diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f19d3cd3..b4b26234 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -14,7 +14,16 @@ build:
   before_script:
     - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
   script:
-    - docker build -f k8s/Dockerfile -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -t $CI_REGISTRY_IMAGE:latest .
+    # Pull latest image for layer caching (ignore failures if not exists)
+    - docker pull $CI_REGISTRY_IMAGE:latest || true
+    # Build with cache-from for faster builds and inline cache for future builds
+    - docker build
+        --cache-from $CI_REGISTRY_IMAGE:latest
+        --build-arg BUILDKIT_INLINE_CACHE=1
+        -f k8s/Dockerfile
+        -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+        -t $CI_REGISTRY_IMAGE:latest
+        .
     - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
     - docker push $CI_REGISTRY_IMAGE:latest
   rules:
diff --git a/Dockerfile b/Dockerfile
index a5dba55a..a3537981 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1.4
+
 # Find eligible builder and runner images on Docker Hub. We use Ubuntu/Debian
 # instead of Alpine to avoid DNS resolution issues in production.
 #
@@ -22,6 +24,7 @@ FROM ${BUILDER_IMAGE} AS builder
 
 # install build dependencies
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends build-essential git \
   && rm -rf /var/lib/apt/lists/*
 
@@ -71,6 +74,7 @@ RUN mix release
 FROM ${RUNNER_IMAGE} AS final
 
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends libstdc++6 openssl libncurses6 locales ca-certificates \
   && rm -rf /var/lib/apt/lists/*
 
@@ -98,4 +102,8 @@ USER nobody
 # above and adding an entrypoint. See https://github.com/krallin/tini for details
 # ENTRYPOINT ["/tini", "--"]
 
+# Health check for container orchestration
+HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
+  CMD ["/app/bin/towerops", "rpc", "1 + 1"]
+
 CMD ["/app/bin/server"]
diff --git a/k8s/Dockerfile b/k8s/Dockerfile
index a5dba55a..a3537981 100644
--- a/k8s/Dockerfile
+++ b/k8s/Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1.4
+
 # Find eligible builder and runner images on Docker Hub. We use Ubuntu/Debian
 # instead of Alpine to avoid DNS resolution issues in production.
 #
@@ -22,6 +24,7 @@ FROM ${BUILDER_IMAGE} AS builder
 
 # install build dependencies
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends build-essential git \
   && rm -rf /var/lib/apt/lists/*
 
@@ -71,6 +74,7 @@ RUN mix release
 FROM ${RUNNER_IMAGE} AS final
 
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends libstdc++6 openssl libncurses6 locales ca-certificates \
   && rm -rf /var/lib/apt/lists/*
 
@@ -98,4 +102,8 @@ USER nobody
 # above and adding an entrypoint. See https://github.com/krallin/tini for details
 # ENTRYPOINT ["/tini", "--"]
 
+# Health check for container orchestration
+HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
+  CMD ["/app/bin/towerops", "rpc", "1 + 1"]
+
 CMD ["/app/bin/server"]