diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e7dd212b..c9d1b4f3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,8 @@
 - Closing Claude Code sessions no longer leaves child processes running ([#1540](https://github.com/getpaseo/paseo/pull/1540) by [@TommyLike](https://github.com/TommyLike))
 - OpenCode no longer indexes your home directory by mistake ([#1704](https://github.com/getpaseo/paseo/pull/1704) by [@rex-chang](https://github.com/rex-chang))
 - ACP sessions load with the correct project folder and MCP server settings ([#1624](https://github.com/getpaseo/paseo/pull/1624) by [@theslava](https://github.com/theslava))
+- Docker images serve the bundled web UI from global installs
+- Docker images can extract downloaded local speech models
 
 ## 0.1.101 - 2026-06-26
 
diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
index 72785eabc..904372610 100644
--- a/docker/base/Dockerfile
+++ b/docker/base/Dockerfile
@@ -27,6 +27,7 @@ RUN set -eux; \
       curl \
       git \
       gosu \
+      lbzip2 \
       openssh-client \
       tini; \
     rm -rf /var/lib/apt/lists/*
diff --git a/docker/base/Dockerfile.source b/docker/base/Dockerfile.source
index 4680ee4be..0c93f08a0 100644
--- a/docker/base/Dockerfile.source
+++ b/docker/base/Dockerfile.source
@@ -48,6 +48,7 @@ RUN set -eux; \
       curl \
       git \
       gosu \
+      lbzip2 \
       openssh-client \
       tini; \
     rm -rf /var/lib/apt/lists/*
diff --git a/docs/docker.md b/docs/docker.md
index 36c36b0b5..c10b67c56 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -10,7 +10,8 @@ The image source lives in [`docker/`](../docker/).
 
 The official image:
 
-- installs `@getpaseo/server` and `@getpaseo/cli` from npm
+- installs `@getpaseo/server` and `@getpaseo/cli` from npm for stable images,
+  or from source-built workspace tarballs for beta images
 - runs the daemon as the non-root `paseo` user
 - listens on `0.0.0.0:6767` inside the container
 - enables the bundled daemon web UI with `PASEO_WEB_UI_ENABLED=true`
@@ -202,10 +203,10 @@ docker build \
 ```
 
 The Docker workflow builds the image on pull requests and on `main` as a
-non-publishing check. GHCR publishing follows the stable release cadence: only a
-stable `vX.Y.Z` tag push publishes `ghcr.io/getpaseo/paseo:X.Y.Z` and
-`ghcr.io/getpaseo/paseo:latest`. Beta tags and manual workflow runs build for
-validation only.
+non-publishing check. Stable `vX.Y.Z` tag pushes publish
+`ghcr.io/getpaseo/paseo:X.Y.Z` and `ghcr.io/getpaseo/paseo:latest`. Beta tags
+publish only the exact prerelease tag, such as
+`ghcr.io/getpaseo/paseo:0.1.102-beta.1`, and do not update `latest`.
 
 The published image is multi-arch for `linux/amd64` and `linux/arm64`.
 
diff --git a/packages/server/src/server/config.test.ts b/packages/server/src/server/config.test.ts
new file mode 100644
index 000000000..1708c76a1
--- /dev/null
+++ b/packages/server/src/server/config.test.ts
@@ -0,0 +1,61 @@
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { describe, expect, test } from "vitest";
+
+import { resolveBundledWebUiDistDir } from "./config.js";
+
+function fileUrlFor(...segments: string[]): URL {
+  return pathToFileURL(path.join(path.parse(process.cwd()).root, ...segments));
+}
+
+describe("server config", () => {
+  test("resolves bundled web UI path from source-tree modules", () => {
+    expect(
+      resolveBundledWebUiDistDir(
+        fileUrlFor("repo", "packages", "server", "src", "server", "config.ts"),
+      ),
+    ).toBe(
+      path.join(
+        path.parse(process.cwd()).root,
+        "repo",
+        "packages",
+        "server",
+        "dist",
+        "server",
+        "web-ui",
+      ),
+    );
+  });
+
+  test("resolves bundled web UI path from globally installed compiled modules", () => {
+    expect(
+      resolveBundledWebUiDistDir(
+        fileUrlFor(
+          "usr",
+          "local",
+          "lib",
+          "node_modules",
+          "@getpaseo",
+          "server",
+          "dist",
+          "server",
+          "server",
+          "config.js",
+        ),
+      ),
+    ).toBe(
+      path.join(
+        path.parse(process.cwd()).root,
+        "usr",
+        "local",
+        "lib",
+        "node_modules",
+        "@getpaseo",
+        "server",
+        "dist",
+        "server",
+        "web-ui",
+      ),
+    );
+  });
+});
diff --git a/packages/server/src/server/config.ts b/packages/server/src/server/config.ts
index d8987bb80..f1e4b4bd8 100644
--- a/packages/server/src/server/config.ts
+++ b/packages/server/src/server/config.ts
@@ -34,6 +34,14 @@ export function resolveBundledWebUiDistDir(moduleUrl: string | URL = import.meta
     return path.resolve(moduleDir, "..", "..", "dist", "server", "web-ui");
   }
 
+  if (
+    path.basename(moduleDir) === "server" &&
+    path.basename(path.dirname(moduleDir)) === "server" &&
+    path.basename(path.dirname(path.dirname(moduleDir))) === "dist"
+  ) {
+    return path.resolve(moduleDir, "..", "web-ui");
+  }
+
   return path.resolve(moduleDir, "web-ui");
 }