diff --git a/src/.dockerignore b/src/.dockerignore
new file mode 100644
index 00000000..ba8390f9
--- /dev/null
+++ b/src/.dockerignore
@@ -0,0 +1,33 @@
+# Build contexts for the Tracker images (tracker-web, tracker-api, tracker-gateway)
+# are this `src/` directory. Keep the context small and hermetic: every image
+# restores its own dependencies and builds from source inside the build, so host
+# build outputs and installed modules must never leak in.
+
+# Node / Nx
+**/node_modules
+dist
+.nx
+tmp
+.angular
+coverage
+playwright-report
+test-output
+**/*.tsbuildinfo
+
+# .NET build outputs (the tracker-api image restores + publishes from source)
+**/bin
+**/obj
+**/*.user
+
+# VCS / editor / OS
+.git
+.gitignore
+.vs
+.vscode
+.idea
+**/.DS_Store
+
+# Local env files must not be baked into images
+**/.env
+**/.env.*
+!**/.env.example
diff --git a/src/apps/tracker-web/Dockerfile b/src/apps/tracker-web/Dockerfile
index 0a4d99b7..47136933 100644
--- a/src/apps/tracker-web/Dockerfile
+++ b/src/apps/tracker-web/Dockerfile
@@ -6,10 +6,11 @@
 #   docker build -f apps/tracker-web/Dockerfile -t evolith-tracker-web:local src/
 #
 # The SPA reads its BFF base URL from VITE_TRACKER_BFF_BASE_URL at BUILD time
-# (import.meta.env). We default it to the relative path `/api`, and nginx (see
-# nginx.conf) proxies `/api` → the tracker-api service, so the same image works
-# in any cluster without rebuilding. Override VITE_TRACKER_BFF_BASE_URL as a
-# build-arg to bake an absolute URL instead.
+# (import.meta.env). We default it to the relative path `/api/v1` — the tracker-api
+# business surface is versioned under /api/v1 (CD-32), which is also the SPA's own
+# code default — and nginx (see nginx.conf) proxies `/api` → the tracker-api service,
+# so the same image works in any cluster without rebuilding. Override
+# VITE_TRACKER_BFF_BASE_URL as a build-arg to bake an absolute URL instead.
 # ──────────────────────────────────────────────────────────────────────────
 FROM node:20-alpine AS build
 
@@ -22,7 +23,7 @@ RUN npm ci --legacy-peer-deps
 # Bring in the workspace and build only the web app via the Nx/Vite target.
 COPY . ./
 
-ARG VITE_TRACKER_BFF_BASE_URL=/api
+ARG VITE_TRACKER_BFF_BASE_URL=/api/v1
 ENV VITE_TRACKER_BFF_BASE_URL=${VITE_TRACKER_BFF_BASE_URL}
 
 RUN npx nx build tracker-web --configuration=production \