diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..ac46f85
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,20 @@
+# Git and local tooling
+.git
+.gitignore
+.cursor
+
+# Python caches and local virtualenvs (not copied into image)
+**/.venv
+**/__pycache__
+**/*.py[cod]
+.pytest_cache
+.mypy_cache
+.ruff_cache
+
+# Not used by Dockerfile.server (only COPY python/ and gen/)
+clients/
+deploy/
+
+Makefile
+.env
+.env.*
diff --git a/.github/workflows/docker-server.yml b/.github/workflows/docker-server.yml
new file mode 100644
index 0000000..c23dd7d
--- /dev/null
+++ b/.github/workflows/docker-server.yml
@@ -0,0 +1,38 @@
+name: Docker server image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea container registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.auvem.com
+          username: ${{ secrets.GITEA_REGISTRY_USER }}
+          password: ${{ secrets.GITEA_REGISTRY_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.server
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: |
+            gitea.auvem.com/end-internal/officeconvert-server:${{ github.sha }}
+            gitea.auvem.com/end-internal/officeconvert-server:latest
diff --git a/Dockerfile.server b/Dockerfile.server
index e54b1ab..d6a05d8 100644
--- a/Dockerfile.server
+++ b/Dockerfile.server
@@ -2,20 +2,32 @@ FROM python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
-ENV PYTHONPATH=/app/gen/python:/app/python/packages/officeconvert/src:/app/python/packages/server/src
+# Protobuf/gRPC stubs live outside the venv-installed packages
+ENV PYTHONPATH=/app/gen/python
 
+# libreoffice: soffice (headless PPTX→PDF); poppler-utils: pdftoppm; fonts-dejavu-core: baseline fonts
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libreoffice \
+    libreoffice-impress \
     poppler-utils \
     fonts-dejavu-core \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
+# Hatch (pyproject readme = ../../../README.md) resolves from each package dir; repo root must exist
+COPY README.md /app/README.md
 COPY python /app/python
 COPY gen /app/gen
 
-RUN pip install --no-cache-dir -e /app/python/packages/officeconvert -e /app/python/packages/server
+RUN pip install --no-cache-dir uv
+
+WORKDIR /app/python
+RUN uv sync --frozen --all-packages
+
+ENV PATH="/app/python/.venv/bin:$PATH"
+
+WORKDIR /app
 
 EXPOSE 8080
 
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..96f4503
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,40 @@
+# Prebuilt server image from Gitea registry. For local builds use deploy/docker-compose.yml.
+services:
+  seaweedfs:
+    image: chrislusf/seaweedfs:latest
+    command:
+      - server
+      - -s3
+    environment:
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-minioadmin}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY:-minioadmin}
+    ports:
+      - "8333:8333"
+      - "9333:9333"
+      - "8888:8888"
+    volumes:
+      - seaweedfs_data:/data
+
+  server:
+    image: gitea.auvem.com/end-internal/officeconvert-server:${OFFICECONVERT_IMAGE_TAG:-latest}
+    depends_on:
+      - seaweedfs
+    environment:
+      S3_ENDPOINT: ${S3_ENDPOINT:-seaweedfs:8333}
+      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-localhost:8333}
+      S3_USE_SSL: ${S3_USE_SSL:-false}
+      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-minioadmin}
+      S3_SECRET_KEY: ${S3_SECRET_KEY:-minioadmin}
+      S3_SESSION_TTL_SECONDS: ${S3_SESSION_TTL_SECONDS:-3600}
+      CONVERSION_PPTX_TO_PDF_TIMEOUT_SECONDS: ${CONVERSION_PPTX_TO_PDF_TIMEOUT_SECONDS:-180}
+      CONVERSION_PDF_TO_IMAGES_TIMEOUT_SECONDS: ${CONVERSION_PDF_TO_IMAGES_TIMEOUT_SECONDS:-1800}
+      CONVERSION_PPTX_TO_PDF_BASE_TIMEOUT_SECONDS: ${CONVERSION_PPTX_TO_PDF_BASE_TIMEOUT_SECONDS:-45}
+      CONVERSION_PPTX_TO_PDF_PER_SLIDE_TIMEOUT_SECONDS: ${CONVERSION_PPTX_TO_PDF_PER_SLIDE_TIMEOUT_SECONDS:-3}
+      CONVERSION_PDF_TO_IMAGES_BASE_TIMEOUT_SECONDS: ${CONVERSION_PDF_TO_IMAGES_BASE_TIMEOUT_SECONDS:-30}
+      CONVERSION_PDF_TO_IMAGES_PER_SLIDE_TIMEOUT_SECONDS: ${CONVERSION_PDF_TO_IMAGES_PER_SLIDE_TIMEOUT_SECONDS:-8}
+      CONVERSION_CLEANUP_DELAY_SECONDS: ${CONVERSION_CLEANUP_DELAY_SECONDS:-3600}
+    ports:
+      - "8080:8080"
+
+volumes:
+  seaweedfs_data: