diff --git a/ui/web/Dockerfile b/ui/web/Dockerfile
index d19df026..c73b2265 100644
--- a/ui/web/Dockerfile
+++ b/ui/web/Dockerfile
@@ -18,8 +18,9 @@ RUN pnpm build
 # ── Stage 2: Serve ──
 FROM nginx:1.27-alpine
 
-# Copy built assets
-COPY --from=builder /app/dist /usr/share/nginx/html
+# Copy built assets — force 0755 so the nginx worker (non-root) can read them
+# regardless of pnpm's build-time umask (see #761).
+COPY --chmod=0755 --from=builder /app/dist /usr/share/nginx/html
 
 # Copy nginx config
 COPY nginx.conf /etc/nginx/conf.d/default.conf