diff --git a/.gitignore b/.gitignore
index 4c49bd7..0c336c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
 .env
+exchange/secrets/
+bank/token-info.txt
+vendor/gnunet.tar.gz
diff --git a/Dockerfile b/Dockerfile
index c19adad..3ceb63c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,6 +34,17 @@ RUN set -e; \
         git clone --depth 1 --branch "${GNUNET_REF}" https://git.taler.net/gnunet.git gnunet; \
         GNUNET_DIR="gnunet"; \
       fi; \
+    elif [ -f /vendor/gnunet.tar.gz ]; then \
+      echo "Using local GNUnet tarball from /vendor/gnunet.tar.gz"; \
+      cp /vendor/gnunet.tar.gz .; \
+      tar xzf gnunet.tar.gz; \
+      GNUNET_DIR="$(ls -d gnunet-* | head -1)"; \
+      if [ ! -f "${GNUNET_DIR}/doc/handbook/meson.build" ]; then \
+        echo "Local tarball seems incomplete; falling back to git clone ${GNUNET_REF}"; \
+        rm -rf "${GNUNET_DIR}"; \
+        git clone --depth 1 --branch "${GNUNET_REF}" https://git.taler.net/gnunet.git gnunet; \
+        GNUNET_DIR="gnunet"; \
+      fi; \
     else \
       git clone --depth 1 --branch "${GNUNET_REF}" https://git.taler.net/gnunet.git gnunet; \
       GNUNET_DIR="gnunet"; \
diff --git a/README-DE.md b/README-DE.md
index b951bdc..885f852 100644
--- a/README-DE.md
+++ b/README-DE.md
@@ -47,6 +47,7 @@ Container-Stack für GNU Taler (Exchange, Merchant, LibEuFin Bank) mit optionale
 - Bei eigener CA `EXCHANGE_CURL_OPTS="-k"` setzen, wenn der Offline-Job `/keys` über HTTPS abfragt.
 - Nach Passwortänderungen in `.env` ist kein manuelles SQL-Rendering nötig; das Init-Skript liest sie beim Start.
 - Release-Refs/Tarballs: Tags/Commits unter `https://git.taler.net/{gnunet,exchange,merchant,libeufin}.git/` ansehen (Tarballs via `.../snapshot/<tag>.tar.gz`) und `*_REF`/`GNUNET_TARBALL_URL` entsprechend setzen.
+- Offline-Tarball: Lege ein GNUnet-Tarball unter `vendor/gnunet.tar.gz` ab, um es beim Build zu nutzen; bei unvollständigem Tarball fällt der Build auf Git zurück.
 
 ## Nützliche Kommandos
 - Logs: `docker compose logs -f exchange` (oder bank/merchant/caddy/wordpress).
diff --git a/README.md b/README.md
index de98ad8..75d84b6 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,7 @@ Container stack for GNU Taler (Exchange, Merchant, LibEuFin Bank) with optional
 - With custom CAs, set `EXCHANGE_CURL_OPTS="-k"` if the offline job needs to curl `/keys` over HTTPS.
 - After changing DB passwords in `.env`, no manual SQL rendering is needed—the init script reads them at container start.
 - Release refs/tarballs: Browse tags/commits at `https://git.taler.net/{gnunet,exchange,merchant,libeufin}.git/` (Tarballs via `.../snapshot/<tag>.tar.gz`) and set `*_REF`/`GNUNET_TARBALL_URL` accordingly.
+- Offline tarball drop-in: place a GNUnet tarball at `vendor/gnunet.tar.gz` to use it instead of downloading; the build falls back to git if the tarball looks incomplete.
 
 ## Useful commands
 - Logs: `docker compose logs -f exchange` (or bank/merchant/caddy/wordpress).
diff --git a/vendor/.gitkeep b/vendor/.gitkeep
new file mode 100644
index 0000000..ccb33d4
--- /dev/null
+++ b/vendor/.gitkeep
@@ -0,0 +1 @@
+*** End Patch*** 香港赛马会 to=functions.apply_patch져 json## Test Input Reasoning