diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d2e4b80..246c953 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -139,6 +139,22 @@ build_image:
     - echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin
   script:
     - echo "--- Building Docker Image ---"
+    - |
+      for var_name in NEXT_PUBLIC_API_URL NEXT_PUBLIC_MARKETPLACE_URL NEXT_PUBLIC_DASHBOARD_URL NEXT_PUBLIC_ADMIN_URL; do
+        var_value="$(printenv "$var_name" || true)"
+
+        if [ -z "$var_value" ]; then
+          echo "$var_name is not set. Refusing to build a production image with missing public frontend URLs." >&2
+          exit 1
+        fi
+
+        case "$var_value" in
+          *example.com*)
+            echo "$var_name=$var_value still uses the placeholder example.com domain. Update the GitLab CI/CD variable before building." >&2
+            exit 1
+            ;;
+        esac
+      done
     # NEXT_PUBLIC_* vars are inlined into Next.js bundles at build time — must be passed as ARGs
     - |
       docker build \
diff --git a/docs/DOCKER.md b/docs/DOCKER.md
index e8f033c..6dc10f0 100644
--- a/docs/DOCKER.md
+++ b/docs/DOCKER.md
@@ -191,6 +191,17 @@ If you want GitLab CI to build once and deploy by pulling a prebuilt image on th
 
 If `REGISTRY_*` variables are set, the CI pipeline now uses them as a complete override and requires all four values. If they are unset, the pipeline falls back to GitLab's `CI_REGISTRY_*` variables.
 
+For production image builds, also define these GitLab CI/CD variables with their real public URLs:
+
+```text
+NEXT_PUBLIC_API_URL=https://api.rentaldrivego.ma/api/v1
+NEXT_PUBLIC_MARKETPLACE_URL=https://rentaldrivego.ma
+NEXT_PUBLIC_DASHBOARD_URL=https://rentaldrivego.ma/dashboard
+NEXT_PUBLIC_ADMIN_URL=https://rentaldrivego.ma/admin
+```
+
+The Docker build now fails if any of those values are missing or still point at `example.com`, because Next.js inlines them into the production frontend bundles at build time.
+
 Example explicit values for a local registry exposed through Traefik:
 
 ```text