diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da2763b..e806145 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ permissions:
 
 concurrency:
   group: ci-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # The job id "ci" is the required status check on main (see mgpl-diagnostics/.github scripts/protect-repos.mjs).
@@ -26,20 +26,20 @@ jobs:
         options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 3s --health-retries 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          registry-url: https://npm.pkg.github.com
-          scope: "@mgpl-diagnostics"
       # The kits come from GitHub Packages at the versions pinned in package-lock.json.
       # (`npm run kits` still builds unreleased kit branches from source for local testing.)
-      - run: npm ci
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: mgpl-diagnostics/.github/actions/node@main
+        with:
+          github-packages: "true"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          install: npm ci --no-audit --no-fund
+          mongodb: "true"
       - run: npm run typecheck
       # the [pgbouncer] and [replicas] checks run the API through PgBouncer in transaction mode
-      - name: Install PgBouncer
-        run: sudo apt-get update -q && sudo apt-get install -y -q pgbouncer
+      # from cached .debs, so a mirror outage no longer holds the run (it once failed after five minutes)
+      - uses: mgpl-diagnostics/.github/actions/apt@main
+        with:
+          packages: pgbouncer
       - name: End-to-end tests (GraphQL over HTTP, tokens, worker on Redis, client SDK) on PostgreSQL, PostgreSQL through PgBouncer and MongoDB
         run: npm test
         env:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..2813d45
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,29 @@
+name: Docker
+
+# Builds the image on every PR and on main without pushing, to catch Dockerfile bugs before a release
+# (a missing COPY, a dependency dropped by `npm prune`, a native module that fails to load).
+# Pushing to GHCR stays in release.yml (v* tag or manual run on main). The build itself lives in
+# mgpl-diagnostics/.github (.github/workflows/docker-build.yml), shared with the dashboard.
+on:
+  push:
+    branches: [main]
+    paths-ignore: ["**.md", "docs/**", "test/**", "llms.txt", "llms-full.txt", "schema.graphql", "LICENSE"]
+  pull_request:
+    paths-ignore: ["**.md", "docs/**", "test/**", "llms.txt", "llms-full.txt", "schema.graphql", "LICENSE"]
+
+permissions:
+  contents: read
+  packages: read
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  docker:
+    uses: mgpl-diagnostics/.github/.github/workflows/docker-build.yml@main
+    with:
+      # loads every kit the api imports (report-kit's native resvg included) from the pruned node_modules
+      smoke: >-
+        docker run --rm "$IMAGE" node --input-type=module
+        -e "await import('/app/dist/index.js'); console.log('api image: every module loads'); process.exit(0)"