diff --git a/warzone/deploy/docker/Dockerfile.caddy b/warzone/deploy/docker/Dockerfile.caddy
new file mode 100644
index 0000000..97d3e5a
--- /dev/null
+++ b/warzone/deploy/docker/Dockerfile.caddy
@@ -0,0 +1,9 @@
+# Caddy with Cloudflare DNS plugin — builds for any arch
+FROM caddy:2-builder AS builder
+
+RUN xcaddy build \
+    --with github.com/caddy-dns/cloudflare
+
+FROM caddy:2
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
diff --git a/warzone/deploy/docker/docker-compose.yml b/warzone/deploy/docker/docker-compose.yml
index b3be844..fc03634 100644
--- a/warzone/deploy/docker/docker-compose.yml
+++ b/warzone/deploy/docker/docker-compose.yml
@@ -9,7 +9,9 @@
 services:
   # ─── Caddy reverse proxy (TLS termination) ───
   caddy:
-    image: ghcr.io/caddy-dns/cloudflare:latest
+    build:
+      context: .
+      dockerfile: Dockerfile.caddy
     restart: unless-stopped
     ports:
       - "80:80"