diff --git a/.dockerignore b/.dockerignore
index 4aef71a..078f07d 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -58,3 +58,6 @@ __pycache__/
 # src/ (source code)
 # *.ts, *.js, *.java (source files)
 # docker-compose.yml, Dockerfile, .dockerignore
+# Dependencies (exclude installed, but KEEP package.json and package-lock.json)
+node_modules/
+**/node_modules/
diff --git a/tests/dockerignore.test.mjs b/tests/dockerignore.test.mjs
new file mode 100644
index 0000000..66964dd
--- /dev/null
+++ b/tests/dockerignore.test.mjs
@@ -0,0 +1,11 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import test from 'node:test';
+
+test('root Docker build context excludes installed Node dependencies', async () => {
+  const dockerignore = await readFile(new URL('../.dockerignore', import.meta.url), 'utf8');
+  const patterns = new Set(dockerignore.split(/\r?\n/));
+
+  assert.ok(patterns.has('node_modules/'), 'missing node_modules/ exclusion');
+  assert.ok(patterns.has('**/node_modules/'), 'missing **/node_modules/ exclusion');
+});