diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..4d07b3aae
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,25 @@
+# Build context for client images is the repo root (see src/apphost/AppHost.cs
+# AddDockerfile calls). Keep the context lean — only src/ sources and
+# .devcontainer/certs are COPYed by src/Dockerfile-client-universal.
+
+# Version control / tooling
+.git/
+.github/
+.vscode/
+.idea/
+
+# Node / frontend
+**/node_modules/
+**/dist/
+
+# .NET build output
+**/bin/
+**/obj/
+**/_db/
+
+# Docs and non-build assets
+docs/
+site/
+experimental/
+src/Ghosts.Api/wwwroot/lib/fontawesome/svgs/
+src/Ghosts.Api/wwwroot/flags/
diff --git a/.gitignore b/.gitignore
index b9a497cb5..bc404e4be 100755
--- a/.gitignore
+++ b/.gitignore
@@ -343,8 +343,6 @@ output/
 .claude/settings.local.json
 src/apphost/n8n_data/*
 src/Ghosts.Api/config/AttackData/enterprise-attack.json
-src/certs/*
-!src/certs/readme.md
 site/*
 site/
 .agents/*
diff --git a/src/Dockerfile-client-universal b/src/Dockerfile-client-universal
index 135fa0395..da0bdbd88 100644
--- a/src/Dockerfile-client-universal
+++ b/src/Dockerfile-client-universal
@@ -2,11 +2,17 @@
 
 FROM mcr.microsoft.com/dotnet/sdk:10.0.101 AS dev
 
-COPY certs/*.crt /usr/local/share/ca-certificates/
-RUN update-ca-certificates
+# Custom Cert Support — single source of truth in .devcontainer/certs.
+# The dir always exists (readme.md is committed); .crt files are gitignored,
+# so tolerate an empty set and only update the trust store when certs are present.
+COPY .devcontainer/certs /usr/local/share/ca-certificates/custom/
+RUN find /usr/local/share/ca-certificates/custom -type f ! -name '*.crt' -delete \
+    && if find /usr/local/share/ca-certificates/custom -type f -name '*.crt' -print -quit | grep -q .; then \
+    update-ca-certificates; \
+    fi
 
-COPY Ghosts.Client.Universal/. /app/Ghosts.Client.Universal
-COPY Ghosts.Domain/. /app/Ghosts.Domain
+COPY src/Ghosts.Client.Universal/. /app/Ghosts.Client.Universal
+COPY src/Ghosts.Domain/. /app/Ghosts.Domain
 
 WORKDIR /app/Ghosts.Client.Universal
 RUN dotnet publish -c Release -o /app/dist
diff --git a/src/apphost/AppHost.cs b/src/apphost/AppHost.cs
index f46e7bb26..8f2f9518e 100644
--- a/src/apphost/AppHost.cs
+++ b/src/apphost/AppHost.cs
@@ -119,21 +119,21 @@
     .WaitFor(postgres);
 
 // GHOSTS Universal Clients (built from source, demo/testing)
-var client1 = builder.AddDockerfile("ghosts-client-1", "../", "Dockerfile-client-universal")
+var client1 = builder.AddDockerfile("ghosts-client-1", "../../", "src/Dockerfile-client-universal")
     .WithContainerName("ghosts-client-1")
     .WithEnvironment("BASE_URL", "http://host.docker.internal:5000/api")
     .WithBindMount("../../configuration/clients/client-1/config", "/app/config", isReadOnly: false)
     .WithLifetime(ContainerLifetime.Persistent)
     .WaitFor(api);
 
-var client2 = builder.AddDockerfile("ghosts-client-2", "../", "Dockerfile-client-universal")
+var client2 = builder.AddDockerfile("ghosts-client-2", "../../", "src/Dockerfile-client-universal")
     .WithContainerName("ghosts-client-2")
     .WithEnvironment("BASE_URL", "http://host.docker.internal:5000/api")
     .WithBindMount("../../configuration/clients/client-2/config", "/app/config", isReadOnly: false)
     .WithLifetime(ContainerLifetime.Persistent)
     .WaitFor(api);
 
-var client3 = builder.AddDockerfile("ghosts-client-3", "../", "Dockerfile-client-universal")
+var client3 = builder.AddDockerfile("ghosts-client-3", "../../", "src/Dockerfile-client-universal")
     .WithContainerName("ghosts-client-3")
     .WithEnvironment("BASE_URL", "http://host.docker.internal:5000/api")
     .WithBindMount("../../configuration/clients/client-3/config", "/app/config", isReadOnly: false)
diff --git a/src/certs/readme.md b/src/certs/readme.md
deleted file mode 100644
index ca440d9c5..000000000
--- a/src/certs/readme.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Devcontainer Certs
-
-Add any necessary certificates to this folder. They will be copied to the container and added to the trusted certificate store on startup. This is useful for development environments that require self-signed certificates or internal CA certificates.