diff --git a/Dockerfile b/Dockerfile
index 4421f68..c8a1215 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,12 +15,15 @@ COPY src ./src
 COPY lib ./lib
 RUN mkdir -p src/static/bundled-lib && cp -f lib/*.py src/static/bundled-lib/
 COPY workspace ./workspace
-# Mirror canonical demo files into the static bundle so the editor's
-# "Reset demos" button works from a static-only host too.
-RUN mkdir -p src/static/bundled-demos && \
-    for f in pattern_rainbow_demo.py pattern_twinkle_demo.py pattern_chase_demo.py \
+# Sanity-check: the canonical demos under `src/static/bundled-demos/` (used by
+# the editor's "Reset demos" button) must stay in sync with `workspace/code/`.
+# Files in `bundled-demos/` are committed to git and copied via `COPY src`
+# above; this step just fails the build if a checked-in copy drifted from the
+# canonical version, so the mismatch is caught here instead of at runtime.
+RUN for f in pattern_rainbow_demo.py pattern_twinkle_demo.py pattern_chase_demo.py \
              adc_slider_demo.py pin_demo.py serial_demo.py; do \
-        cp -f "workspace/code/$f" "src/static/bundled-demos/$f"; \
+        diff -q "workspace/code/$f" "src/static/bundled-demos/$f" \
+            || { echo "ERROR: $f out of sync between workspace/code/ and src/static/bundled-demos/" >&2; exit 1; }; \
     done
 
 EXPOSE 8080