diff --git a/.dockerignore b/.dockerignore
index 8d8d8d71..f67babef 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,6 +5,8 @@
 !packages/
 !packages/cli/
 !packages/cli/package.json
+!packages/cli/scripts/
+!packages/cli/scripts/warm-cache.mjs
 !packages/compiler/
 !packages/compiler/package.json
 !packages/runtime/
diff --git a/Dockerfile.sandbox b/Dockerfile.sandbox
index ad320d3f..3ab8ea0a 100644
--- a/Dockerfile.sandbox
+++ b/Dockerfile.sandbox
@@ -39,6 +39,7 @@ WORKDIR /workspace
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY packages/cli/package.json packages/cli/package.json
+COPY packages/cli/scripts/warm-cache.mjs packages/cli/scripts/warm-cache.mjs
 COPY packages/compiler/package.json packages/compiler/package.json
 COPY packages/runtime/package.json packages/runtime/package.json
 
diff --git a/tests/harness/sandbox-dockerfile.test.ts b/tests/harness/sandbox-dockerfile.test.ts
new file mode 100644
index 00000000..29808741
--- /dev/null
+++ b/tests/harness/sandbox-dockerfile.test.ts
@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, test } from "vitest";
+
+const dockerfile = readFileSync(new URL("../../Dockerfile.sandbox", import.meta.url), "utf8");
+const dockerignore = readFileSync(new URL("../../.dockerignore", import.meta.url), "utf8");
+
+describe("Sandbox Dockerfile", () => {
+  test("copies CLI lifecycle scripts before installing workspace dependencies", () => {
+    const packageIndex = dockerfile.indexOf(
+      "COPY packages/cli/package.json packages/cli/package.json",
+    );
+    const scriptIndex = dockerfile.indexOf(
+      "COPY packages/cli/scripts/warm-cache.mjs packages/cli/scripts/warm-cache.mjs",
+    );
+    const installIndex = dockerfile.indexOf("RUN pnpm install --frozen-lockfile");
+
+    expect(packageIndex).toBeGreaterThanOrEqual(0);
+    expect(scriptIndex).toBeGreaterThan(packageIndex);
+    expect(installIndex).toBeGreaterThan(scriptIndex);
+    expect(dockerignore).toContain("!packages/cli/scripts/");
+    expect(dockerignore).toContain("!packages/cli/scripts/warm-cache.mjs");
+  });
+});