diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8f9052e..e32ad17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
     branches: [main]
     tags: ['v*']
   pull_request:
+  # CodeQL runs on main + this weekly cron only (not on PRs) — see the codeql job's `if`.
+  schedule:
+    - cron: '0 3 * * 1' # Mondays 03:00 UTC
 
 # Least privilege by default; the CodeQL job widens its own scope locally.
 permissions:
@@ -25,7 +28,7 @@ jobs:
         with:
           node-version: 24
           cache: npm
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - run: npm run lint
       - run: npm run format:check
       - run: npm run check:tokens
@@ -47,7 +50,13 @@ jobs:
         with:
           node-version: 24
           cache: npm
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
+      # Cache the chromium download across runs; `install --with-deps` then only
+      # runs the (fast, idempotent) apt deps check on a hit.
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
       - run: npx playwright install --with-deps chromium
       - run: npm run build-storybook
       - run: npm run test-storybook:ci
@@ -60,6 +69,11 @@ jobs:
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
+      - uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
       - run: dotnet format backend/BigRegister.slnx --verify-no-changes
       - run: dotnet test backend/BigRegister.slnx
 
@@ -84,12 +98,24 @@ jobs:
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
-      - run: npm ci
+      - uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
+      - run: npm ci --prefer-offline --no-audit --no-fund
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
       - run: npx playwright install --with-deps chromium
       - run: npm run e2e
 
   codeql:
     # Static analysis (SAST) for both sides; results appear under the Security tab.
+    # Off the PR path (slow 2-language matrix) — runs on push-to-main + the weekly
+    # cron only, so PR feedback isn't bottlenecked on it.
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -106,6 +132,12 @@ jobs:
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
+      - if: matrix.language == 'csharp'
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
       - uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
@@ -128,6 +160,11 @@ jobs:
           dotnet-version: |
             8.0.x
             10.0.x
-      - run: npm ci
+      - uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - run: npm run gen:api
       - run: git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json
diff --git a/docker-compose.yml b/docker-compose.yml
index 174d535..6eedd7e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,7 +25,10 @@ services:
       - '5000:5000'
 
   web:
-    image: node:24
+    # slim (Debian/glibc, ~220MB vs ~1.1GB for the full tag): the container only runs
+    # `npm ci && ng serve`, and the native deps (esbuild, lmdb, @parcel/watcher,
+    # msgpackr-extract) ship prebuilt glibc binaries, so no build toolchain is needed.
+    image: node:24-slim
     working_dir: /app
     # Uses the committed generated client (no codegen at startup); proxies /api → api container.
     # ponytail: `--no-fund --loglevel=error` silences npm 11's startup noise (deprecation +