diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..50e4b2fc
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+node_modules
+**/node_modules
+dist
+**/dist
+target
+**/target
+.claude
+vendored
+**/vendored
+*.log
+.git
diff --git a/Dockerfile.proxy b/Dockerfile.proxy
new file mode 100644
index 00000000..b44ae3f1
--- /dev/null
+++ b/Dockerfile.proxy
@@ -0,0 +1,18 @@
+# syntax=docker/dockerfile:1
+# The stateless send proxy for web.yaak.app. Builds only crates-server/yaak-send-proxy
+# (over yaak-http), so no plugins/Node. Binds a fixed 8080; Railway routes to it.
+
+FROM rust:1-bookworm AS build
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config libssl-dev protobuf-compiler && rm -rf /var/lib/apt/lists/*
+COPY . .
+RUN cargo build --release -p yaak-send-proxy
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/target/release/yaak-send-proxy /usr/local/bin/yaak-send-proxy
+ENV YAAK_PROXY_BIND=0.0.0.0:8080
+EXPOSE 8080
+CMD ["yaak-send-proxy"]
diff --git a/Dockerfile.web b/Dockerfile.web
new file mode 100644
index 00000000..6ba7515d
--- /dev/null
+++ b/Dockerfile.web
@@ -0,0 +1,20 @@
+# syntax=docker/dockerfile:1
+# web.yaak.app — the browser Yaak client, built static and served by Caddy.
+FROM node:22-slim AS build
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends git python3 make g++ ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+COPY . .
+RUN git init -q && git add -A \
+    && git -c user.email=build@yaak.app -c user.name=build commit -qm build
+# Build-time: which send proxy the tab talks to (baked into the bundle by Vite).
+ARG VITE_YAAK_SEND_PROXY_URL
+ENV VITE_YAAK_SEND_PROXY_URL=$VITE_YAAK_SEND_PROXY_URL
+ENV YAAK_TARGET=web
+ENV SKIP_WASM_BUILD=1
+RUN npm ci
+RUN node_modules/.bin/vp -C apps/yaak-client build
+
+FROM caddy:2-alpine
+COPY deploy/web/Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist/apps/yaak-client /srv
diff --git a/deploy/web/Caddyfile b/deploy/web/Caddyfile
new file mode 100644
index 00000000..809688c9
--- /dev/null
+++ b/deploy/web/Caddyfile
@@ -0,0 +1,8 @@
+:{$PORT}
+root * /srv
+encode gzip zstd
+try_files {path} /index.html
+file_server
+@assets path /assets/*
+header @assets Cache-Control "public, max-age=31536000, immutable"
+header /index.html Cache-Control "no-cache"