diff --git a/Dockerfile b/Dockerfile
index cc9e6b5..d39f88e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,6 +10,15 @@ FROM node:20-alpine AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
+# Public variables are baked into the browser code by `next build`, so they must
+# exist at build time. Ship passes them from .env.local; a name that is not
+# declared here is silently ignored by the build.
+ARG NEXT_PUBLIC_POCKETBASE_URL
+ARG NEXT_PUBLIC_TOMTOM_API_KEY
+ARG NEXT_PUBLIC_QB_INVOICE_WEBHOOK_URL
+ENV NEXT_PUBLIC_POCKETBASE_URL=${NEXT_PUBLIC_POCKETBASE_URL}
+ENV NEXT_PUBLIC_TOMTOM_API_KEY=${NEXT_PUBLIC_TOMTOM_API_KEY}
+ENV NEXT_PUBLIC_QB_INVOICE_WEBHOOK_URL=${NEXT_PUBLIC_QB_INVOICE_WEBHOOK_URL}
 # The commit being built, supplied by Ship. Declared late so the layers above
 # stay cached; it is empty for builds that do not pass it.
 ARG NEXT_PUBLIC_APP_COMMIT