diff --git a/.dockerignore b/.dockerignore
index 08a21ec97..99535f01b 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,5 @@
 Dockerfile
-node_modules
+**/node_modules
 docs/old
 dist
 target
diff --git a/apps/wallet/src/configs/init.config.ts b/apps/wallet/src/configs/init.config.ts
index 8e4acc0de..fe68cd8be 100644
--- a/apps/wallet/src/configs/init.config.ts
+++ b/apps/wallet/src/configs/init.config.ts
@@ -30,7 +30,13 @@ const appInitConfig: AppInitConfig = {
   isProduction: !!import.meta.env.PROD,
   apiGatewayUrl: new URL(import.meta.env.PROD ? 'https://icp-api.io' : 'http://localhost:4943'),
   httpGatewayUrl: getHttpGatewayUrl(import.meta.env.PROD),
-  derivationOrigin: import.meta.env.PROD ? 'https://orbitwallet.io' : undefined,
+  // Only the production build mode derives the identity from the legacy domain; other
+  // IC-hosted build modes (e.g. playground, testing) authenticate against their own origin,
+  // which is not listed in the production domain's ii-alternative-origins.
+  derivationOrigin:
+    import.meta.env.PROD && import.meta.env.APP_BUILD_MODE === 'production'
+      ? 'https://orbitwallet.io'
+      : undefined,
   marketingSiteUrl: import.meta.env.APP_MARKETING_SITE_URL,
   locale: {
     default: defaultLocale,
diff --git a/canister_ids.json b/canister_ids.json
index d2ab55095..814602e1b 100644
--- a/canister_ids.json
+++ b/canister_ids.json
@@ -1,4 +1,7 @@
 {
+  "app_marketing": {
+    "production": "kguhj-fyaaa-aaaaa-qad6a-cai"
+  },
   "app_wallet": {
     "playground": "bxkhk-6yaaa-aaaal-ai6va-cai",
     "production": "5fu67-giaaa-aaaal-ajbla-cai",
@@ -9,10 +12,8 @@
     "production": "5mxvd-qaaaa-aaaal-ajbkq-cai",
     "testing": "lotbt-qqaaa-aaaal-aduzq-cai"
   },
-  "app_marketing": {
-    "production": "kguhj-fyaaa-aaaaa-qad6a-cai"
-  },
   "docs_portal": {
+    "playground": "d537j-aaaaa-aaaal-asz5q-cai",
     "production": "bp6mw-eqaaa-aaaac-ahroq-cai"
   },
   "wasm_chunk_store": {
diff --git a/scripts/docker-build.sh b/scripts/docker-build.sh
index a20b77e4a..41a745d30 100755
--- a/scripts/docker-build.sh
+++ b/scripts/docker-build.sh
@@ -56,8 +56,9 @@ function deterministic_build() {
   local project_name=$1
   local target=$2
 
-  # Build the canister
-  docker build --build-arg BUILD_MODE=$BUILD_MODE -t orbit-$project_name --target $target . --platform=linux/amd64
+  # Build the canister. Provenance attestations are disabled so the output is a single
+  # manifest that `docker create` can resolve on non-amd64 hosts (e.g. Apple Silicon).
+  docker build --build-arg BUILD_MODE=$BUILD_MODE -t orbit-$project_name --target $target . --platform=linux/amd64 --provenance=false
 
   # Create a container to extract the generated artifacts
   docker create --name orbit-$project_name-container orbit-$project_name