diff --git a/.github/workflows/deploy-docker.yml b/.github/workflows/deploy-docker.yml
index 8489d7c..d770728 100644
--- a/.github/workflows/deploy-docker.yml
+++ b/.github/workflows/deploy-docker.yml
@@ -48,6 +48,9 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          build-args: |
+            VITE_BE_API_URL=https://imphnen.asepharyana.my.id
+            VITE_BE_WS_URL=wss://imphnen.asepharyana.my.id
 
   deploy:
     needs: build-and-push
@@ -115,9 +118,6 @@ jobs:
                 image: ghcr.io/${OWNER:-mytheclipse}/bete-frontend:latest
                 container_name: imphenbot-frontend
                 restart: unless-stopped
-                environment:
-                  VITE_API_URL: https://imphnen.asepharyana.my.id
-                  VITE_WS_URL: wss://imphnen.asepharyana.my.id
                 labels:
                   - "traefik.enable=true"
                   - "traefik.http.routers.imphenbot-frontend.rule=Host(`imphnen.asepharyana.my.id`)"
diff --git a/infra/docker/Dockerfile.frontend b/infra/docker/Dockerfile.frontend
index 289acfc..19de9b1 100644
--- a/infra/docker/Dockerfile.frontend
+++ b/infra/docker/Dockerfile.frontend
@@ -1,5 +1,8 @@
 FROM node:22-alpine
 
+ARG VITE_BE_API_URL
+ARG VITE_BE_WS_URL
+
 WORKDIR /app
 
 # Install pnpm
@@ -16,10 +19,10 @@ COPY services/frontend ./services/frontend
 # Install dependencies
 RUN pnpm install --frozen-lockfile
 
-# Build frontend
-RUN pnpm --filter './services/frontend' run build
+# Build frontend (env vars injected at build time)
+RUN VITE_BE_API_URL=${VITE_BE_API_URL} VITE_BE_WS_URL=${VITE_BE_WS_URL} pnpm --filter './services/frontend' run build
 
-# Expose port (served by backend)
+# Expose port
 EXPOSE 3000
 
 # Start frontend (production preview)