diff --git a/.gitignore b/.gitignore
index 0adbdb6..3986475 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,4 +8,5 @@ ve
 .coverage
 .firebase
 static
+public/media
 default-cache
diff --git a/Makefile b/Makefile
index 2e6b506..fb4585c 100644
--- a/Makefile
+++ b/Makefile
@@ -19,6 +19,24 @@ deploy:
 test:
 	docker run -it -e PORT=8000 -p8000:8000 orthocal ./manage.py test
 
-firebase:
+firebase: collectstatic
 	firebase use --add orthocal-1d1b9
 	firebase deploy --only hosting
+
+# Regenerates static/ (Django's STATIC_ROOT) via the same collectstatic
+# step the Dockerfile runs at image-build time, then mirrors it into
+# public/media -- matching STATIC_URL='media/' -- so Firebase Hosting
+# serves these files directly from its own CDN instead of proxying every
+# request through Cloud Run. Firebase's rewrite in firebase.json only
+# applies as a fallback for paths that don't match a real file under
+# public/, so no rewrite changes are needed for this to take effect.
+collectstatic:
+	docker compose run --rm local ./manage.py collectstatic --noinput
+	rm -rf public/media
+	mkdir -p public/media
+	cp -r static/* public/media/
+	# servestatic pre-compresses sidecar files (.br/.gz/.zstd) for its own
+	# on-disk serving scheme; Firebase Hosting compresses on the fly at its
+	# own CDN edge and never looks for these, so they'd just be dead weight
+	# in the deploy.
+	find public/media \( -name '*.br' -o -name '*.gz' -o -name '*.zstd' \) -print0 | xargs -0 rm -f