diff --git a/.github/workflows/build-operator.yml b/.github/workflows/build-operator.yml
index 468d631d8..9e8da7840 100644
--- a/.github/workflows/build-operator.yml
+++ b/.github/workflows/build-operator.yml
@@ -14,6 +14,8 @@ on:
     paths:
       - 'cmd/kms-operator/**'
       - 'pkg/zapclient/**'
+      - 'pkg/envelope/**'
+      - 'pkg/zap/**'
       - 'Dockerfile.operator'
       - '.github/workflows/build-operator.yml'
     tags: ['v*']
diff --git a/Dockerfile.operator b/Dockerfile.operator
index d1666283b..4963dbe8e 100644
--- a/Dockerfile.operator
+++ b/Dockerfile.operator
@@ -17,7 +17,11 @@ WORKDIR /build
 COPY go.mod go.sum ./
 COPY vendor ./vendor
 COPY cmd/kms-operator ./cmd/kms-operator
+# zapclient and its in-module deps (envelope, zap) — vendor only carries
+# external deps, so the module's own packages must be in the build context.
 COPY pkg/zapclient ./pkg/zapclient
+COPY pkg/envelope ./pkg/envelope
+COPY pkg/zap ./pkg/zap
 
 RUN CGO_ENABLED=0 go build -mod=vendor \
     -ldflags="-s -w" -o /usr/local/bin/kms-operator ./cmd/kms-operator