diff --git a/Dockerfile b/Dockerfile
index df0156d7..318240fd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,11 +38,17 @@ RUN if [ -f /tmp/corpca/corp-root-ca.pem ]; then \
         cp /tmp/corpca/corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt && \
         update-ca-certificates; \
     fi
-ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt
 
 # Copy only the manifests first so `npm ci` caches on dependency changes.
 COPY frontend/package*.json ./frontend/
-RUN cd frontend && npm ci
+# Trust the corp CA for npm's TLS only when it was actually installed above. The
+# guard keeps NODE_EXTRA_CA_CERTS unset on a clean checkout (no cert), so Node
+# does not warn about a missing cert path; a proxy-inspected build still gets
+# the cert because the file is present.
+RUN if [ -f /usr/local/share/ca-certificates/corp-root-ca.crt ]; then \
+        export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt; \
+    fi; \
+    cd frontend && npm ci
 
 # The frontend keeps its repo-relative layout here, because npm prebuild runs
 # `node ../scripts/stage-frontend.mjs`, which stages each plugin's frontend/ into
@@ -54,7 +60,10 @@ COPY scripts/stage-frontend.mjs ./scripts/
 COPY plugins/ ./plugins/
 
 COPY frontend/ ./frontend/
-RUN cd frontend && npm run build
+RUN if [ -f /usr/local/share/ca-certificates/corp-root-ca.crt ]; then \
+        export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt; \
+    fi; \
+    cd frontend && npm run build
 # Output lands in /build/frontend/dist (Vite default), copied into the final
 # stage below.