diff --git a/frontend/web/copy-dist.mjs b/frontend/web/copy-dist.mjs
index 033fe1e..a6ff2ef 100644
--- a/frontend/web/copy-dist.mjs
+++ b/frontend/web/copy-dist.mjs
@@ -2,14 +2,27 @@
 // the Go package can //go:embed it into the single Cyrene binary. It runs as the
 // last step of `npm run build`. The source dist is the canonical build output,
 // so it also serves as the external deploy-override directory.
-import { cp, rm } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+//
+// The destination is wiped first so assets from an older build cannot linger in
+// the binary. internal/webui/dist/.gitkeep is committed because //go:embed
+// all:dist fails to compile when the directory holds no files at all — that is
+// what makes `go build ./...` work in a clean checkout. The wipe may clear build
+// output but never the placeholder, so it is restored on every run, including a
+// failed copy: a bare placeholder still compiles, a missing one breaks the build.
+import { cp, mkdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const src = resolve(here, "dist");
 const dest = resolve(here, "..", "..", "internal", "webui", "dist");
+const placeholder = ".gitkeep";
 
 await rm(dest, { recursive: true, force: true });
-await cp(src, dest, { recursive: true });
+try {
+  await cp(src, dest, { recursive: true });
+} finally {
+  await mkdir(dest, { recursive: true });
+  await writeFile(join(dest, placeholder), "");
+}
 console.log(`webui: copied ${src} -> ${dest}`);
diff --git a/internal/webui/dist/.gitkeep b/internal/webui/dist/.gitkeep
new file mode 100644
index 0000000..e69de29