diff --git a/Dockerfile.web-server b/Dockerfile.web-server
index 956bff88..f5e23db7 100644
--- a/Dockerfile.web-server
+++ b/Dockerfile.web-server
@@ -5,10 +5,14 @@
 
 FROM --platform=$BUILDPLATFORM node:20-bookworm AS frontend
 
-WORKDIR /frontend
+# 使用 monorepo 布局：frontend 源码通过相对路径 ../../../shared/i18n 引用仓库 shared/
+# （见 frontend/src/i18n/catalog.ts、shared/i18n/messages.ts、shared/i18n/translate.ts）。
+# 仅 COPY frontend/ 会导致 tsc 报 Cannot find module '../../../shared/i18n/*'。
+WORKDIR /src/frontend
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci --no-audit --no-fund
 COPY frontend/ ./
+COPY shared/ /src/shared/
 # wailsjs 绑定已入库；容器内只构建静态前端
 RUN npm run build
 
@@ -25,7 +29,7 @@ COPY third_party/go-irisnative/go.mod third_party/go-irisnative/go.sum ./third_p
 RUN go mod download
 
 COPY . .
-COPY --from=frontend /frontend/dist ./frontend/dist
+COPY --from=frontend /src/frontend/dist ./frontend/dist
 
 # 纯 Go 构建主程序（web-server 模式不需要 Wails WebView / CGO）
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
diff --git a/tools/validate-web-server-dockerfile.sh b/tools/validate-web-server-dockerfile.sh
new file mode 100755
index 00000000..11730dd8
--- /dev/null
+++ b/tools/validate-web-server-dockerfile.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Ensure web-server Docker frontend stage can resolve monorepo shared/i18n imports.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DOCKERFILE="${ROOT}/Dockerfile.web-server"
+
+if [[ ! -f "${DOCKERFILE}" ]]; then
+  echo "missing Dockerfile.web-server" >&2
+  exit 1
+fi
+
+fail() {
+  echo "validate-web-server-dockerfile: $*" >&2
+  exit 1
+}
+
+grep -Fq 'WORKDIR /src/frontend' "${DOCKERFILE}" \
+  || fail "expected WORKDIR /src/frontend monorepo layout"
+grep -Fq 'COPY shared/ /src/shared/' "${DOCKERFILE}" \
+  || fail "expected COPY shared/ so frontend ../../../shared/i18n resolves"
+grep -Fq 'COPY --from=frontend /src/frontend/dist ./frontend/dist' "${DOCKERFILE}" \
+  || fail "expected dist copy from /src/frontend/dist"
+
+# Old layout only copied frontend/ and broke catalog/messages/translate imports in CI.
+if grep -Eq '^WORKDIR /frontend$' "${DOCKERFILE}"; then
+  fail "legacy WORKDIR /frontend would break shared/i18n relative imports"
+fi
+if grep -Fq 'COPY --from=frontend /frontend/dist' "${DOCKERFILE}"; then
+  fail "legacy dist path /frontend/dist no longer matches frontend stage"
+fi
+
+# Frontend sources still point outside package root into shared/i18n.
+FRONTEND_CATALOG="${ROOT}/frontend/src/i18n/catalog.ts"
+grep -Fq '../../../shared/i18n/' "${FRONTEND_CATALOG}" \
+  || fail "frontend catalog no longer imports ../../../shared/i18n (update Dockerfile if path changed)"
+
+echo "validate-web-server-dockerfile: ok"
diff --git a/tools/validate-web-server-dockerfile.test.sh b/tools/validate-web-server-dockerfile.test.sh
new file mode 100755
index 00000000..7ed9735d
--- /dev/null
+++ b/tools/validate-web-server-dockerfile.test.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+bash "${ROOT}/tools/validate-web-server-dockerfile.sh"