diff --git a/Dockerfile b/Dockerfile
index 3cc42f4..95d16f8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,8 @@
-# syntax=docker/dockerfile:1.7
-
 FROM node:24-alpine AS api-deps
 WORKDIR /build/api
 
 COPY api/package*.json ./
-RUN --mount=type=cache,target=/root/.npm npm ci
+RUN npm ci
 
 FROM node:24-alpine AS api-build
 WORKDIR /build/api
@@ -21,13 +19,13 @@ WORKDIR /build/api
 ENV NODE_ENV=production
 
 COPY api/package*.json ./
-RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev --ignore-scripts
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM node:24-alpine AS client-deps
 WORKDIR /build/client
 
 COPY client/package*.json ./
-RUN --mount=type=cache,target=/root/.npm npm ci
+RUN npm ci
 
 FROM node:24-alpine AS client-build
 WORKDIR /build/client
@@ -54,80 +52,8 @@ COPY --from=api-build /build/api/dist ./api/dist
 COPY api/package*.json ./api/
 COPY --from=client-build /build/client/dist/client/browser /usr/share/nginx/html
 
-RUN <<'EOF'
-cat > /etc/nginx/http.d/default.conf <<'NGINX'
-server {
-  listen 80;
-  server_name _;
-
-  root /usr/share/nginx/html;
-  index index.html;
-
-  access_log /dev/stdout;
-  error_log /dev/stderr warn;
-
-  gzip on;
-  gzip_comp_level 5;
-  gzip_min_length 1024;
-  gzip_types
-    application/javascript
-    application/json
-    image/svg+xml
-    text/css
-    text/plain;
-
-  location ~* \.(?:css|js|mjs|png|jpg|jpeg|gif|ico|svg|webp|woff2?)$ {
-    access_log off;
-    add_header Cache-Control "public, max-age=31536000, immutable";
-    try_files $uri =404;
-  }
-
-  location ~ ^/(analytics|auth|strava)(/|$) {
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_pass http://127.0.0.1:3000;
-  }
-
-  location / {
-    add_header Cache-Control "no-store";
-    try_files $uri $uri/ /index.html;
-  }
-}
-NGINX
-
-cat > /etc/supervisord.conf <<'SUPERVISOR'
-[supervisord]
-nodaemon=true
-logfile=/dev/null
-logfile_maxbytes=0
-pidfile=/tmp/supervisord.pid
-
-[program:api]
-directory=/app/api
-command=node dist/main.js
-user=node
-autorestart=true
-stopasgroup=true
-killasgroup=true
-stdout_logfile=/dev/fd/1
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/fd/2
-stderr_logfile_maxbytes=0
-
-[program:nginx]
-command=nginx -g "daemon off;"
-autorestart=true
-stopasgroup=true
-killasgroup=true
-stdout_logfile=/dev/fd/1
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/fd/2
-stderr_logfile_maxbytes=0
-SUPERVISOR
-EOF
+COPY docker/nginx.conf /etc/nginx/http.d/default.conf
+COPY docker/supervisord.conf /etc/supervisord.conf
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
   CMD wget -qO- http://127.0.0.1/ >/dev/null || exit 1
diff --git a/docker/nginx.conf b/docker/nginx.conf
new file mode 100644
index 0000000..4fb1bb8
--- /dev/null
+++ b/docker/nginx.conf
@@ -0,0 +1,40 @@
+server {
+  listen 80;
+  server_name _;
+
+  root /usr/share/nginx/html;
+  index index.html;
+
+  access_log /dev/stdout;
+  error_log /dev/stderr warn;
+
+  gzip on;
+  gzip_comp_level 5;
+  gzip_min_length 1024;
+  gzip_types
+    application/javascript
+    application/json
+    image/svg+xml
+    text/css
+    text/plain;
+
+  location ~* \.(?:css|js|mjs|png|jpg|jpeg|gif|ico|svg|webp|woff2?)$ {
+    access_log off;
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    try_files $uri =404;
+  }
+
+  location ~ ^/(analytics|auth|strava)(/|$) {
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_pass http://127.0.0.1:3000;
+  }
+
+  location / {
+    add_header Cache-Control "no-store";
+    try_files $uri $uri/ /index.html;
+  }
+}
diff --git a/docker/supervisord.conf b/docker/supervisord.conf
new file mode 100644
index 0000000..e422b37
--- /dev/null
+++ b/docker/supervisord.conf
@@ -0,0 +1,27 @@
+[supervisord]
+nodaemon=true
+logfile=/dev/null
+logfile_maxbytes=0
+pidfile=/tmp/supervisord.pid
+
+[program:api]
+directory=/app/api
+command=node dist/main.js
+user=node
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/fd/2
+stderr_logfile_maxbytes=0
+
+[program:nginx]
+command=nginx -g "daemon off;"
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/fd/2
+stderr_logfile_maxbytes=0