diff --git a/canary/.dockerignore b/canary/.dockerignore
new file mode 100644
index 0000000..e156484
--- /dev/null
+++ b/canary/.dockerignore
@@ -0,0 +1,17 @@
+# Keep the build context small. The HF model cache lives at
+# /opt/stacks/doctate-canary/models/ on Minerva — without this exclude,
+# `docker build` ships ~6 GB to the daemon on every run.
+models/
+
+# Not needed inside the image.
+deploy.sh
+*.md
+.git/
+.gitignore
+
+# Python local artifacts.
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+venv/
diff --git a/canary/deploy.sh b/canary/deploy.sh
index 24bf589..dea876e 100755
--- a/canary/deploy.sh
+++ b/canary/deploy.sh
@@ -14,8 +14,13 @@ rsync -av \
   "$LOCAL_DIR/" "$HOST:$REMOTE_DIR/"
 
 echo ">>> Rebuilding + restarting on $HOST"
+# Pre-pull the base image with the Docker engine before `docker build`.
+# Docker's legacy builder hits a TLS cert error on the pull path; pulling
+# first means the build finds the layer in cache and skips that step.
+# Keep this tag in sync with the FROM line in the Dockerfile.
 ssh "$HOST" "cd $REMOTE_DIR && \
   docker compose down && \
+  docker pull nvidia/cuda:12.6.1-devel-ubuntu22.04 && \
   docker build -t doctate-canary . && \
   docker compose up -d"