diff --git a/worker/Dockerfile b/worker/Dockerfile
index 0d09f63..f491446 100644
--- a/worker/Dockerfile
+++ b/worker/Dockerfile
@@ -1,24 +1,31 @@
-FROM node:20
+### Multi-stage build: compile TypeScript in a builder image, produce a smaller runtime image
 
-# Create app directory
+FROM node:20 AS builder
 WORKDIR /usr/src/app
 
-# Install dependencies first (copy package files)
+# Copy package manifests and install all deps (including dev) for build
 COPY package.json package-lock.json ./
-
-# Install full dependencies so `tsx` can run worker/index.ts
 RUN npm ci --silent
 
-# Copy only required directories to keep image smaller
-COPY worker ./worker
-COPY lib ./lib
-COPY node_modules ./node_modules
-COPY .env* ./
-COPY tsconfig.json ./
+# Copy project files and compile TypeScript output to `dist/`
+COPY . .
+# Try to compile the project; if there is no TS config for worker, keep files as-is
+RUN npx tsc -p tsconfig.json --outDir dist || echo "tsc exit code ignored"
+
+FROM node:20-alpine AS runner
+WORKDIR /usr/src/app
+
+# Install only production dependencies
+COPY package.json package-lock.json ./
+RUN npm ci --production --silent
+
+# Copy compiled output from builder (if present) and essential runtime files
+COPY --from=builder /usr/src/app/dist ./dist
+COPY --from=builder /usr/src/app/worker ./worker
+COPY --from=builder /usr/src/app/lib ./lib
+COPY --from=builder /usr/src/app/.env* ./ || true
 
 ENV NODE_ENV=production
 
-# Set working directory to repo root; worker is invoked by npm script
-WORKDIR /usr/src/app
-
-CMD ["npm", "run", "worker:start"]
+# If compiled JS exists, run compiled entrypoint; otherwise fallback to tsx runtime
+CMD ["sh", "-c", "if [ -f ./dist/worker/index.js ]; then node ./dist/worker/index.js; else npx tsx ./worker/index.ts; fi"]
diff --git a/worker/README.md b/worker/README.md
index 88e763e..b8021c1 100644
--- a/worker/README.md
+++ b/worker/README.md
@@ -6,6 +6,36 @@ Build context
 - Build path: `worker/` (Dokploy should use this path so the worker Dockerfile is found)
 - Dockerfile: `worker/Dockerfile`
 
+Two-stage build (recommended)
+-----------------------------
+- This repository includes a two-stage Dockerfile that compiles TypeScript in a builder stage and produces a smaller runtime image.
+- The builder stage runs `npx tsc -p tsconfig.json --outDir dist` and the runtime stage will run the compiled `dist/worker/index.js` if present. If compilation is not performed, the container falls back to running `npx tsx ./worker/index.ts`.
+
+Recommended Dokploy settings
+----------------------------
+- Provider: `Gitea`
+- Repository: `ahmido/tenantpilot` (or your repo)
+- Branch: `development`
+- Build path: `worker/`
+- Watch paths: `worker/**`, `lib/**`, `package.json`, `package-lock.json`
+
+Notes
+-----
+- The Dockerfile attempts to run compiled JS first; if no compiled output is present the runtime falls back to `tsx`.
+- If Dokploy requires a separate webhook per app, use the worker webhook URL provided in this repo's docs/workflow.
+
+Notes on environment
+--------------------
+- Ensure Dokploy provides `REDIS_URL` in the environment for the worker container.
+- Provide Azure AD secrets in Dokploy environment vars: `AZURE_AD_TENANT_ID`, `AZURE_AD_CLIENT_ID`, `AZURE_AD_CLIENT_SECRET`.
+Worker container and Dokploy settings
+====================================
+
+Build context
+-------------
+- Build path: `worker/` (Dokploy should use this path so the worker Dockerfile is found)
+- Dockerfile: `worker/Dockerfile`
+
 Recommended Dokploy settings
 ----------------------------
 - Provider: `Gitea`