diff --git a/.dockerignore b/.dockerignore
index 30d3d533bf..23085f962f 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -61,3 +61,9 @@ packages/paperclip-runner/test-fixtures/pi-acp/**
 !packages/paperclip-runner/src/**/*.test.tsx
 
 packages/grok-acp/bin
+
+# The Copilot build-time identity gate reads these sanitized source declarations.
+!packages/paperclip-runner/test/fixtures/copilot-profile-v*-identity.json
+# Images build their pinned Copilot assets instead of copying host binaries.
+/packages/paperclip-runner/provider-assets/
+/server/provider-assets/