diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..062184c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+.git
+.gitignore
+.venv
+node_modules
+__pycache__
+*.py[cod]
+.env
+.env.*
+static/dist
+README.md
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7e5fcf1
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1
+
+FROM --platform=$BUILDPLATFORM oven/bun:1.3.13-alpine AS frontend-builder
+
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY frontend ./frontend
+COPY vite.config.js ./
+RUN bun run build
+
+
+FROM ghcr.io/astral-sh/uv:0.9.5-python3.12-bookworm-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    PATH="/app/.venv/bin:$PATH"
+
+WORKDIR /app
+
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev
+
+RUN useradd --create-home --uid 10001 appuser
+
+COPY --chown=appuser:appuser app.py ./
+COPY --chown=appuser:appuser templates ./templates
+COPY --chown=appuser:appuser static/assets ./static/assets
+COPY --from=frontend-builder --chown=appuser:appuser /app/static/dist ./static/dist
+
+USER appuser
+
+EXPOSE 8000
+
+CMD ["gunicorn", "--bind", "0.0.0.0:8000", "--workers", "2", "--threads", "4", "--access-logfile", "-", "--error-logfile", "-", "app:app"]
diff --git a/pyproject.toml b/pyproject.toml
index ab90a71..b3f4958 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,6 +4,7 @@ version = "1.0.0"
 requires-python = ">=3.10"
 dependencies = [
     "flask>=3.0,<4.0",
+    "gunicorn>=23.0,<24.0",
     "pyjwt>=2.8,<3.0",
 ]
 
diff --git a/uv.lock b/uv.lock
index ad6a4d7..36a41e4 100644
--- a/uv.lock
+++ b/uv.lock
@@ -37,6 +37,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7f/9c/34f6962f9b9e9c71f6e5ed806e0d0ff03c9d1b0b2340088a0cf4bce09b18/flask-3.1.3-py3-none-any.whl", hash = "sha256:f4bcbefc124291925f1a26446da31a5178f9483862233b23c0c96a20701f670c", size = 103424, upload-time = "2026-02-19T05:00:56.027Z" },
 ]
 
+[[package]]
+name = "gunicorn"
+version = "23.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/34/72/9614c465dc206155d93eff0ca20d42e1e35afc533971379482de953521a4/gunicorn-23.0.0.tar.gz", hash = "sha256:f014447a0101dc57e294f6c18ca6b40227a4c90e9bdb586042628030cba004ec", size = 375031, upload-time = "2024-08-10T20:25:27.378Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/7d/6dac2a6e1eba33ee43f318edbed4ff29151a49b5d37f080aad1e6469bca4/gunicorn-23.0.0-py3-none-any.whl", hash = "sha256:ec400d38950de4dfd418cff8328b2c8faed0edb0d517d3394e457c317908ca4d", size = 85029, upload-time = "2024-08-10T20:25:24.996Z" },
+]
+
 [[package]]
 name = "itsdangerous"
 version = "2.2.0"
@@ -143,18 +155,29 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
 ]
 
+[[package]]
+name = "packaging"
+version = "26.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/fa/3944b40b07da9ce895c0e6303a5ab7d53da063554f534556b134a54d6093/packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79", size = 313412, upload-time = "2026-08-04T18:15:28.737Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c", size = 129956, upload-time = "2026-08-04T18:15:27.159Z" },
+]
+
 [[package]]
 name = "passport-access-pass"
 version = "1.0.0"
 source = { virtual = "." }
 dependencies = [
     { name = "flask" },
+    { name = "gunicorn" },
     { name = "pyjwt" },
 ]
 
 [package.metadata]
 requires-dist = [
     { name = "flask", specifier = ">=3.0,<4.0" },
+    { name = "gunicorn", specifier = ">=23.0,<24.0" },
     { name = "pyjwt", specifier = ">=2.8,<3.0" },
 ]