diff --git a/.dockerignore b/.dockerignore
index d2098ebad7..5cbbce7aee 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -20,6 +20,8 @@ build/*
 .ruff_cache
 .agents
 .claude/skills/
+.claude/worktrees/
+.worktrees/
 .claude-*
 collections/
 .env
diff --git a/.gitignore b/.gitignore
index d2098ebad7..5cbbce7aee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,8 @@ build/*
 .ruff_cache
 .agents
 .claude/skills/
+.claude/worktrees/
+.worktrees/
 .claude-*
 collections/
 .env
diff --git a/Makefile b/Makefile
index e08a2a1888..b400a0d679 100644
--- a/Makefile
+++ b/Makefile
@@ -260,7 +260,7 @@ compose-system-purge: compose-entity-purge
 
 .PHONY: compose-up
 # Start the development stack.
-compose-up: install
+compose-up: install fix-dockerignore
 	@"$${PYTHON}" -m cli.administration.deploy.development up
 
 .PHONY: console
diff --git a/tests/lint/repository/test_dockerignore.py b/tests/lint/repository/test_dockerignore.py
new file mode 100644
index 0000000000..81df725641
--- /dev/null
+++ b/tests/lint/repository/test_dockerignore.py
@@ -0,0 +1,31 @@
+import re
+import unittest
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parents[3]
+NESTED_CHECKOUTS = (".claude/worktrees/", ".worktrees/")
+
+
+class TestDockerignore(unittest.TestCase):
+    def test_dockerignore_is_the_gitignore(self) -> None:
+        self.assertEqual(
+            (PROJECT_ROOT / ".gitignore").read_text(),
+            (PROJECT_ROOT / ".dockerignore").read_text(),
+            "Run 'make fix-dockerignore': .dockerignore must be a copy of .gitignore.",
+        )
+
+    def test_nested_checkouts_stay_out_of_the_build_context(self) -> None:
+        lines = (PROJECT_ROOT / ".dockerignore").read_text().splitlines()
+        for entry in NESTED_CHECKOUTS:
+            with self.subTest(entry=entry):
+                self.assertIn(entry, lines)
+
+    def test_compose_up_regenerates_the_dockerignore(self) -> None:
+        makefile = (PROJECT_ROOT / "Makefile").read_text()
+        match = re.search(r"^compose-up:(.*)$", makefile, re.MULTILINE)
+        self.assertIsNotNone(match, "Makefile has no compose-up target")
+        self.assertIn("fix-dockerignore", match.group(1).split())
+
+
+if __name__ == "__main__":
+    unittest.main()