitly approved.
+    # sharp ships prebuilt binaries so its build script is unnecessary; this flag
+    # downgrades the gate to a warning and keeps the build resilient regardless of
+    # pnpm-workspace.yaml's allowBuilds value. See CLAUDE.md "pnpm / sharp build".
+    corepack enable pnpm && pnpm install --frozen-lockfile --config.strictDepBuilds=false; \
   else \
     echo "No lockfile found." && exit 1; \
   fi