diff --git a/.dockerignore b/.dockerignore
index 5717c3d..93bb0e5 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,7 @@
 .git
-.github
+# .github is NOT ignored: the test suite asserts on the refresh workflows, and
+# the image build runs that suite as its gate. It reaches the build stage only —
+# the runtime stage copies nothing but public/ and serve.ts.
 .gitlab-ci.yml
 node_modules
 public
diff --git a/Dockerfile b/Dockerfile
index 591c210..06fe86d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,6 +24,10 @@ COPY fixtures ./fixtures
 # served fresh, with nothing to say why.
 COPY snapshots ./snapshots
 COPY test ./test
+# The suite asserts on the refresh workflows — three defects that live in YAML
+# and fail silently — so the files have to be here for `bun test` below to mean
+# the same thing it means in CI.
+COPY .github ./.github
 
 # Fail the image on a type error or a failing test rather than shipping it.
 RUN bun run typecheck && bun test