diff --git a/Dockerfile b/Dockerfile
index 76ba78e..301aa0f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,5 @@
 # Base images pinned to exact patch for reproducible builds. Floating `:10.0` tags
-# drift; a stale/pre-GA SDK base silently drops the Blazor framework static assets
-# (blazor.web.js) from the publish manifest → 404 in production. Bump deliberately.
-#
-# SDK 10.0.300 (feature band 3xx) reintroduced exactly that regression: it published
-# an endpoints manifest without blazor.web.js, so MapStaticAssets 404'd the boot
-# script and the whole app rendered static (no interactive circuit on any page).
-# Feature band 2xx publishes blazor.web.js correctly (verified locally with 10.0.204);
-# MCR's newest 2xx image is 10.0.203, used below. Pairs with the 10.0.8 runtime.
+# drift between machines; bump deliberately. (SDK 10.0.203 + runtime 10.0.8.)
 FROM mcr.microsoft.com/dotnet/aspnet:10.0.8 AS base
 WORKDIR /app
 EXPOSE 8080
@@ -20,7 +13,13 @@ WORKDIR /src
 COPY ["SharepointToolbox.Web.csproj", "."]
 RUN dotnet restore
 COPY . .
-RUN dotnet publish -c Release -o /app/publish --no-restore
+# Do NOT add --no-restore here. The restore above runs with only the .csproj present
+# (no source, no wwwroot); pairing that cached state with `publish --no-restore`
+# silently drops the Blazor framework static assets (wwwroot/_framework/blazor.web.js)
+# from the output → the boot script 404s and no interactive circuit starts on any page.
+# Letting publish restore against the full project re-materializes them. (Reproduced;
+# the early restore above is kept only to cache the NuGet layer.)
+RUN dotnet publish -c Release -o /app/publish
 
 FROM base AS final
 WORKDIR /app