diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index d17ef0b..09418ff 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -39,6 +39,10 @@ COPY apps/pwa/package.json ./apps/pwa/
 RUN pnpm install --frozen-lockfile --prod --filter @familysync/api...
 COPY --from=builder /app/apps/api/dist ./apps/api/dist
 WORKDIR /app/apps/api
+# Enforce production identity — engages the NODE_ENV=production hard guard
+# in devBypass.ts, preventing dev-bypass activation even if DEV_AUTH_BYPASS
+# is accidentally set in the container environment. (D-07)
+ENV NODE_ENV=production
 # PWA static assets built from apps/pwa and served by this API from ./public
 # (single-port deployment for the Pangolin/newt tunnel). serveStatic resolves
 # ./public relative to the runtime CWD, which is this WORKDIR (/app/apps/api).