diff --git a/Dockerfile b/Dockerfile
index 60ae4a0..0a29511 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -75,7 +75,7 @@ WORKDIR /app
 
 # Copy standalone output and static files (Monorepo paths)
 # Note: Base image already handles the non-root user and basic env
-COPY --from=builder --chown=1001:65533 /app/apps/web/public ./public
+COPY --from=builder --chown=1001:65533 /app/apps/web/public ./apps/web/public
 COPY --from=builder --chown=1001:65533 /app/apps/web/.next/standalone ./
 COPY --from=builder --chown=1001:65533 /app/apps/web/.next/static ./apps/web/.next/static
 
diff --git a/docker-compose.yml b/docker-compose.yml
index d4329dc..f902f6e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -26,7 +26,7 @@ services:
       - "caddy.reverse_proxy={{upstreams 3000}}"
 
       # Public Router (Whitelist for OG Images, Sitemaps, Health)
-      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
+      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*") || PathRegexp(".*\\.(png|jpg|jpeg|webp|svg|ico|pdf|mp4|webm|woff2)$"))'
       - "traefik.http.routers.${PROJECT_NAME}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls=${TRAEFIK_TLS:-false}"