diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index 90a37a7..21bba61 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -6,10 +6,12 @@ WORKDIR /repo
 RUN npm install -g pnpm@11
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json ./
 COPY packages/shared ./packages/shared
+COPY packages/plugin-sdk ./packages/plugin-sdk
 COPY apps/api ./apps/api
 COPY deploy/fonts ./deploy/fonts
 RUN pnpm install --frozen-lockfile --filter @dorfteich/api... \
   && pnpm --filter @dorfteich/shared build \
+  && pnpm --filter @dorfteich/plugin-sdk build \
   && pnpm --filter @dorfteich/api build \
   # Bake the self-hosted font catalog in so the PDF exporter can inline a
   # pond's fonts as base64 (ADR 0016). Same download as the web image; fails
@@ -28,10 +30,11 @@ WORKDIR /app
 COPY --from=build --chown=node:node /out /app
 # Generate the Prisma client for this image's platform.
 RUN node node_modules/prisma/build/index.js generate
-# A fresh named volume mounted at /data/uploads is created root-owned;
-# pre-creating it here (Docker copies an image directory's ownership into
-# a new volume on first mount) lets the non-root `node` user write to it.
-RUN mkdir -p /data/uploads && chown -R node:node /data/uploads
+# A fresh named volume mounted at /data/uploads or /data/plugins is created
+# root-owned; pre-creating them here (Docker copies an image directory's
+# ownership into a new volume on first mount) lets the non-root `node` user
+# write to them.
+RUN mkdir -p /data/uploads /data/plugins && chown -R node:node /data/uploads /data/plugins
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=3s --retries=3 \