diff --git a/Cargo.toml b/Cargo.toml
index 52953fd..9715bf1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,5 +16,7 @@ serde_json = "1.0"
 tokio = { version = "1.48", features = ["macros", "rt-multi-thread", "signal", "net", "sync", "time"] }
 
 [profile.release]
+opt-level = "s"
 lto = "thin"
 strip = true
+panic = "abort"
diff --git a/Dockerfile b/Dockerfile
index bf553cb..34d80d6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,25 +1,35 @@
 # syntax=docker/dockerfile:1
-FROM rust:1.98.1-bookworm AS build
+FROM rust:1.98.1-alpine3.22 AS build
+RUN apk add --no-cache cmake make
 WORKDIR /build
+ARG TARGETARCH
+ARG CARGO_BUILD_JOBS=2
 COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+RUN rustup show active-toolchain
 COPY src ./src
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/build/target \
+RUN --mount=type=cache,id=vacationplanner2ics-registry,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,id=vacationplanner2ics-target-${TARGETARCH},target=/build/target,sharing=locked \
+    cargo fmt --check && \
+    cargo clippy --release --locked --all-targets -- -D warnings && \
     cargo build --release --locked && \
+    ! readelf -l target/release/vacationplanner2ics | grep -q INTERP && \
     cp target/release/vacationplanner2ics /usr/local/bin/vacationplanner2ics
 
-FROM python:3.14-slim-bookworm AS test
-RUN pip install --no-cache-dir icalendar==7.3.0
+FROM python:3.14-alpine3.22 AS test
+COPY tests/requirements.txt /tests/requirements.txt
+RUN pip install --no-cache-dir -r /tests/requirements.txt
 COPY --from=build /usr/local/bin/vacationplanner2ics /usr/local/bin/
 COPY tests /tests
 ENV PYTHONDONTWRITEBYTECODE=1
 USER 65532:65532
 CMD ["python", "/tests/e2e.py"]
 
-FROM debian:bookworm-slim AS runtime
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=build /usr/local/bin/vacationplanner2ics /usr/local/bin/
+FROM scratch AS runtime
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /usr/local/bin/vacationplanner2ics /vacationplanner2ics
+LABEL org.opencontainers.image.source="https://code.popov.link/valentineus/vacationplanner2ics" \
+      org.opencontainers.image.description="Vacationplanner calendar subscriptions over HTTP" \
+      org.opencontainers.image.licenses="MIT"
 USER 65532:65532
 EXPOSE 8080
-ENTRYPOINT ["vacationplanner2ics"]
+ENTRYPOINT ["/vacationplanner2ics"]
diff --git a/tests/requirements.txt b/tests/requirements.txt
new file mode 100644
index 0000000..bde83d8
--- /dev/null
+++ b/tests/requirements.txt
@@ -0,0 +1,4 @@
+icalendar==7.3.0
+python-dateutil==2.9.0.post0
+six==1.17.0
+tzdata==2026.3