diff --git a/deploy/build.sh b/deploy/build.sh
new file mode 100644
index 0000000..4d649ed
--- /dev/null
+++ b/deploy/build.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+# Baut die Images für deploy/docker-compose.standalone.yml im Host-Netzwerk.
+#
+# Für Docker in einem LXC-Container ohne NAT für Docker-Bridge-Netze: Build-Schritte (npm, Google Fonts) erreichen
+# das Netz nur über das Host-Netzwerk. Docker Compose kann das per "build.network: host" nicht ohne Weiteres
+# freigeben ("additional privileges requested"), docker build schon. Die Builds laufen nacheinander (schont RAM).
+#
+#   sh deploy/build.sh [env-datei]        # Standard: deploy/.env
+#   docker compose -f deploy/docker-compose.standalone.yml --env-file deploy/.env up -d
+set -eu
+
+cd "$(dirname "$0")/.."
+ENV_FILE="${1:-deploy/.env}"
+[ -f "$ENV_FILE" ] || { echo "build: $ENV_FILE nicht gefunden" >&2; exit 1; }
+
+# Nur die Proxy-Werte lesen, die Datei nicht als Shell-Skript ausführen.
+value() { grep -E "^$1=" "$ENV_FILE" | tail -n 1 | cut -d= -f2- || true; }
+HTTP_PROXY_VALUE="$(value HTTP_PROXY)"
+HTTPS_PROXY_VALUE="$(value HTTPS_PROXY)"
+NO_PROXY_VALUE="$(value NO_PROXY)"
+
+build() {
+  dockerfile="$1"; tag="$2"; shift 2
+  echo "build: $tag"
+  docker build --network host \
+    --build-arg HTTP_PROXY="$HTTP_PROXY_VALUE" --build-arg http_proxy="$HTTP_PROXY_VALUE" \
+    --build-arg HTTPS_PROXY="$HTTPS_PROXY_VALUE" --build-arg https_proxy="$HTTPS_PROXY_VALUE" \
+    --build-arg NO_PROXY="$NO_PROXY_VALUE" --build-arg no_proxy="$NO_PROXY_VALUE" \
+    "$@" -f "$dockerfile" -t "$tag" .
+}
+
+build backend/Dockerfile atm10-stats/backend:latest
+# Next.js löst den /api-Rewrite beim Build auf: Die API läuft auf demselben Host.
+build web/Dockerfile atm10-stats/web:latest --build-arg API_INTERNAL_URL=http://127.0.0.1:3001
+
+echo "build: fertig. Starten mit:"
+echo "  docker compose -f deploy/docker-compose.standalone.yml --env-file $ENV_FILE up -d"
diff --git a/deploy/docker-compose.standalone.yml b/deploy/docker-compose.standalone.yml
index 71cc48f..f40b286 100644
--- a/deploy/docker-compose.standalone.yml
+++ b/deploy/docker-compose.standalone.yml
@@ -5,28 +5,18 @@
 # Netz des LXC-Containers.
 #
 #   cp deploy/.env.example deploy/.env      # Werte eintragen (TRUST_PROXY = IP des Traefik-Servers!)
-#   docker compose -f deploy/docker-compose.standalone.yml --env-file deploy/.env up -d --build
+#   sh deploy/build.sh                       # Images im Host-Netzwerk bauen (nach jedem git pull)
+#   docker compose -f deploy/docker-compose.standalone.yml --env-file deploy/.env up -d
 #
 # Erreichbar auf dem LXC-Container:  web http://<LXC-IP>:3000   api http://<LXC-IP>:3001
 # Die Datenbank lauscht nur auf 127.0.0.1. Traefik-Konfiguration: docs/OPERATIONS.md, "Traefik auf einem anderen Server".
 
 name: atm10-stats
 
-x-proxy-build-args: &proxy-build-args
-  HTTP_PROXY: ${HTTP_PROXY:-}
-  HTTPS_PROXY: ${HTTPS_PROXY:-}
-  NO_PROXY: ${NO_PROXY:-}
-  http_proxy: ${HTTP_PROXY:-}
-  https_proxy: ${HTTPS_PROXY:-}
-  no_proxy: ${NO_PROXY:-}
-
 x-backend: &backend
-  build:
-    context: ..
-    dockerfile: backend/Dockerfile
-    network: host
-    args: *proxy-build-args
+  # built by deploy/build.sh (docker build --network host)
   image: atm10-stats/backend:latest
+  pull_policy: never
   restart: unless-stopped
   network_mode: host
   env_file: ${ENV_FILE:-.env}
@@ -68,15 +58,9 @@ services:
       disable: true
 
   web:
-    build:
-      context: ..
-      dockerfile: web/Dockerfile
-      network: host
-      args:
-        <<: *proxy-build-args
-        # Next.js resolves the /api rewrite at build time: the API is on the same host.
-        API_INTERNAL_URL: http://127.0.0.1:3001
+    # built by deploy/build.sh (docker build --network host)
     image: atm10-stats/web:latest
+    pull_policy: never
     restart: unless-stopped
     network_mode: host
     environment: