diff --git a/openvidu-dashboard/dashboard-ce/docker/AGENTS.md b/openvidu-dashboard/dashboard-ce/docker/AGENTS.md
index 46ef479ad..6d8f045ea 100644
--- a/openvidu-dashboard/dashboard-ce/docker/AGENTS.md
+++ b/openvidu-dashboard/dashboard-ce/docker/AGENTS.md
@@ -2,10 +2,13 @@
 
 - `dashboard-ce/docker/Dockerfile` builds `openvidu/openvidu-dashboard` with `openvidu-dashboard/` as context
   (`.dockerignore` at its root). These rules also apply to images built on these packages.
-- Images run Aikido safe-chain for every package manager call, install with `--frozen-lockfile` and a `--filter`, build
-  the SPA on `$BUILDPLATFORM` with `--base-href "$BASE_HREF"` (default `/`, deployments use `/dashboard/`), purge
-  tzdata, run as uid 1000 and declare a `HEALTHCHECK` through the entry's `healthcheck` argument, which uses
-  `node:http` because `fetch` refuses ports such as 6000.
+- Images run Aikido safe-chain for every package manager call and install with `--frozen-lockfile` and a `--filter`,
+  only in stages on `$BUILDPLATFORM` (`FROM --platform=$BUILDPLATFORM <image>`: on a `FROM` that names a stage the flag
+  is ignored): under emulation its check can outlast its 10 s timeout. A stage that must run per platform (the runtime,
+  or what needs the target's Node) installs nothing and only copies and runs what those stages built. The SPA is built
+  with `--base-href "$BASE_HREF"` (default `/`, deployments use `/dashboard/`). Images purge tzdata, run as uid 1000 and
+  declare a `HEALTHCHECK` through the entry's `healthcheck` argument, which uses `node:http` because `fetch` refuses
+  ports such as 6000.
 - Runtime: `pnpm deploy --prod` of the backend on `node:<24.x.y>-trixie-slim`, without npm, npx and corepack.
 - `smoke-test.sh <image> <budget-mb> [docker run options...]` (`./dashboard.sh smoke-image ce`, 300 MB) checks
   `MONGO_ENABLED=false`, health, `GET /api/healthcheck`, `HEAD /`, uid 1000, `SERVER_PORT`, `docker stop` and the
diff --git a/openvidu-dashboard/dashboard-ce/docker/Dockerfile b/openvidu-dashboard/dashboard-ce/docker/Dockerfile
index 139d21685..bcd431a3c 100644
--- a/openvidu-dashboard/dashboard-ce/docker/Dockerfile
+++ b/openvidu-dashboard/dashboard-ce/docker/Dockerfile
@@ -4,8 +4,9 @@ ARG NODE_VERSION=24.22.1
 ARG DEBIAN_RELEASE=trixie
 ARG SAFE_CHAIN_VERSION=1.5.25
 
-# Workspace manifests and the lockfile, shared by the install stages.
-FROM node:${NODE_VERSION}-${DEBIAN_RELEASE}-slim AS base
+# Workspace manifests and the lockfile, shared by the install stages. They run on the build platform, so no package is
+# installed, nor checked by safe-chain, under emulation; a --platform on a FROM that names a stage would be ignored.
+FROM --platform=$BUILDPLATFORM node:${NODE_VERSION}-${DEBIAN_RELEASE}-slim AS base
 ARG SAFE_CHAIN_VERSION
 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates curl \
@@ -24,14 +25,15 @@ COPY dashboard-ce/frontend/projects/dashboard-ui/package.json dashboard-ce/front
 COPY dashboard-ce/e2e/package.json dashboard-ce/e2e/
 COPY dashboard-ce/tools/data-generator/package.json dashboard-ce/tools/data-generator/
 
-# The SPA does not depend on the architecture: built once, on the build platform.
-FROM --platform=$BUILDPLATFORM base AS frontend
+# The SPA does not depend on the architecture: built once.
+FROM base AS frontend
 ARG BASE_HREF=/
 RUN pnpm install --frozen-lockfile --filter "@openvidu-dashboard/frontend..."
 COPY dashboard-ce/typings dashboard-ce/typings
 COPY dashboard-ce/frontend dashboard-ce/frontend
 RUN BASE_HREF="${BASE_HREF}" pnpm --filter "@openvidu-dashboard/frontend..." run build
 
+# Nor do the backend and its production dependencies, JavaScript only.
 FROM base AS backend
 RUN pnpm install --frozen-lockfile --filter "@openvidu-dashboard/backend..."
 COPY dashboard-ce/typings dashboard-ce/typings