diff --git a/Dockerfile b/Dockerfile
index eb52e11..f270769 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,11 @@
-# Build image — stays at 1.19.5 until hexpm publishes 1.20.0 stable image.
+# Portal umbrella — Elixir/Phoenix web apps
+# Build image stays at 1.19.5 until hexpm publishes 1.20.0 stable.
 # Dev shell uses 1.20.0-rc.4 via flake.nix.
+#
+# Two image targets:
+#   docker build --target my    -t .../centralcloud-my:VERSION .
+#   docker build --target staff -t .../centralcloud-staff:VERSION .
+
 FROM hexpm/elixir:1.19.5-erlang-28.3.1-debian-trixie-20260202-slim AS build
 
 RUN apt-get update -y && apt-get install -y --no-install-recommends \
@@ -12,25 +18,26 @@ ENV MIX_ENV=prod
 
 RUN mix local.hex --force && mix local.rebar --force
 
-# Umbrella root deps
+# Umbrella root + all sub-app deps files (layer-cache friendly)
 COPY mix.exs mix.lock ./
-COPY apps/centralcloud_core/mix.exs ./apps/centralcloud_core/
-COPY apps/centralcloud_my/mix.exs ./apps/centralcloud_my/
-COPY apps/centralcloud_ops/mix.exs ./apps/centralcloud_ops/
+COPY apps/centralcloud_core/mix.exs   ./apps/centralcloud_core/
+COPY apps/centralcloud_my/mix.exs     ./apps/centralcloud_my/
+COPY apps/centralcloud_staff/mix.exs  ./apps/centralcloud_staff/
 
 RUN mix deps.get --only prod && mix deps.compile
 
-COPY config ./config
-COPY apps/centralcloud_core ./apps/centralcloud_core
-COPY apps/centralcloud_my ./apps/centralcloud_my
+COPY config            ./config
+COPY apps/centralcloud_core   ./apps/centralcloud_core
+COPY apps/centralcloud_my     ./apps/centralcloud_my
+COPY apps/centralcloud_staff  ./apps/centralcloud_staff
+COPY rel               ./rel
 
-RUN mix compile
+RUN mix compile && \
+    mix release centralcloud_my && \
+    mix release centralcloud_staff
 
-# Build release for centralcloud_my only
-COPY rel ./rel
-RUN mix release centralcloud_my
-
-FROM debian:trixie-slim AS app
+# ── Shared runtime base ───────────────────────────────────────────────────────
+FROM debian:trixie-slim AS runtime-base
 
 RUN apt-get update -y && apt-get install -y --no-install-recommends \
     libstdc++6 openssl libncurses6 locales ca-certificates \
@@ -43,12 +50,22 @@ RUN chown app:app /app
 
 USER app
 
+ENV HOME=/app PHX_SERVER=true
+
+# ── centralcloud-my ───────────────────────────────────────────────────────────
+FROM runtime-base AS my
+
 COPY --from=build --chown=app:app /app/_build/prod/rel/centralcloud_my ./
 
-# Convenience symlink for migrate init container
 RUN ln -s /app/bin/centralcloud_my /app/bin/migrate || true
 
-ENV HOME=/app
-ENV PHX_SERVER=true
+CMD ["/app/bin/server"]
+
+# ── centralcloud-staff ────────────────────────────────────────────────────────
+FROM runtime-base AS staff
+
+COPY --from=build --chown=app:app /app/_build/prod/rel/centralcloud_staff ./
+
+RUN ln -s /app/bin/centralcloud_staff /app/bin/migrate || true
 
 CMD ["/app/bin/server"]
diff --git a/config/runtime.exs b/config/runtime.exs
index 04dc990..2c90fae 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -32,3 +32,6 @@ config :centralcloud_core, :oidc,
 config :centralcloud_staff, :router_agent,
   url:     System.get_env("ROUTER_AGENT_URL", "http://router-agent.router-agent.svc:8642"),
   api_key: System.get_env("ROUTER_AGENT_API_KEY", "")
+
+config :centralcloud_staff, :ops_engine,
+  url: System.get_env("OPS_ENGINE_URL", "http://centralcloud-ops.centralcloud-ops.svc.cluster.local")