diff --git a/.dockerignore b/.dockerignore
index b7edad4..87ed4ab 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,7 @@
 .git
-.circleci
+.github
+.DS_Store
+coverage
 log/*
 tmp/*
 !log/.keep
diff --git a/Dockerfile b/Dockerfile
index a96077a..da01235 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 FROM ruby:4.0.4
 
 RUN dpkg --add-architecture i386 \
@@ -19,24 +20,30 @@ RUN dpkg --add-architecture i386 \
     chromium-driver \
   && rm -rf /var/lib/apt/lists/*
 
-RUN gem install bundler -v 2.2.21
-
 WORKDIR /app
 
-COPY Gemfile Gemfile.lock ./
-RUN bundle _2.2.21_ install --jobs=4 --retry=3
+ENV BUNDLE_GEMFILE=/app/Gemfile \
+    BUNDLE_JOBS=4 \
+    BUNDLE_RETRY=3
+
+COPY Gemfile Gemfile.lock .ruby-version ./
+RUN --mount=type=cache,target=/usr/local/bundle/cache,sharing=locked \
+  bundle install
 
 # Dual-boot: Gemfile.next targets the Rails version we're upgrading to.
 # Remove this block (and Gemfile.next / Gemfile.next.lock) once the upgrade lands.
 COPY Gemfile.next Gemfile.next.lock ./
-RUN BUNDLE_GEMFILE=Gemfile.next bundle _2.2.21_ install --jobs=4 --retry=3
+RUN --mount=type=cache,target=/usr/local/bundle/cache,sharing=locked \
+  BUNDLE_GEMFILE=/app/Gemfile.next bundle install
 
-COPY . .
+COPY --chmod=0755 docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 
-COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod +x /usr/local/bin/entrypoint.sh
+COPY . .
 
 EXPOSE 3000
 
+HEALTHCHECK --interval=10s --timeout=3s --start-period=60s --retries=6 \
+  CMD curl -fsS http://localhost:3000/up || exit 1
+
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"]
diff --git a/docker-compose.yml b/docker-compose.yml
index ff7f614..b6b24aa 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -34,12 +34,7 @@ services:
     tty: true
 
   web_next:
-    # Reuse the image built for `web` (compose tags it <project>-web, i.e.
-    # audit-web) instead of building a second image. Only BUNDLE_GEMFILE
-    # differs, so a separate build is unnecessary. (Not using `extends` here:
-    # it merges array fields like `ports` instead of overriding them, which
-    # would leak web's 3000:3000 mapping into this service too.)
-    image: audit-web
+    build: .
     platform: linux/amd64
     # Distinct pidfile: web and web_next share the same bind-mounted /app, so
     # they'd otherwise race on tmp/pids/server.pid and refuse to boot together.
@@ -53,12 +48,12 @@ services:
       DATABASE_HOST: db
       DATABASE_USERNAME: postgres
       DATABASE_PASSWORD: postgres
-      BUNDLE_GEMFILE: Gemfile.next
+      BUNDLE_GEMFILE: /app/Gemfile.next
     depends_on:
       db:
         condition: service_healthy
       web:
-        condition: service_started
+        condition: service_healthy
     stdin_open: true
     tty: true