diff --git a/backend/Dockerfile b/backend/Dockerfile
index d64be92..6b6b4b9 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -5,6 +5,7 @@ WORKDIR /app
 ENV PRISMA_SKIP_POSTINSTALL_GENERATE=true
 ENV PRISMA_ENGINES_MIRROR=https://registry.npmmirror.com/-/binary/prisma
 ENV DISABLE_OPENCOLLECTIVE=1
+ENV npm_config_cache=/tmp/npm-cache
 
 # Optional: Use Nexus as npm registry (pass --build-arg NPM_REGISTRY=http://nexus:8081/repository/npm/)
 ARG NPM_REGISTRY=
@@ -15,9 +16,16 @@ RUN if [ -n "$NPM_REGISTRY" ]; then \
     fi
 
 COPY package*.json ./
-RUN http_proxy=http://172.17.0.1:8888 https_proxy=http://172.17.0.1:8888 DISABLE_OPENCOLLECTIVE=1 npm ci --prefer-offline --no-audit
+# npm ci: NO proxy so it talks directly to Nexus; no_proxy prevents accidental proxy routing
+RUN no_proxy="172.17.0.2,172.17.0.3,localhost,127.0.0.1" \
+    NO_PROXY="172.17.0.2,172.17.0.3,localhost,127.0.0.1" \
+    DISABLE_OPENCOLLECTIVE=1 \
+    npm ci --prefer-offline --no-audit --maxsockets 4
 COPY . .
-RUN http_proxy=http://172.17.0.1:8888 https_proxy=http://172.17.0.1:8888 ./node_modules/.bin/prisma generate && npm run build
+# prisma generate needs internet for engine binary -> use VPN proxy
+RUN http_proxy=http://172.17.0.1:8888 https_proxy=http://172.17.0.1:8888 \
+    no_proxy="172.17.0.2,172.17.0.3,localhost,127.0.0.1" \
+    ./node_modules/.bin/prisma generate && npm run build
 
 FROM node:20-alpine
 USER root