diff --git a/.dockerignore b/.dockerignore
index 6775392..09c8786 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -10,6 +10,7 @@
 !backup.js
 !reading-analytics.js
 !reading-access.js
+!moments.js
 !public/
 !public/**
 !greatest/
diff --git a/test/dockerfile.test.js b/test/dockerfile.test.js
index 4327071..dbc41e3 100644
--- a/test/dockerfile.test.js
+++ b/test/dockerfile.test.js
@@ -18,5 +18,10 @@ test('every top-level module the reader requires is copied into the image', () =
       else pending.push(name + '.js');
     }
   }
-  for (const file of seen) assert.ok(copied.has(file), `${file} is required but not copied by the Dockerfile`);
+  // .dockerignore is an allowlist too: a file not let through never reaches COPY.
+  const allowed = new Set(fs.readFileSync(path.join(root, '.dockerignore'), 'utf8').split(/\r?\n/).filter(line => line.startsWith('!')).map(line => line.slice(1)));
+  for (const file of seen) {
+    assert.ok(copied.has(file), `${file} is required but not copied by the Dockerfile`);
+    assert.ok(allowed.has(file), `${file} is required but not allowed through .dockerignore`);
+  }
 });