diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 6239dec..d216e3e 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -1,23 +1,32 @@
 #!/usr/bin/env bash
-# Deploy lvmh to alarm over ssh (tailnet). Source is rsynced; compose builds there.
+# Deploy lvmh to alarm over ssh (tailnet). rsync source, build images there,
+# compose up. Requires .env on the remote (created on first run).
 set -euo pipefail
 
 REMOTE="${1:-alarm}"
 REMOTE_DIR="${2:-/zdata/root/dockerFiles/lvmh}"
 
 if ! ssh "$REMOTE" "test -f $REMOTE_DIR/.env" 2>/dev/null; then
-	echo "ERROR: $REMOTE:$REMOTE_DIR/.env missing. Create it first (see .env.example):"
-	echo "  ssh $REMOTE 'mkdir -p $REMOTE_DIR && cat > $REMOTE_DIR/.env' <<EOF
-LVMH_TOKEN=...
-ZAI_RENAUD_API_KEY=...
-EOF"
-	exit 1
+  echo "ERROR: $REMOTE:$REMOTE_DIR/.env missing. Create it first (see .env.example):"
+  echo "  ssh $REMOTE 'mkdir -p $REMOTE_DIR && nano $REMOTE_DIR/.env'"
+  echo "  # LVMH_TOKEN=<random>, ZAI_RENAUD_API_KEY=<key>"
+  exit 1
+fi
+
+# web/dist must exist (daemon serves it)
+if [ ! -f web/dist/index.html ]; then
+  echo "building web/dist first..."
+  (cd web && bun install && bun run build)
 fi
 
 rsync -az --delete \
-	--exclude .git --exclude node_modules --exclude web/dist \
-	--exclude .env --exclude .scratch --exclude .pi \
-	./ "$REMOTE:$REMOTE_DIR/"
+  --exclude .git --exclude node_modules --exclude web/node_modules \
+  --exclude .env --exclude .scratch --exclude .pi --exclude coverage \
+  ./ "$REMOTE:$REMOTE_DIR/"
 
-ssh "$REMOTE" "cd $REMOTE_DIR && docker compose build lvmh && docker compose up -d && docker compose ps"
+echo "building daemon image + worker image on $REMOTE..."
+ssh "$REMOTE" "cd $REMOTE_DIR \
+  && docker build -q -f daemon/Dockerfile -t lvmh-daemon:latest . \
+  && docker build -q -f docker/worker.Dockerfile -t lvmh-worker:latest . \
+  && docker compose up -d && docker compose ps"
 echo "Deployed: http://$REMOTE:8686"
diff --git a/docker-compose.yml b/docker-compose.yml
index ccd8f3f..6a0455b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,6 +20,7 @@ services:
       - lvmh-data:/data
       - .:/app/build:ro # repo checkout (rsynced by deploy.sh)
         # daemon rebuilds lvmh-worker from /app/build/docker/worker.Dockerfile
+      - ./web/dist:/app/web-dist:ro # web UI served from repo checkout
     networks:
       lvmh-net:
         aliases: [lvmh]
diff --git a/docker/worker.Dockerfile b/docker/worker.Dockerfile
index eaa38fa..df7fdf2 100644
--- a/docker/worker.Dockerfile
+++ b/docker/worker.Dockerfile
@@ -11,9 +11,8 @@ RUN apt-get update \
 
 RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
 
-# lvmh plugin: dial-home mirror (built from plugin/lvmh-agent.ts at image build)
-ARG LVMH_PLUGIN=./plugin-placeholder
-COPY ${LVMH_PLUGIN} /root/.pi/agent/extensions/lvmh-agent.ts
+# lvmh plugin: dial-home mirror (built from plugin/ at repo root)
+COPY plugin/lvmh-agent.ts /root/.pi/agent/extensions/lvmh-agent.ts
 COPY docker/worker-models.json /root/.pi/agent/models.json
 COPY docker/bridge /bridge