diff --git a/Dockerfile b/Dockerfile
index 7e56ea72..732b8156 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,16 +54,12 @@ COPY --from=builder /usr/local/src/dex/go.mod /usr/local/src/dex/go.sum /usr/loc
 COPY --from=builder /usr/local/src/dex/api/v2/go.mod /usr/local/src/dex/api/v2/go.sum /usr/local/src/dex/api/v2/
 
 COPY --from=builder /go/bin/dex /usr/local/bin/dex
+COPY --from=builder /usr/local/src/dex/web /srv/dex/web
+
 COPY --from=gomplate /usr/local/bin/gomplate /usr/local/bin/gomplate
 
 USER 1001:1001
 
-# Import frontend assets and set the correct CWD directory so the assets
-# are in the default path.
-COPY --from=builder /usr/local/src/dex/web /web
-
-USER 1001:1001
-
 COPY docker-entrypoint.sh /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/cmd/dex/serve.go b/cmd/dex/serve.go
index bd7869c4..1960d101 100644
--- a/cmd/dex/serve.go
+++ b/cmd/dex/serve.go
@@ -523,4 +523,8 @@ func applyConfigOverrides(options serveOptions, config *Config) {
 	if options.grpcAddr != "" {
 		config.GRPC.Addr = options.grpcAddr
 	}
+
+	if config.Frontend.Dir == "" {
+		config.Frontend.Dir = os.Getenv("DEX_FRONTEND_DIR")
+	}
 }
diff --git a/config.yaml.dist b/config.yaml.dist
index dd8056fc..6afd063c 100644
--- a/config.yaml.dist
+++ b/config.yaml.dist
@@ -60,7 +60,7 @@ web:
 # frontend:
 #   issuer: dex
 #   logoURL: theme/logo.png
-#   dir: web/
+#   dir: ""
 #   theme: light
 
 # Telemetry configuration
diff --git a/server/server.go b/server/server.go
index 17d72af3..93ab9f16 100644
--- a/server/server.go
+++ b/server/server.go
@@ -9,6 +9,7 @@ import (
 	"io/fs"
 	"net/http"
 	"net/url"
+	"os"
 	"path"
 	"strconv"
 	"strings"
@@ -41,6 +42,7 @@ import (
 	"github.com/dexidp/dex/connector/saml"
 	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/web"
 )
 
 // LocalConnector is the local passwordDB connector which is an internal
@@ -101,20 +103,20 @@ type Config struct {
 
 // WebConfig holds the server's frontend templates and asset configuration.
 type WebConfig struct {
-	// A file path to web static. If set, WebFS will be ignored.
+	// A file path to static web assets.
 	//
 	// It is expected to contain the following directories:
 	//
 	//   * static - Static static served at "( issuer URL )/static".
 	//   * templates - HTML templates controlled by dex.
 	//   * themes/(theme) - Static static served at "( issuer URL )/theme".
-	//
 	Dir string
 
-	// Alternative way to configure web static filesystem. Dir overrides this.
-	// It's expected to contain the same files and directories as mentioned
-	// above in Dir doc.
+	// Alternative way to programatically configure static web assets.
+	// If Dir is specified, WebFS is ignored.
+	// It's expected to contain the same files and directories as mentioned above.
 	//
+	// Note: this is experimental. Might get removed without notice!
 	WebFS fs.FS
 
 	// Defaults to "( issuer URL )/theme/logo.png"
@@ -210,9 +212,15 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
 		supported[respType] = true
 	}
 
+	webFS := web.FS()
+	if c.Web.Dir != "" {
+		webFS = os.DirFS(c.Web.Dir)
+	} else if c.Web.WebFS != nil {
+		webFS = c.Web.WebFS
+	}
+
 	web := webConfig{
-		dir:       c.Web.Dir,
-		webFS:     c.Web.WebFS,
+		webFS:     webFS,
 		logoURL:   c.Web.LogoURL,
 		issuerURL: c.Issuer,
 		issuer:    c.Web.Issuer,
diff --git a/server/templates.go b/server/templates.go
index ca5e4d24..ac484301 100644
--- a/server/templates.go
+++ b/server/templates.go
@@ -7,7 +7,6 @@ import (
 	"io/fs"
 	"net/http"
 	"net/url"
-	"os"
 	"path"
 	"path/filepath"
 	"sort"
@@ -45,7 +44,6 @@ type templates struct {
 }
 
 type webConfig struct {
-	dir       string
 	webFS     fs.FS
 	logoURL   string
 	issuer    string
@@ -77,11 +75,6 @@ func loadWebConfig(c webConfig) (http.Handler, http.Handler, *templates, error)
 	if c.issuer == "" {
 		c.issuer = "dex"
 	}
-	if c.dir != "" {
-		c.webFS = os.DirFS(c.dir)
-	} else if c.webFS == nil {
-		c.webFS = os.DirFS("./web")
-	}
 	if c.logoURL == "" {
 		c.logoURL = "theme/logo.png"
 	}
diff --git a/web/web.go b/web/web.go
new file mode 100644
index 00000000..c5ff7514
--- /dev/null
+++ b/web/web.go
@@ -0,0 +1,14 @@
+package web
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed static/* templates/* themes/*
+var files embed.FS
+
+// FS returns a filesystem with the default web assets.
+func FS() fs.FS {
+	return files
+}