diff --git a/webui/Dockerfile b/webui/Dockerfile
index 5a47187..88c693c 100644
--- a/webui/Dockerfile
+++ b/webui/Dockerfile
@@ -8,36 +8,59 @@
 # - Mayank Sharma, <mayank.sharma@cern.ch>, 2022
 # - Eraldo Junior <ejunior@cbpf.br>, 2023
 
-FROM almalinux:9
+# ---------- Stage 1: builder (clone repo & install node deps) ----------
+FROM almalinux:9 AS builder
 
 ARG TAG
 
-LABEL stage=production
+ENV NODE_ENV=production
+
 RUN dnf -y update && \
     dnf -y module reset nodejs && \
-    dnf -y module enable nodejs:20 && \
-    dnf -y module install nodejs:20/common && \
-    dnf -y install httpd mod_ssl python39 python-pip git procps patch patchutils && \
-    dnf -y install wget && \
+    dnf -y module enable nodejs:24 && \
+    dnf -y module install nodejs:24/common && \
+    dnf -y install git && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
-RUN python3 -m pip install --no-cache-dir --upgrade pip && \
-    python3 -m pip install --no-cache-dir --upgrade setuptools
-
-COPY j2.py /usr/local/bin/
-RUN python3 -m pip install --no-cache-dir jinja2 && \
-    ln -s j2.py /usr/local/bin/j2
-
 WORKDIR /opt/rucio/webui
 
 ENV RUCIO_WEBUI_PATH=/opt/rucio/webui
 
-RUN curl https://raw.githubusercontent.com/rucio/rucio/master/tools/merge_rucio_configs.py --output /opt/rucio/merge_rucio_configs.py
 RUN git clone --depth 1 -b ${TAG} -- https://github.com/rucio/webui.git ${RUCIO_WEBUI_PATH}
 
 RUN npm i -g pm2
-RUN npm install
+RUN npm install --omit=dev
+
+# Pre-build env-generator so it's ready at runtime (needs dev deps for tsc)
+WORKDIR /opt/rucio/webui/tools/env-generator
+RUN npm install --include=dev && npx tsc --skipLibCheck && cp -rf src/templates dist/
+WORKDIR /opt/rucio/webui
+
+# ---------- Stage 2: runtime ----------
+FROM almalinux:9
+
+LABEL stage=production
+ENV NODE_ENV=production
+
+RUN dnf -y update && \
+    dnf -y module reset nodejs && \
+    dnf -y module enable nodejs:24 && \
+    dnf -y module install nodejs:24/common && \
+    dnf -y install httpd mod_ssl python3 python3-jinja2 procps patch patchutils && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf
+
+COPY j2.py /usr/local/bin/
+RUN ln -s j2.py /usr/local/bin/j2
+
+RUN npm i -g pm2
+
+WORKDIR /opt/rucio/webui
+
+ENV RUCIO_WEBUI_PATH=/opt/rucio/webui
+
+COPY --from=builder /opt/rucio/webui/ /opt/rucio/webui/
 
 COPY docker-entrypoint.sh /
 COPY httpd.conf.j2 /tmp/
@@ -47,4 +70,4 @@ COPY ecosystem.config.js /opt/rucio/webui/ecosystem.config.js
 EXPOSE 443
 EXPOSE 80
 
-ENTRYPOINT ["/docker-entrypoint.sh"]
\ No newline at end of file
+ENTRYPOINT ["/docker-entrypoint.sh"]
diff --git a/webui/docker-entrypoint.sh b/webui/docker-entrypoint.sh
index 58c9aba..aaaa929 100755
--- a/webui/docker-entrypoint.sh
+++ b/webui/docker-entrypoint.sh
@@ -6,20 +6,17 @@ log() {
 
 generate_env_file() {
     cd tools/env-generator
-    npm install
-
-    log "Building env-generator (skipping lib checks to avoid parent node_modules conflicts)..."
-    npx tsc --skipLibCheck && cp -rf src/templates dist/
-    local build_exit=$?
-
-    if [ $build_exit -ne 0 ]; then
-        log "WARNING: Build had errors but checking if output exists..."
-    fi
 
     if [ ! -f ./dist/generate-env.js ]; then
-        log "ERROR: ./dist/generate-env.js was not created by build"
-        cd ../..
-        return 1
+        log "Pre-built env-generator not found, building now..."
+        npm install
+        npx tsc --skipLibCheck && cp -rf src/templates dist/
+
+        if [ ! -f ./dist/generate-env.js ]; then
+            log "ERROR: ./dist/generate-env.js was not created by build"
+            cd ../..
+            return 1
+        fi
     fi
 
     chmod +x ./dist/generate-env.js
@@ -59,7 +56,7 @@ if [ -z "${RUCIO_WEBUI_COMMUNITY_LOGO_URL}" ]; then
     log "Environment variable RUCIO_WEBUI_COMMUNITY_LOGO_URL is not set. The default experiment-icon will be used."
 else
     log "Downloading community logo from ${RUCIO_WEBUI_COMMUNITY_LOGO_URL}"
-    wget -O /opt/rucio/webui/public/experiment-logo.png ${RUCIO_WEBUI_COMMUNITY_LOGO_URL}
+    curl -fsSL -o /opt/rucio/webui/public/experiment-logo.png ${RUCIO_WEBUI_COMMUNITY_LOGO_URL}
 fi
 
 if [ -d "/patch" ]