diff --git a/.gitea/workflows/ci-cd-vm.yml b/.gitea/workflows/ci-cd-vm.yml
index 9b9b9a3..02c5772 100644
--- a/.gitea/workflows/ci-cd-vm.yml
+++ b/.gitea/workflows/ci-cd-vm.yml
@@ -28,7 +28,9 @@ jobs:
       - name: Build images
         run: |
           docker build -t "$REGISTRY/rolac-api:latest" -t "$REGISTRY/rolac-api:${{ github.sha }}" ./API
-          docker build -t "$REGISTRY/rolac-app:latest" -t "$REGISTRY/rolac-app:${{ github.sha }}" ./APP
+          docker build \
+            --build-arg KENDO_UI_LICENSE="${{ secrets.KENDO_UI_LICENSE }}" \
+            -t "$REGISTRY/rolac-app:latest" -t "$REGISTRY/rolac-app:${{ github.sha }}" ./APP
 
       - name: Push images
         run: |
diff --git a/APP/Dockerfile b/APP/Dockerfile
index 3055cb8..2fe0595 100644
--- a/APP/Dockerfile
+++ b/APP/Dockerfile
@@ -4,6 +4,11 @@ WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci --legacy-peer-deps
 COPY . .
+# Kendo Angular license: passed in as a build-arg (sourced from a Gitea Actions
+# secret), exposed to `npm run build` as the env var kendo-licensing reads. Not
+# baked into any image layer beyond this build stage (the runtime stage is nginx).
+ARG KENDO_UI_LICENSE
+ENV KENDO_UI_LICENSE=${KENDO_UI_LICENSE}
 RUN npm run build           # -> dist/client-bridge/browser  (production by default)
 
 # ---- runtime ----