diff --git a/web/dist/.gitkeep b/web/dist/.gitkeep
index 9e57975..5c863b8 100644
--- a/web/dist/.gitkeep
+++ b/web/dist/.gitkeep
@@ -1,10 +1,6 @@
-# Keeps web/dist present in a fresh clone.
+# Generated by scripts/keep-dist.mjs after every build.
 #
-# //go:embed all:dist in web/embed.go fails to compile if the directory is
-# absent, so a clone with no frontend build could not run `go build` at all.
-# With this file present the build succeeds and the server logs
-# "web UI not embedded; run the frontend build to include it", which is the
-# intended behaviour for someone who only wants the API.
-#
-# `pnpm build` overwrites dist/ with the real bundle; the Dockerfile builds the
-# frontend first and overlays it.
+# Keeps web/dist present so //go:embed all:dist in web/embed.go compiles
+# in a fresh clone, where the frontend has not been built. Without it the
+# server logs "web UI not embedded" and serves the API only, which is the
+# intended behaviour for a clone that has not run `pnpm build`.
diff --git a/web/package.json b/web/package.json
index 4637601..9c35fd7 100644
--- a/web/package.json
+++ b/web/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "vite build",
+    "build": "vite build && node scripts/keep-dist.mjs",
     "preview": "vite preview",
     "check": "svelte-check --tsconfig ./tsconfig.json"
   },
diff --git a/web/scripts/keep-dist.mjs b/web/scripts/keep-dist.mjs
new file mode 100644
index 0000000..583983b
--- /dev/null
+++ b/web/scripts/keep-dist.mjs
@@ -0,0 +1,22 @@
+// Recreates dist/.gitkeep after a build.
+//
+// vite clears outDir (emptyOutDir: true in vite.config.ts), which deletes the
+// tracked placeholder. Without that file present, //go:embed all:dist in
+// web/embed.go fails to compile, so a fresh clone with no frontend build cannot
+// run `go build` at all - and a developer who ran `pnpm build` and then
+// committed the deletion would silently break every clone.
+//
+// Writing it here means the file survives a build instead of needing to be
+// restored by hand every time.
+import { mkdirSync, writeFileSync } from 'node:fs'
+
+mkdirSync('dist', { recursive: true })
+writeFileSync(
+  'dist/.gitkeep',
+  '# Generated by scripts/keep-dist.mjs after every build.\n' +
+    '#\n' +
+    '# Keeps web/dist present so //go:embed all:dist in web/embed.go compiles\n' +
+    '# in a fresh clone, where the frontend has not been built. Without it the\n' +
+    '# server logs "web UI not embedded" and serves the API only, which is the\n' +
+    '# intended behaviour for a clone that has not run `pnpm build`.\n',
+)