diff --git a/Makefile b/Makefile
index f20c786..0f171d2 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,8 @@
 
 .PHONY: bootstrap dev dev-web dev-desktop \
         build test test-e2e lint lint-fix typecheck check \
-        ci-web ci-desktop smoke-docker install help
+        ci-web ci-desktop smoke-docker \
+        compose-up compose-up-prod compose-down install help
 
 help:
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS=":.*?## "}; {printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'
@@ -50,5 +51,14 @@ ci-desktop: ## CI: cargo-check for @openconcho/desktop
 smoke-docker: ## Local: build the image + smoke-test the /api proxy (Docker required)
 	bash docker/smoke-test.sh
 
+compose-up: ## Run the web container from source (builds; dev-forward) at :8080
+	docker compose up -d --build
+
+compose-up-prod: ## Run the web container from the published image (pulls latest)
+	docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+
+compose-down: ## Stop and remove the web container
+	docker compose down --remove-orphans
+
 install: ## pnpm install (no playwright)
 	pnpm install
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
new file mode 100644
index 0000000..bb3dd75
--- /dev/null
+++ b/docker-compose.prod.yml
@@ -0,0 +1,11 @@
+# Production override — pull the published image instead of building from source.
+# Layer it on top of docker-compose.yml; it reuses every setting there (env, ports,
+# extra_hosts) and only swaps the local build for the latest published image.
+#
+#   make compose-up-prod
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+services:
+  openconcho:
+    build: !reset null
+    image: ghcr.io/offendingcommit/openconcho-web:latest
+    pull_policy: always
diff --git a/docker-compose.yml b/docker-compose.yml
index 15ee4f7..fb689cb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,25 +1,25 @@
-# Run OpenConcho's web UI with `docker compose up`.
+# OpenConcho web UI — DEV-FORWARD compose (builds from THIS repo).
 #
-# Standalone: serves the SPA on http://localhost:8080. The browser issues all
-# Honcho calls same-origin to /api; nginx forwards each to the URL named in the
-# per-request X-Honcho-Upstream header (no browser CORS). Seed the first instance
-# with OPENCONCHO_DEFAULT_HONCHO_URL — override for anything else:
+#   make compose-up        # build from source + run        → http://localhost:8080
+#   make compose-up-prod   # pull the published image instead (see docker-compose.prod.yml)
+#   make compose-down      # stop + remove
 #
-#   OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net docker compose up
+# The SPA issues all Honcho calls same-origin to /api; nginx forwards each to the
+# URL named in the per-request X-Honcho-Upstream header (no browser CORS). Seed the
+# first instance with OPENCONCHO_DEFAULT_HONCHO_URL:
 #
-# To fold this into an existing Honcho Compose stack, drop the `openconcho`
-# service into that project, set OPENCONCHO_DEFAULT_HONCHO_URL to the api service
-# (e.g. http://api:8000 — nginx resolves it on the compose network), and add
-# `depends_on: { api: { condition: service_healthy } }`.
+#   OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make compose-up
+#
+# To fold into an existing Honcho Compose stack, set OPENCONCHO_DEFAULT_HONCHO_URL
+# to the api service (e.g. http://api:8000 — nginx resolves it on the compose
+# network) and add `depends_on: { api: { condition: service_healthy } }`.
 services:
   openconcho:
-    image: ghcr.io/offendingcommit/openconcho-web:latest
-    # Or build from this repo instead of pulling the published image:
-    # build: .
+    build: .
+    image: openconcho-web:local
     environment:
-      # The SPA seeds its first instance from this absolute URL; the browser then
-      # routes all calls same-origin through /api, and nginx forwards them to the
-      # URL named per-request in the X-Honcho-Upstream header (no browser CORS).
+      # Absolute URL seeding the first instance; the browser sends it as the
+      # X-Honcho-Upstream header and nginx forwards there (no browser CORS).
       OPENCONCHO_DEFAULT_HONCHO_URL: ${OPENCONCHO_DEFAULT_HONCHO_URL:-http://host.docker.internal:8000}
       # Optional SSRF guard. Unset = forward anywhere (safe for the localhost-only
       # binding below). Set comma-separated host globs before exposing the proxy: