diff --git a/Dockerfile b/Dockerfile
index 4f2cf7f..64008a6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,15 +9,6 @@ RUN echo "//gitea.siegeln.net/api/packages/cameleer/npm/:_authToken=${REGISTRY_T
 COPY ui/ .
 RUN npm run build
 
-# Sign-in UI: custom Logto sign-in experience
-FROM --platform=$BUILDPLATFORM node:22-alpine AS sign-in-frontend
-ARG REGISTRY_TOKEN
-WORKDIR /ui
-COPY ui/sign-in/package.json ui/sign-in/package-lock.json ui/sign-in/.npmrc ./
-RUN echo "//gitea.siegeln.net/api/packages/cameleer/npm/:_authToken=${REGISTRY_TOKEN}" >> .npmrc && npm ci
-COPY ui/sign-in/ .
-RUN npm run build
-
 # Maven build: runs natively on build host (no QEMU emulation)
 FROM --platform=$BUILDPLATFORM eclipse-temurin:21-jdk-alpine AS build
 WORKDIR /build
@@ -34,7 +25,6 @@ FROM eclipse-temurin:21-jre-alpine
 WORKDIR /app
 RUN addgroup -S cameleer && adduser -S cameleer -G cameleer
 COPY --from=build /build/target/*.jar app.jar
-COPY --from=sign-in-frontend /ui/dist/ /app/sign-in-dist/
 USER cameleer
 EXPOSE 8080
 ENTRYPOINT ["java", "-jar", "app.jar"]
diff --git a/docker-compose.yml b/docker-compose.yml
index d94f807..52c64df 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -58,16 +58,15 @@ services:
       - cameleer
 
   logto:
-    image: ghcr.io/logto-io/logto:latest
+    image: ${LOGTO_IMAGE:-gitea.siegeln.net/cameleer/cameleer-logto}:${VERSION:-latest}
+    build:
+      context: .
+      dockerfile: docker/logto.Dockerfile
     restart: unless-stopped
     depends_on:
       postgres:
         condition: service_healthy
-      sign-in-ui:
-        condition: service_completed_successfully
     entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
-    volumes:
-      - signinui:/etc/logto/packages/experience/dist
     environment:
       DB_URL: postgres://${POSTGRES_USER:-cameleer}:${POSTGRES_PASSWORD:-cameleer_dev}@postgres:5432/logto
       ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
@@ -122,14 +121,6 @@ services:
     networks:
       - cameleer
 
-  sign-in-ui:
-    image: ${CAMELEER_IMAGE:-gitea.siegeln.net/cameleer/cameleer-saas}:${VERSION:-latest}
-    restart: "no"
-    user: root
-    entrypoint: ["sh", "-c", "cp -r /app/sign-in-dist/* /data/sign-in-ui/ && echo '[sign-in-ui] Copied custom UI to shared volume'"]
-    volumes:
-      - signinui:/data/sign-in-ui
-
   cameleer-saas:
     image: ${CAMELEER_IMAGE:-gitea.siegeln.net/cameleer/cameleer-saas}:${VERSION:-latest}
     restart: unless-stopped
@@ -250,4 +241,3 @@ volumes:
   certs:
   jardata:
   bootstrapdata:
-  signinui:
diff --git a/docker/logto.Dockerfile b/docker/logto.Dockerfile
new file mode 100644
index 0000000..c774788
--- /dev/null
+++ b/docker/logto.Dockerfile
@@ -0,0 +1,14 @@
+# syntax=docker/dockerfile:1
+
+# Build custom sign-in UI
+FROM --platform=$BUILDPLATFORM node:22-alpine AS sign-in
+ARG REGISTRY_TOKEN
+WORKDIR /ui
+COPY ui/sign-in/package.json ui/sign-in/package-lock.json ui/sign-in/.npmrc ./
+RUN echo "//gitea.siegeln.net/api/packages/cameleer/npm/:_authToken=${REGISTRY_TOKEN}" >> .npmrc && npm ci
+COPY ui/sign-in/ .
+RUN npm run build
+
+# Custom Logto with baked-in sign-in UI
+FROM ghcr.io/logto-io/logto:latest
+COPY --from=sign-in /ui/dist/ /etc/logto/packages/experience/dist/
diff --git a/docker/saas-entrypoint.sh b/docker/saas-entrypoint.sh
deleted file mode 100644
index e2aca6b..0000000
--- a/docker/saas-entrypoint.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-# Copy sign-in UI dist to shared volume for Logto's CUSTOM_UI_PATH
-if [ -d /app/sign-in-dist ] && [ -d /data/sign-in-ui ]; then
-  cp -r /app/sign-in-dist/* /data/sign-in-ui/
-  echo "[saas] Copied sign-in UI to shared volume"
-fi
-exec java -jar /app/app.jar "$@"
diff --git a/ui/src/auth/LoginPage.tsx b/ui/src/auth/LoginPage.tsx
index 7189f33..d28e05f 100644
--- a/ui/src/auth/LoginPage.tsx
+++ b/ui/src/auth/LoginPage.tsx
@@ -1,11 +1,12 @@
-import { useEffect } from 'react';
+import { useEffect, useRef } from 'react';
 import { useLogto } from '@logto/react';
 import { useNavigate } from 'react-router';
-import { Button, Spinner } from '@cameleer/design-system';
+import { Spinner } from '@cameleer/design-system';
 
 export function LoginPage() {
   const { signIn, isAuthenticated, isLoading } = useLogto();
   const navigate = useNavigate();
+  const redirected = useRef(false);
 
   useEffect(() => {
     if (isAuthenticated) {
@@ -13,27 +14,16 @@ export function LoginPage() {
     }
   }, [isAuthenticated, navigate]);
 
-  if (isLoading) {
-    return (
-      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh' }}>
-        <Spinner />
-      </div>
-    );
-  }
-
-  const handleLogin = () => {
-    signIn(`${window.location.origin}/platform/callback`);
-  };
+  useEffect(() => {
+    if (!isLoading && !isAuthenticated && !redirected.current) {
+      redirected.current = true;
+      signIn(`${window.location.origin}/platform/callback`);
+    }
+  }, [isLoading, isAuthenticated, signIn]);
 
   return (
     <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh' }}>
-      <div style={{ textAlign: 'center' }}>
-        <h1>Cameleer SaaS</h1>
-        <p style={{ marginBottom: '2rem', color: 'var(--color-text-secondary)' }}>
-          Managed Apache Camel Runtime
-        </p>
-        <Button onClick={handleLogin}>Sign in with Logto</Button>
-      </div>
+      <Spinner />
     </div>
   );
 }