diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index 5592afb835..615549cf82 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -12,7 +12,8 @@ COPY . .
 RUN --mount=type=cache,id=bun-1.4.0,target=/root/.bun/install/cache bun install --frozen-lockfile
 
 ARG NEXT_PUBLIC_DOCKER_BUILD=true
-ENV NEXT_PUBLIC_WEB_URL=http://localhost:3000
+ARG NEXT_PUBLIC_WEB_URL=http://localhost:3000
+ENV NEXT_PUBLIC_WEB_URL=$NEXT_PUBLIC_WEB_URL
 
 RUN bun run build:web
 
diff --git a/apps/web/content/docs/self-hosting.mdx b/apps/web/content/docs/self-hosting.mdx
index 45219a81bd..1963a0bc8d 100644
--- a/apps/web/content/docs/self-hosting.mdx
+++ b/apps/web/content/docs/self-hosting.mdx
@@ -70,6 +70,14 @@ MYSQL_PASSWORD=your-secure-password
 MINIO_ROOT_PASSWORD=your-minio-password
 ```
 
+**Building your own web image:**
+
+`CAP_URL` is read at runtime by the server, but the browser bundle gets its copy of the public URL baked in at build time from `NEXT_PUBLIC_WEB_URL`. The pre-built `ghcr.io` image bakes `http://localhost:3000`. If you build `apps/web/Dockerfile` yourself, pass your public URL as a build argument so share links, embeds and CORS work in the browser:
+
+```bash
+docker build -f apps/web/Dockerfile --build-arg NEXT_PUBLIC_WEB_URL=https://cap.yourdomain.com .
+```
+
 ### Option 2: Railway (One-Click)
 
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/new/template/PwpGcf)