diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index c0ab559..c48f730 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   build-docker-image:
-    name: Build Docker image (${{ matrix.runner }})
+    name: Build Docker image (linux-${{ matrix.key }})
     strategy:
       fail-fast: false
       matrix:
@@ -31,6 +31,9 @@ jobs:
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          extra_nix_config: |
+            extra-substituters = ${{ vars.NIKS3_SERVER_URL }}
+            extra-trusted-public-keys = ${{ vars.NIKS3_PUBLIC_KEY }}
       - name: Build Docker image
         run: |
           DOCKER_PATH=$(nix build .#docker --no-link --print-out-paths)
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 756ac9d..b33728b 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -1,6 +1,7 @@
 on:
   push:
     branches: ["main"]
+    tags: ["v*.*.*"]
 
 permissions:
   contents: read
@@ -31,7 +32,6 @@ jobs:
           nix_path: nixpkgs=channel:nixpkgs-unstable
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
           extra_nix_config: |
-            system = ${{ matrix.system }}
             extra-substituters = ${{ vars.NIKS3_SERVER_URL }}
             extra-trusted-public-keys = ${{ vars.NIKS3_PUBLIC_KEY }}
       - id: build
@@ -62,3 +62,14 @@ jobs:
           UDP_OVER_TCP_PATH: ${{ steps.build.outputs.udp_over_tcp }}
         run: |
           cachix push ${CACHIX_NAME} ${SANDHOLE_PATH} ${UDP_OVER_TCP_PATH}
+  build-docker:
+    name: Build Docker
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - build-nix-packages
+    uses: ./.github/workflows/docker.yml
+    secrets:
+      dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN  }}
+      ghcr-push-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4fc286..de0b7a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,16 +29,6 @@ jobs:
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
 
-  build-docker:
-    name: Build for Docker
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/docker.yml
-    secrets:
-      dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN  }}
-      ghcr-push-token: ${{ secrets.GITHUB_TOKEN }}
-
   build-linux:
     strategy:
       fail-fast: false
@@ -78,10 +68,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: macos-15-intel
+          - runner: macos-26-intel
             target: x86_64-apple-darwin
             key: macos-amd64
-          - runner: macos-15
+          - runner: macos-26
             target: aarch64-apple-darwin
             key: macos-arm64
     name: Build for ${{ matrix.key }}
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index b471aef..42f0a75 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -83,9 +83,9 @@ jobs:
         include:
           - runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
-          - runner: macos-15-intel
+          - runner: macos-26-intel
             target: x86_64-apple-darwin
-          - runner: macos-15
+          - runner: macos-26
             target: aarch64-apple-darwin
           - runner: windows-latest
             target: x86_64-pc-windows-msvc
@@ -136,20 +136,3 @@ jobs:
         with:
           files: ./codecov.json
           token: ${{ secrets.CODECOV_TOKEN }}
-  build-docker:
-    name: Build Docker
-    if: github.ref == 'refs/heads/main'
-    permissions:
-      contents: read
-      packages: write
-    needs:
-      - rustfmt-msrv
-      - clippy-msrv
-      - build-msrv-default-features
-      - build-msrv-no-default-features
-      - tests-nightly
-      - coverage-nightly
-    uses: ./.github/workflows/docker.yml
-    secrets:
-      dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN  }}
-      ghcr-push-token: ${{ secrets.GITHUB_TOKEN }}