diff --git a/Dockerfile b/Dockerfile
index 020273f..5b09f62 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,8 @@ FROM node:${NODE_VERSION}-alpine AS deps
 WORKDIR /app
 RUN apk add --no-cache libc6-compat
 COPY package.json package-lock.json ./
+# SheetJS resmi dağıtımdan vendor/ altında (npm uzak tarball indirmez).
+COPY vendor ./vendor
 RUN npm ci --no-audit --no-fund
 
 # 2) Build
diff --git a/package-lock.json b/package-lock.json
index 69118eb..526b89a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,6 +31,7 @@
         "sonner": "^2.0.8",
         "tw-animate-css": "^1.4.0",
         "vaul": "^1.1.2",
+        "xlsx": "file:vendor/xlsx-0.20.3.tgz",
         "zod": "^4.6.7"
       },
       "devDependencies": {
@@ -13158,6 +13159,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/xlsx": {
+      "version": "0.20.3",
+      "resolved": "file:vendor/xlsx-0.20.3.tgz",
+      "integrity": "sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==",
+      "license": "Apache-2.0",
+      "bin": {
+        "xlsx": "bin/xlsx.njs"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
     "node_modules/yallist": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
diff --git a/package.json b/package.json
index b6a2590..0120e41 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "sonner": "^2.0.8",
     "tw-animate-css": "^1.4.0",
     "vaul": "^1.1.2",
+    "xlsx": "file:vendor/xlsx-0.20.3.tgz",
     "zod": "^4.6.7"
   },
   "devDependencies": {
diff --git a/vendor/xlsx-0.20.3.tgz b/vendor/xlsx-0.20.3.tgz
new file mode 100644
index 0000000..b9df84a
Binary files /dev/null and b/vendor/xlsx-0.20.3.tgz differ