diff --git a/workloads/ecommerce/Dockerfile b/workloads/ecommerce/Dockerfile
index 3821978..f2c78e6 100644
--- a/workloads/ecommerce/Dockerfile
+++ b/workloads/ecommerce/Dockerfile
@@ -23,31 +23,56 @@ ENV NEXT_TELEMETRY_DISABLED=1 \
 
 COPY package.json package-lock.json .npmrc ./
 
-# Evita que un package-lock generado en otro entorno apunte a un
-# registry privado o inaccesible para el runner de Gitea.
+# Normaliza cualquier URL interna que haya quedado grabada en el
+# package-lock.json antes de ejecutar npm ci.
 RUN node <<'NODE'
 const fs = require("node:fs");
 
 const file = "package-lock.json";
-const text = fs.readFileSync(file, "utf8");
+const publicRegistry = "https://registry.npmjs.org/";
+
+let text = fs.readFileSync(file, "utf8");
+let replacements = 0;
+
+const internalRegistryPatterns = [
+  /https?:\/\/packages\.applied-caas-gateway1\.internal\.api\.openai\.org\/artifactory\/api\/npm\/npm-public\//g,
+];
+
+for (const pattern of internalRegistryPatterns) {
+  text = text.replace(pattern, () => {
+    replacements += 1;
+    return publicRegistry;
+  });
+}
+
+fs.writeFileSync(file, `${text.trimEnd()}\n`, "utf8");
+
+const normalizedText = fs.readFileSync(file, "utf8");
 
 const forbiddenHosts = [
   "internal.api.openai.org",
   "packages.applied-caas-gateway1",
 ];
 
-const detected = forbiddenHosts.filter((host) => text.includes(host));
+const detectedHosts = forbiddenHosts.filter((host) =>
+  normalizedText.includes(host)
+);
 
-if (detected.length > 0) {
+if (detectedHosts.length > 0) {
   console.error(
-    `ERROR: package-lock.json contiene registry no permitido: ${detected.join(", ")}`
+    `ERROR: todavía existen registries no permitidos: ${detectedHosts.join(", ")}`
   );
   process.exit(1);
 }
 
-const lock = JSON.parse(text);
+const lockfile = JSON.parse(normalizedText);
+
 console.log(
-  `Lockfile válido: ${lock.name} · lockfileVersion=${lock.lockfileVersion}`
+  `Lockfile válido: ${lockfile.name} · lockfileVersion=${lockfile.lockfileVersion}`
+);
+
+console.log(
+  `Referencias normalizadas hacia registry.npmjs.org: ${replacements}`
 );
 NODE
 
@@ -57,7 +82,8 @@ RUN node --version \
     && npm config get replace-registry-host \
     && npm ping
 
-# --kill-after garantiza que un npm colgado termine después de SIGTERM.
+# Caché privado para no quedar esperando compilaciones simultáneas.
+# El timeout fuerza la terminación si npm queda realmente bloqueado.
 RUN --mount=type=cache,target=/root/.npm,sharing=private \
     timeout \
       --signal=TERM \
@@ -88,6 +114,7 @@ COPY . .
 RUN --mount=type=cache,target=/app/.next/cache,sharing=private \
     npm run build
 
+# next.config.ts debe contener output: "standalone".
 RUN test -f /app/.next/standalone/server.js
 
 
@@ -145,4 +172,4 @@ HEALTHCHECK \
   --retries=3 \
   CMD ["node", "-e", "fetch('http://127.0.0.1/api/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
 
-CMD ["node", "server.js"]
+CMD ["node", "server.js"]
\ No newline at end of file