diff --git a/Proxytrace.Api/Dockerfile b/Proxytrace.Api/Dockerfile
index 88302dee..9057f51b 100644
--- a/Proxytrace.Api/Dockerfile
+++ b/Proxytrace.Api/Dockerfile
@@ -1,4 +1,5 @@
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
+# syntax=docker/dockerfile:1
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
 USER root
 # Pre-create the writable runtime data dirs (Lucene search index, plus the appdata dir
 # that holds generated secrets / the session signing key / the license offline-grace cache)
@@ -29,13 +30,15 @@ ARG APP_VERSION=0.0.0-dev
 # production key. The dev/e2e/perf composes pass the test key; official images pass nothing.
 ARG LICENSE_PUBLIC_KEY=
 WORKDIR /src
-# The Nordstein.Core reference expansion lives in these files, so restore needs them
-# before the project files. Nordstein.Core.sln is what selects source mode (see
-# Directory.Build.props); without it the image would silently restore package mode.
+# Warm the restore cache from just the project files, then bring in the rest of the tree
+# below. Every core/*/*.csproj is copied via a glob (COPY --parents preserves the per-project
+# directories) so the source-mode reference expansion resolves for all core packages and a
+# newly added Nordstein.Core package is picked up automatically instead of silently drifting
+# out of this layer. Nordstein.Core.sln is what selects source mode (see Directory.Build.props);
+# without it the image would silently restore package mode.
 COPY ["Directory.Build.props", "Directory.Build.targets", "nuget.config", "./"]
 COPY ["core/Directory.Build.props", "core/Nordstein.Core.sln", "core/"]
-COPY ["core/Nordstein.Core.Common/Nordstein.Core.Common.csproj", "core/Nordstein.Core.Common/"]
-COPY ["core/Nordstein.Core.Domain/Nordstein.Core.Domain.csproj", "core/Nordstein.Core.Domain/"]
+COPY --parents core/*/*.csproj ./
 COPY ["Proxytrace.Api/Proxytrace.Api.csproj", "Proxytrace.Api/"]
 COPY ["Proxytrace.Application/Proxytrace.Application.csproj", "Proxytrace.Application/"]
 COPY ["Proxytrace.Domain/Proxytrace.Domain.csproj", "Proxytrace.Domain/"]
diff --git a/Proxytrace.Proxy.Api/Dockerfile b/Proxytrace.Proxy.Api/Dockerfile
index 0a05cc53..cd2bfad6 100644
--- a/Proxytrace.Proxy.Api/Dockerfile
+++ b/Proxytrace.Proxy.Api/Dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
 USER root
 # /app/data holds the Data Protection key ring the proxy must read to decrypt the upstream provider
@@ -25,13 +26,15 @@ ARG APP_VERSION=0.0.0-dev
 # production key. The dev/e2e/perf composes pass the test key; official images pass nothing.
 ARG LICENSE_PUBLIC_KEY=
 WORKDIR /src
-# The Nordstein.Core reference expansion lives in these files, so restore needs them
-# before the project files. Nordstein.Core.sln is what selects source mode (see
-# Directory.Build.props); without it the image would silently restore package mode.
+# Warm the restore cache from just the project files, then bring in the rest of the tree
+# below. Every core/*/*.csproj is copied via a glob (COPY --parents preserves the per-project
+# directories) so the source-mode reference expansion resolves for all core packages and a
+# newly added Nordstein.Core package is picked up automatically instead of silently drifting
+# out of this layer. Nordstein.Core.sln is what selects source mode (see Directory.Build.props);
+# without it the image would silently restore package mode.
 COPY ["Directory.Build.props", "Directory.Build.targets", "nuget.config", "./"]
 COPY ["core/Directory.Build.props", "core/Nordstein.Core.sln", "core/"]
-COPY ["core/Nordstein.Core.Common/Nordstein.Core.Common.csproj", "core/Nordstein.Core.Common/"]
-COPY ["core/Nordstein.Core.Domain/Nordstein.Core.Domain.csproj", "core/Nordstein.Core.Domain/"]
+COPY --parents core/*/*.csproj ./
 COPY ["Proxytrace.Proxy.Api/Proxytrace.Proxy.Api.csproj", "Proxytrace.Proxy.Api/"]
 COPY ["Proxytrace.Proxy/Proxytrace.Proxy.csproj", "Proxytrace.Proxy/"]
 COPY ["Proxytrace.Domain/Proxytrace.Domain.csproj", "Proxytrace.Domain/"]
diff --git a/deploy/allinone/Dockerfile b/deploy/allinone/Dockerfile
index f09b52fd..3e26bbe8 100644
--- a/deploy/allinone/Dockerfile
+++ b/deploy/allinone/Dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 # Proxytrace — all-in-one image.
 #
 # The single released image: the whole product in one container.
@@ -48,13 +49,15 @@ ARG APP_VERSION=0.0.0-dev
 # production key. The dev/e2e/perf composes pass the test key; official images pass nothing.
 ARG LICENSE_PUBLIC_KEY=
 WORKDIR /src
-# The Nordstein.Core reference expansion lives in these files, so restore needs them
-# before the project files. Nordstein.Core.sln is what selects source mode (see
-# Directory.Build.props); without it the image would silently restore package mode.
+# Warm the restore cache from just the project files, then bring in the rest of the tree
+# below. Every core/*/*.csproj is copied via a glob (COPY --parents preserves the per-project
+# directories) so the source-mode reference expansion resolves for all core packages and a
+# newly added Nordstein.Core package is picked up automatically instead of silently drifting
+# out of this layer. Nordstein.Core.sln is what selects source mode (see Directory.Build.props);
+# without it the image would silently restore package mode.
 COPY ["Directory.Build.props", "Directory.Build.targets", "nuget.config", "./"]
 COPY ["core/Directory.Build.props", "core/Nordstein.Core.sln", "core/"]
-COPY ["core/Nordstein.Core.Common/Nordstein.Core.Common.csproj", "core/Nordstein.Core.Common/"]
-COPY ["core/Nordstein.Core.Domain/Nordstein.Core.Domain.csproj", "core/Nordstein.Core.Domain/"]
+COPY --parents core/*/*.csproj ./
 COPY ["Proxytrace.Api/Proxytrace.Api.csproj", "Proxytrace.Api/"]
 COPY ["Proxytrace.Proxy.Api/Proxytrace.Proxy.Api.csproj", "Proxytrace.Proxy.Api/"]
 COPY ["Proxytrace.Proxy/Proxytrace.Proxy.csproj", "Proxytrace.Proxy/"]