diff --git a/.github/workflows/deploy-ec2.yml b/.github/workflows/deploy-ec2.yml
index 3a9a74d..c7d0216 100644
--- a/.github/workflows/deploy-ec2.yml
+++ b/.github/workflows/deploy-ec2.yml
@@ -27,6 +27,14 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # Next.js embeds NEXT_PUBLIC_* at build time. Create .env from EC2_ENV so the Docker build sees it.
+      - name: Create .env for build
+        run: |
+          cat > .env << 'ENVFILE'
+          ${{ secrets.EC2_ENV }}
+          ENVFILE
+          echo "NEXT_PUBLIC_VAPID_PUBLIC_KEY is set: $(grep -q 'NEXT_PUBLIC_VAPID_PUBLIC_KEY=.' .env && echo yes || echo no)"
+
       - name: Build application image
         uses: docker/build-push-action@v6
         with:
@@ -37,8 +45,6 @@ jobs:
           tags: ${{ env.IMAGE_NAME }}:latest
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          build-args: |
-            NEXT_PUBLIC_VAPID_PUBLIC_KEY=${{ secrets.NEXT_PUBLIC_VAPID_PUBLIC_KEY }}
 
       - name: Save application image
         run: |
diff --git a/Dockerfile b/Dockerfile
index 9057925..f15999b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,14 +9,10 @@ COPY prisma ./prisma
 # Install ALL dependencies (including devDependencies needed for build)
 RUN npm ci && npx prisma generate
 
-# Copy application code
+# Copy application code (includes .env created in CI from EC2_ENV for NEXT_PUBLIC_* at build time)
 COPY . .
 
-# Build-time env vars (NEXT_PUBLIC_* are embedded into the JS bundle)
-ARG NEXT_PUBLIC_VAPID_PUBLIC_KEY
-ENV NEXT_PUBLIC_VAPID_PUBLIC_KEY=$NEXT_PUBLIC_VAPID_PUBLIC_KEY
-
-# Build the Next.js application
+# Build the Next.js application (reads .env and embeds NEXT_PUBLIC_* into the bundle)
 RUN npm run build
 
 # Copy and set up entrypoint script