diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 087a2b8..573950e 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -3,36 +3,66 @@ name: Build and Push to GHCR
 on:
   push:
     branches: [ "main" ]
+    paths-ignore: [ "**/*.md" ]
   pull_request:
     branches: [ "main" ]
+    paths-ignore: [ "**/*.md" ]
 
 jobs:
-  test:
+  fmt:
     runs-on: ubuntu-latest
+    container: rust:slim
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
+      - name: Install rustfmt
+        run: rustup component add rustfmt
 
       - name: Check formatting
         run: cargo fmt --all -- --check
 
+  clippy:
+    runs-on: ubuntu-latest
+    container: rust:slim
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build deps
+        run: apt-get update && apt-get install -y --no-install-recommends build-essential pkg-config
+
+      - name: Install clippy
+        run: rustup component add clippy
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: clippy
+
       - name: Clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
 
+  test:
+    runs-on: ubuntu-latest
+    container: rust:slim
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build deps
+        run: apt-get update && apt-get install -y --no-install-recommends build-essential pkg-config
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: test
+
       - name: Test
         run: cargo test --workspace
 
   build:
     if: github.event_name == 'push'
-    needs: test
+    needs: [fmt, clippy, test]
     strategy:
+      fail-fast: false
       matrix:
         arch: [amd64, arm64]
     runs-on: ubuntu-latest
diff --git a/Dockerfile b/Dockerfile
index cd01c53..54487bf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -61,13 +61,17 @@ RUN cargo chef prepare --bin uc-server --recipe-path recipe.json
 
 FROM chef AS builder
 COPY --from=planner /app/recipe.json recipe.json
-# Own target/ cache id (separate Cargo.lock from aispecs/operator); registry cache id is shared globally.
+# Own target/ cache id (separate Cargo.lock from aispecs/operator); registry cache id is
+# shared globally. The "-alpine" suffix ties this cache to the builder base image: compiled
+# .rlib/.so artifacts are toolchain/ABI-specific, so reusing a cache built under a different
+# base (e.g. glibc rust:latest) causes relocation failures like a missing __ubsan_handle_*
+# symbol. Bump this suffix again if the builder base image changes.
 RUN --mount=type=cache,target=/usr/local/cargo/registry,id=cargo-registry \
-    --mount=type=cache,target=/app/target,id=cargo-target-uc \
+    --mount=type=cache,target=/app/target,id=cargo-target-uc-alpine \
     cargo chef cook --zigbuild --profile docker --bin uc-server --target "$(cat /rust_target.txt)" --recipe-path recipe.json
 COPY . .
 RUN --mount=type=cache,target=/usr/local/cargo/registry,id=cargo-registry \
-    --mount=type=cache,target=/app/target,id=cargo-target-uc \
+    --mount=type=cache,target=/app/target,id=cargo-target-uc-alpine \
     cargo zigbuild --profile docker --target "$(cat /rust_target.txt)" -p uc-server && \
     cp "/app/target/$(cat /rust_target.txt)/docker/uc-server" /uc-server-bin
 
diff --git a/README.md b/README.md
index 2c41782..230beeb 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,7 @@ unitycatalog-rs/
 | Database | `sqlx 0.7` (SQLite default, Postgres via feature flag) |
 | Auth | `jsonwebtoken 9` (RS512 JWT) + `casbin` (RBAC) |
 | Serialization | `serde` + `serde_json` |
-| Cloud credentials | `aws-sdk-sts` (feature-gated) |
+| Cloud credentials | `aws-sdk-sts` (always compiled in; vending toggled at runtime via `--enable-aws-credentials`, default on) |
 
 ## Quick Start
 
@@ -144,7 +144,7 @@ Migrations run automatically on startup from `migrations/sqlite/` or `migrations
 
 ```bash
 cargo check          # fast type check
-cargo test --lib     # 16 unit tests (JWT, serde, error mapping)
+cargo test --lib     # unit tests across the workspace (JWT, serde, error mapping, ...)
 cargo build          # full build
 ```