diff --git a/content/manuals/engine/install/_index.md b/content/manuals/engine/install/_index.md
index a5e09fac6c0..c2b6e666ea4 100644
--- a/content/manuals/engine/install/_index.md
+++ b/content/manuals/engine/install/_index.md
@@ -138,3 +138,4 @@ Security reports are greatly appreciated, and Docker will publicly thank you for
 
 After setting up Docker, you can learn the basics with
 [Build and share a containerized application](/get-started/tutorials/run-an-app.md).
+
diff --git a/netlify.toml b/netlify.toml
index 10bff81d003..0fc377fe4a8 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -1,13 +1,28 @@
+# Netlify build configuration
+# Ensure Hugo version is pinned and extended edition requested to avoid on-the-fly GitHub downloads
+
 [build]
-publish = "public"
+  publish = "public"
+  # default build command (will also be used when contexts don't override it)
+  command = "hugo --gc --minify -b $DEPLOY_PRIME_URL && ./hack/flatten-and-resolve.js && npx pagefind@v1.5.2"
+
+[build.environment]
+  # Node / npm environment
+  NODE_VERSION = "24"
+  NODE_ENV = "production"
+
+  # Pin the Hugo version and request the extended binary (avoid downloading from GitHub in build)
+  HUGO_VERSION = "0.163.0"
+  HUGO_EXTENDED = "true"
+  HUGO_ENABLEGITINFO = "true"
+  HUGO_ENVIRONMENT = "production"
+
+  # Exclude large public file from secrets scan (existing setting)
+  SECRETS_SCAN_OMIT_PATHS = "public/contribute/file-conventions/index.html"
 
+# Deploy preview context keeps the same command but overrides environment where needed
 [context.deploy-preview.environment]
-NODE_VERSION = "24"
-NODE_ENV = "production"
-HUGO_VERSION = "0.163.0"
-HUGO_ENABLEGITINFO = "true"
-HUGO_ENVIRONMENT = "preview"
-SECRETS_SCAN_OMIT_PATHS = "public/contribute/file-conventions/index.html"
+  HUGO_ENVIRONMENT = "preview"
 
 [context.deploy-preview]
-command = "hugo --gc --minify -b $DEPLOY_PRIME_URL && ./hack/flatten-and-resolve.js && npx pagefind@v1.5.2"
+  command = "hugo --gc --minify -b $DEPLOY_PRIME_URL && ./hack/flatten-and-resolve.js && npx pagefind@v1.5.2"