diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5a747a3..0434c1d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -171,6 +171,69 @@ jobs:
             web/test-results
           if-no-files-found: ignore
 
+  docker-build:
+    name: Docker — backend + web images
+    runs-on: ubuntu-latest
+    needs: [backend, web]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Checkout common-plat (for @bytelyst/* packages)
+        uses: actions/checkout@v4
+        with:
+          repository: saravanakumardb1/learning_ai_common_plat
+          path: learning_ai_common_plat
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Link common-platform workspace path
+        run: |
+          mkdir -p ../learning_ai
+          ln -sfn "$GITHUB_WORKSPACE/learning_ai_common_plat" ../learning_ai/learning_ai_common_plat
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Enable pnpm
+        run: corepack enable
+
+      - name: Install common-platform dependencies
+        working-directory: learning_ai_common_plat
+        run: pnpm install --frozen-lockfile
+
+      - name: Prepare Docker tarball dependencies
+        run: COMMON_PLAT="$GITHUB_WORKSPACE/learning_ai_common_plat" bash scripts/docker-prep.sh
+
+      - name: Build backend image
+        env:
+          GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
+        run: |
+          printf '%s' "${GITEA_NPM_TOKEN:-}" > /tmp/gitea_npm_token
+          DOCKER_BUILDKIT=1 docker build \
+            --secret id=gitea_npm_token,src=/tmp/gitea_npm_token \
+            -f backend/Dockerfile \
+            -t notelett-backend:ci \
+            .
+
+      - name: Build web image
+        env:
+          GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
+        run: |
+          printf '%s' "${GITEA_NPM_TOKEN:-}" > /tmp/gitea_npm_token
+          DOCKER_BUILDKIT=1 docker build \
+            --secret id=gitea_npm_token,src=/tmp/gitea_npm_token \
+            --build-arg NEXT_PUBLIC_NOTES_API_URL=http://localhost:4016/api \
+            --build-arg NEXT_PUBLIC_PLATFORM_SERVICE_URL=http://localhost:4003/api \
+            -f web/Dockerfile \
+            -t notelett-web:ci \
+            .
+
+      - name: Restore Docker prep changes
+        if: always()
+        run: bash scripts/docker-prep.sh --restore
+
   mobile:
     name: Mobile — lint + typecheck + test
     runs-on: ubuntu-latest
diff --git a/scripts/docker-prep.sh b/scripts/docker-prep.sh
index d233273..b508a37 100755
--- a/scripts/docker-prep.sh
+++ b/scripts/docker-prep.sh
@@ -10,7 +10,10 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-COMMON_PLAT="${REPO_DIR}/../learning_ai_common_plat"
+COMMON_PLAT="${COMMON_PLAT:-${REPO_DIR}/../learning_ai/learning_ai_common_plat}"
+if [[ ! -d "$COMMON_PLAT" && -d "${REPO_DIR}/../learning_ai_common_plat" ]]; then
+  COMMON_PLAT="${REPO_DIR}/../learning_ai_common_plat"
+fi
 
 TARBALL_DIR="${REPO_DIR}/.docker-deps"
 
@@ -27,6 +30,12 @@ if [[ "${1:-}" == "--restore" ]]; then
 fi
 
 # ── Pack mode ──────────────────────────────────────────────────────
+if [[ ! -d "$COMMON_PLAT" ]]; then
+  echo "Common platform checkout not found: $COMMON_PLAT" >&2
+  echo "Set COMMON_PLAT=/path/to/learning_ai_common_plat or place it at ../learning_ai/learning_ai_common_plat." >&2
+  exit 1
+fi
+
 echo "=== docker-prep: packing @bytelyst/* tarballs ==="
 
 rm -rf "$TARBALL_DIR"
@@ -70,8 +79,19 @@ rewrite_package_json() {
 
   while IFS='=' read -r pkg_name tarball; do
     [[ -z "$pkg_name" ]] && continue
-    # Replace "^0.1.0" (or any semver) with "file:../.docker-deps/<tarball>"
-    sed -i '' "s|\"${pkg_name}\": \"[^\"]*\"|\"${pkg_name}\": \"file:${rel_prefix}.docker-deps/${tarball}\"|g" "$tmp"
+    node -e "
+      const fs = require('fs');
+      const file = process.argv[1];
+      const pkgName = process.argv[2];
+      const replacement = process.argv[3];
+      const p = JSON.parse(fs.readFileSync(file, 'utf8'));
+      for (const section of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+        if (p[section] && Object.prototype.hasOwnProperty.call(p[section], pkgName)) {
+          p[section][pkgName] = replacement;
+        }
+      }
+      fs.writeFileSync(file, JSON.stringify(p, null, 2) + '\n');
+    " "$tmp" "$pkg_name" "file:${rel_prefix}.docker-deps/${tarball}"
   done < "$TARBALL_MAP_FILE"
 
   mv "$tmp" "$pkg_file"