diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 74706fe7..33f5cdef 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -29,8 +29,8 @@ jobs:
 
       - name: Create .env file from secrets
         run: |
-          echo "${{ secrets.APP_ENV }}" > .env
-          echo ".env file created"
+          echo "${{ secrets.APP_ENV }}" > app.env
+          echo "app.env file created"
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -43,8 +43,10 @@ jobs:
           COMMIT_TAG=${SHORT_SHA::7}
           echo "Building image with tags: latest, $COMMIT_TAG"
 
-          docker build -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest \
-                       -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:$COMMIT_TAG .
+          docker build \
+            --secret id=app_env,src=app.env \
+            -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest \
+            -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:$COMMIT_TAG .
 
       - name: Push image to Docker Hub
         run: |
diff --git a/Dockerfile b/Dockerfile
index cf883a58..0f8864e9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,13 @@
+# syntax=docker/dockerfile:1.2
+
 FROM gradle:8.7-jdk21-alpine AS build
 
 WORKDIR /app
 
+RUN --mount=type=secret,id=app_env \
+    mkdir -p /app && \
+    cat /run/secrets/app_env > /app/.env
+
 COPY build.gradle settings.gradle gradlew ./
 COPY gradle gradle
 RUN ./gradlew dependencies --no-daemon || true