diff --git a/docker/php/Dockerfile b/docker/php/Dockerfile
index a7beb6d..2939ba9 100644
--- a/docker/php/Dockerfile
+++ b/docker/php/Dockerfile
@@ -2,6 +2,8 @@ FROM php:8.3-apache
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libzip-dev libicu-dev libonig-dev default-mysql-client gettext-base \
+        libpng-dev libjpeg-dev libfreetype6-dev \
+    && docker-php-ext-configure gd --with-jpeg --with-freetype \
     && docker-php-ext-install pdo_mysql mysqli mbstring gd zip intl sockets exif opcache \
     && a2enmod rewrite \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
diff --git a/docker/php/apache-vhost.conf b/docker/php/apache-vhost.conf
new file mode 100644
index 0000000..1a732fe
--- /dev/null
+++ b/docker/php/apache-vhost.conf
@@ -0,0 +1,23 @@
+# Serves the app at the vhost root instead of under /wms-app/.
+# Mounted over the image's default site by docker-compose.override.yml.
+<VirtualHost *:80>
+	DocumentRoot /var/www/html/wms-app
+
+	<Directory /var/www/html/wms-app>
+		Options -Indexes +FollowSymLinks
+		AllowOverride All
+		Require all granted
+	</Directory>
+
+	# Never serve deploy artefacts or seeders over HTTP.
+	<FilesMatch "^(\.env|docker-compose(\.override)?\.yml|.*\.log|setup\.php|demo_seed.*\.php|finish-deploy\.sh)$">
+		Require all denied
+	</FilesMatch>
+
+	# nginx terminates TLS upstream; let PHP know the real scheme so the app
+	# does not emit http:// URLs into an https page.
+	SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on
+
+	ErrorLog ${APACHE_LOG_DIR}/error.log
+	CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
diff --git a/sdlc-delivery.zip b/sdlc-delivery.zip
index 382c083..6120050 100644
Binary files a/sdlc-delivery.zip and b/sdlc-delivery.zip differ