diff --git a/.dockerignore b/.dockerignore
index 2f0cdc62..8b01bd9c 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1 +1,7 @@
-/docker-compose.yml
\ No newline at end of file
+/docker-compose.yml
+
+# Runtime-generated replication bootstrap snapshots may contain infrastructure
+# metadata and encrypted/plaintext credential material. They must be
+# supplied at runtime via mounted storage, not baked into deployment images.
+/services/nginx/app/storage/replication-bootstrap.json
+/services/nginx/app/storage/replication-bootstrap-*.json
diff --git a/Dockerfile.coolify-api b/Dockerfile.coolify-api
index e768acf4..09637c19 100644
--- a/Dockerfile.coolify-api
+++ b/Dockerfile.coolify-api
@@ -51,6 +51,7 @@ COPY services/coolify/api/nginx.conf /etc/nginx/nginx.conf
 COPY services/coolify/api/start.sh /usr/local/bin/coolify-api-start
 
 RUN set -eux; \
+    rm -f /var/www/html/storage/replication-bootstrap.json /var/www/html/storage/replication-bootstrap-*.json; \
     sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh /usr/local/bin/coolify-api-start; \
     chmod +x /usr/local/bin/docker-entrypoint.sh /usr/local/bin/coolify-api-start; \
     COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction -d /var/www/html; \