diff --git a/vite.config.ts b/vite.config.ts
index 772b272..c9124cc 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,5 +1,5 @@
 import { defineConfig } from "vite";
-import { cpSync, mkdirSync } from "node:fs";
+import { cpSync, mkdirSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 
 const pdfjsAssets = () => ({
@@ -16,6 +16,29 @@ const pdfjsAssets = () => ({
   },
 });
 
+// emptyOutDir must stay false (web/static also holds tracked assets),
+// so hashed chunks from previous builds would otherwise accumulate
+// forever and leak into Docker images via the build context. Remove
+// any *-<hash>.js(.map) that this build did not produce.
+const cleanStaleChunks = () => {
+  const produced = new Set<string>();
+  return {
+    name: "clean-stale-chunks",
+    generateBundle(_options, bundle) {
+      for (const fileName of Object.keys(bundle)) produced.add(fileName);
+    },
+    closeBundle() {
+      const outDir = "web/static";
+      const chunkRe = /-[A-Za-z0-9_-]{8}\.js(\.map)?$/;
+      for (const f of readdirSync(outDir)) {
+        if (chunkRe.test(f) && !produced.has(f)) {
+          rmSync(join(outDir, f));
+        }
+      }
+    },
+  };
+};
+
 export default defineConfig({
   resolve: {
     alias: {
@@ -24,7 +47,7 @@ export default defineConfig({
     },
   },
   base: "/static/",
-  plugins: [pdfjsAssets()],
+  plugins: [pdfjsAssets(), cleanStaleChunks()],
   build: {
     outDir: "web/static",
     emptyOutDir: false,