diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..fffbd75
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+# Build context is the repo root (see mqtt_demo/docker-compose.yml's
+# `context: ..`). The Dockerfile COPYs whole directories (protocol/,
+# ocf/, mqtt_demo/), so anything under them that shouldn't land in the
+# image has to be excluded here explicitly.
+
+# Secrets — never bake these into the image. Mounted at runtime via
+# the /config volume instead.
+**/.env
+certs/
+
+# Local dev cruft.
+**/__pycache__/
+**/*.pyc
+.git/
+.venv/
diff --git a/requirements-bootstrap.txt b/requirements-bootstrap.txt
index 2360d27..a749cc8 100644
--- a/requirements-bootstrap.txt
+++ b/requirements-bootstrap.txt
@@ -1,4 +1,4 @@
 # Setup-only deps for setup_cert.py: shells out to `openssl` for SHA-1
 # signing (independent of python-cryptography's policy) and uses
 # pyOpenSSL for the optional --test DTLS handshake.
--r requirements.txt
+-r mqtt_demo/requirements.txt