diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index f20d9039..5c25ac33 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -7,6 +7,11 @@ on:
     tags:
       - v**
 
+# The GITHUB_TOKEN pushes the image to ghcr.io.
+permissions:
+  contents: read
+  packages: write
+
 env:
   REPOSITORY_OWNER: ${{ github.repository_owner }}
   GHCR_REGISTRY: "ghcr.io"
diff --git a/test-services/Dockerfile b/test-services/Dockerfile
index e4a21570..98b271f9 100644
--- a/test-services/Dockerfile
+++ b/test-services/Dockerfile
@@ -19,8 +19,10 @@ COPY README.md .
 COPY uv.lock .
 
 
-RUN uv sync --all-extras --all-packages
-RUN uv build --all-packages
+# Only the wheel is needed, built once from the source tree: no editable install of
+# the extras, and no sdist to build it again from (each compiles the Rust extension,
+# which under QEMU, for linux/arm64, takes the better part of an hour).
+RUN uv build --wheel
 
 FROM python:3.12-slim AS test-services