diff --git a/backend-rs/.gitignore b/backend-rs/.gitignore
index fedaa2b..47720e7 100644
--- a/backend-rs/.gitignore
+++ b/backend-rs/.gitignore
@@ -1,2 +1,6 @@
 /target
 .env
+
+# Not vendored: the embedded common-passwords list is fetched at build time
+# (see Dockerfile). A local copy lives here only for native `cargo build` dev.
+/assets
diff --git a/backend-rs/Dockerfile b/backend-rs/Dockerfile
index fc1c7b3..4add609 100644
--- a/backend-rs/Dockerfile
+++ b/backend-rs/Dockerfile
@@ -7,7 +7,7 @@ WORKDIR /build
 # reqwest uses rustls (no OpenSSL), but pkg-config/ca-certs are still handy for
 # the build; sqlite is bundled via libsqlite3-sys, no system lib needed.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends pkg-config ca-certificates \
+    && apt-get install -y --no-install-recommends pkg-config ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 
 # Cache dependencies separately from source: copy manifests, build a stub, then
@@ -17,9 +17,20 @@ RUN mkdir src && echo 'fn main() {}' > src/main.rs \
     && cargo build --release \
     && rm -rf src
 
-# Real sources (assets/ carries the embedded common-passwords list).
+# Fetch the common-passwords list at build time instead of vendoring it in git.
+# It's Django 5.2's `common-passwords.txt.gz`, embedded via include_bytes! in
+# src/password_policy.rs. The checksum is verified, so an upstream change (or a
+# moved branch ref) fails the build loudly rather than silently shipping a
+# different list. Bump the tag + DJANGO_PASSWORDS_SHA256 together to update it.
+ARG DJANGO_PASSWORDS_TAG=5.2
+ARG DJANGO_PASSWORDS_SHA256=3c1baed62596de36860824eb3f436d5932d37ca8b06e59df78f5a44ec175afe4
+RUN mkdir -p assets \
+    && curl -fsSL -o assets/common-passwords.txt.gz \
+       "https://raw.githubusercontent.com/django/django/${DJANGO_PASSWORDS_TAG}/django/contrib/auth/common-passwords.txt.gz" \
+    && echo "${DJANGO_PASSWORDS_SHA256}  assets/common-passwords.txt.gz" | sha256sum -c -
+
+# Real sources.
 COPY src ./src
-COPY assets ./assets
 # Touch so cargo sees main.rs as newer than the stub build above.
 RUN touch src/main.rs && cargo build --release \
     && strip target/release/holy_backend_rs