diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 08f5271..2b9fb5d 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Login to registry
         run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login registry.lunarfront.tech -u ryan --password-stdin
 
-      - name: Build and push
+      - name: Build and push backend
         run: |
           VERSION=${{ steps.version.outputs.version }}
           SHA=$(git rev-parse --short HEAD)
@@ -76,11 +76,24 @@ jobs:
             -t registry.lunarfront.tech/ryan/lunarfront-app:$VERSION \
             -t registry.lunarfront.tech/ryan/lunarfront-app:$SHA \
             -t registry.lunarfront.tech/ryan/lunarfront-app:latest \
-            .
+            -f Dockerfile .
           docker push registry.lunarfront.tech/ryan/lunarfront-app:$VERSION
           docker push registry.lunarfront.tech/ryan/lunarfront-app:$SHA
           docker push registry.lunarfront.tech/ryan/lunarfront-app:latest
 
+      - name: Build and push frontend
+        run: |
+          VERSION=${{ steps.version.outputs.version }}
+          SHA=$(git rev-parse --short HEAD)
+          docker build \
+            -t registry.lunarfront.tech/ryan/lunarfront-frontend:$VERSION \
+            -t registry.lunarfront.tech/ryan/lunarfront-frontend:$SHA \
+            -t registry.lunarfront.tech/ryan/lunarfront-frontend:latest \
+            -f Dockerfile.frontend .
+          docker push registry.lunarfront.tech/ryan/lunarfront-frontend:$VERSION
+          docker push registry.lunarfront.tech/ryan/lunarfront-frontend:$SHA
+          docker push registry.lunarfront.tech/ryan/lunarfront-frontend:latest
+
       - name: Logout
         if: always()
         run: docker logout registry.lunarfront.tech
diff --git a/Dockerfile.frontend b/Dockerfile.frontend
new file mode 100644
index 0000000..1da2545
--- /dev/null
+++ b/Dockerfile.frontend
@@ -0,0 +1,24 @@
+FROM oven/bun:1.3.11-alpine AS deps
+WORKDIR /app
+COPY package.json bun.lock ./
+COPY packages/shared/package.json packages/shared/
+COPY packages/admin/package.json packages/admin/
+RUN bun install --frozen-lockfile
+
+FROM oven/bun:1.3.11-alpine AS build
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/packages/shared/node_modules ./packages/shared/node_modules
+COPY --from=deps /app/packages/admin/node_modules ./packages/admin/node_modules
+COPY packages/shared ./packages/shared
+COPY packages/admin ./packages/admin
+COPY package.json ./
+COPY tsconfig.base.json ./
+WORKDIR /app/packages/admin
+RUN bun run build
+
+FROM nginx:alpine
+COPY --from=build /app/packages/admin/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/Dockerfile.frontend.dockerignore b/Dockerfile.frontend.dockerignore
new file mode 100644
index 0000000..23dbfcb
--- /dev/null
+++ b/Dockerfile.frontend.dockerignore
@@ -0,0 +1,11 @@
+node_modules
+.git
+.gitea
+docs
+planning
+deploy
+infra
+packages/backend
+Dockerfile*
+docker-compose*
+*.md
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..a217ca2
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,29 @@
+server {
+    listen 80;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Proxy API and WebDAV to backend
+    location /v1/ {
+        proxy_pass http://localhost:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /webdav/ {
+        proxy_pass http://localhost:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # SPA fallback — all other routes serve index.html
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}