diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f1992a3d3..bd9849241 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,6 +14,12 @@ on:
         required: false
         default: 'manual'
 
+# Cancel an older in-progress build on the same branch when a newer commit
+# lands, so the latest commit is the one that builds + deploys.
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # ECR region is selected per-branch in the "Extract metadata" step:
   #   prod repo (autumn)         -> us-east-2
@@ -25,7 +31,7 @@ env:
 jobs:
   checks:
     name: Type Check
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     
     steps:
       - name: Checkout code
@@ -156,31 +162,19 @@ jobs:
           echo "Repository: ${ECR_REGISTRY}/${ECR_REPOSITORY}"
           echo "Tag: ${COMBINED_TAG}"
 
-      - name: Auto-deploy fix branches
+      - name: Auto-deploy production
         if: github.ref == 'refs/heads/main'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEPLOY_URL: ${{ secrets.DEPLOY_URL }}
           DEPLOY_SECRET: ${{ secrets.DEPLOY_SECRET }}
           COMMIT_SHA: ${{ github.sha }}
         run: |
-          # Get the PR that was merged (if any)
-          PR_DATA=$(gh pr list --state merged --search "$COMMIT_SHA" --json headRefName --limit 1)
-          BRANCH_NAME=$(echo "$PR_DATA" | jq -r '.[0].headRefName // empty')
-          
-          if [[ "$BRANCH_NAME" == fix/* ]]; then
-            echo "Detected merged fix/ branch: $BRANCH_NAME"
-            echo "Triggering auto-deploy..."
-            
-            curl --fail-with-body -X POST "$DEPLOY_URL/api/deploy/github" \
-              -H "Content-Type: application/json" \
-              -H "x-deploy-secret: $DEPLOY_SECRET" \
-              -d "{\"commitSha\": \"$COMMIT_SHA\", \"deploymentType\": \"server\"}"
-            
-            echo "Auto-deploy triggered!"
-          else
-            echo "Not a fix/ branch (branch: ${BRANCH_NAME:-direct push}), skipping auto-deploy"
-          fi
+          echo "Triggering production auto-deploy for $COMMIT_SHA..."
+          curl --fail-with-body -X POST "$DEPLOY_URL/api/deploy/github" \
+            -H "Content-Type: application/json" \
+            -H "x-deploy-secret: $DEPLOY_SECRET" \
+            -d "{\"commitSha\": \"$COMMIT_SHA\"}"
+          echo "Auto-deploy triggered!"
 
       - name: Auto-deploy staging
         if: github.ref == 'refs/heads/dev' || steps.meta.outputs.deploy_staging_override == 'true'
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index 056dd9c68..2d69fa49d 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -10,7 +10,7 @@ on:
 jobs:
   knip:
     name: Check for unused code
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/sdk-publish.yml b/.github/workflows/sdk-publish.yml
index 9e19dca59..f92181116 100644
--- a/.github/workflows/sdk-publish.yml
+++ b/.github/workflows/sdk-publish.yml
@@ -46,7 +46,7 @@ env:
 jobs:
   publish:
     name: Build and Publish
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     permissions:
       id-token: write
diff --git a/.github/workflows/server-typecheck.yml b/.github/workflows/server-typecheck.yml
index a081ea20f..79ed97953 100644
--- a/.github/workflows/server-typecheck.yml
+++ b/.github/workflows/server-typecheck.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   changes:
     name: Check changed files
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       server: ${{ steps.filter.outputs.server }}
     steps:
@@ -30,7 +30,7 @@ jobs:
     name: Type Check
     needs: changes
     if: needs.changes.outputs.server == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/server-unit-tests.yml b/.github/workflows/server-unit-tests.yml
index 2c99faaec..61b0363d6 100644
--- a/.github/workflows/server-unit-tests.yml
+++ b/.github/workflows/server-unit-tests.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   changes:
     name: Check changed files
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       server: ${{ steps.filter.outputs.server }}
     steps:
@@ -32,7 +32,7 @@ jobs:
     name: Unit Tests
     needs: changes
     if: needs.changes.outputs.server == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/validate-schema.yml b/.github/workflows/validate-schema.yml
index 291f9e806..47fd90454 100644
--- a/.github/workflows/validate-schema.yml
+++ b/.github/workflows/validate-schema.yml
@@ -11,7 +11,7 @@ on:
 jobs:
   changes:
     name: Detect schema-relevant changes
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       schema: ${{ steps.filter.outputs.schema }}
     steps:
@@ -32,7 +32,7 @@ jobs:
   validate-schema:
     name: Validate Schema
     needs: changes
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
       - name: Skip (no schema-relevant changes)
diff --git a/.github/workflows/vite-build.yml b/.github/workflows/vite-build.yml
index 35917b017..4e63aebb0 100644
--- a/.github/workflows/vite-build.yml
+++ b/.github/workflows/vite-build.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   changes:
     name: Check changed files
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       vite: ${{ steps.filter.outputs.vite }}
     steps:
@@ -28,11 +28,11 @@ jobs:
               - "bun.lock"
               - ".github/workflows/vite-build.yml"
 
-  typecheck:
-    name: Type Check
+  build:
+    name: Build & Type Check
     needs: changes
     if: needs.changes.outputs.vite == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
 
     steps:
       - name: Checkout code
@@ -49,23 +49,5 @@ jobs:
       - name: Run TypeScript type check
         run: cd vite && bunx tsc --noEmit
 
-  build:
-    name: Build
-    needs: changes
-    if: needs.changes.outputs.vite == 'true'
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.10
-
-      - name: Install dependencies
-        run: bun install
-
       - name: Build Vite
         run: cd vite && bunx vite build
diff --git a/.github/workflows/vite-unit-tests.yml b/.github/workflows/vite-unit-tests.yml
index cdae25ad9..6d9511dc9 100644
--- a/.github/workflows/vite-unit-tests.yml
+++ b/.github/workflows/vite-unit-tests.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   changes:
     name: Check changed files
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       vite: ${{ steps.filter.outputs.vite }}
     steps:
@@ -34,7 +34,7 @@ jobs:
     name: Unit Tests
     needs: changes
     if: needs.changes.outputs.vite == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
       - name: Checkout code
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 6566442f0..ae5cac2e2 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -19,8 +19,11 @@ WORKDIR /app
 COPY --from=pruner /app/out/json/ .
 RUN mkdir -p scripts && touch scripts/preload-env.ts
 RUN bun -e 'const fs = require("fs"); const pkg = JSON.parse(fs.readFileSync("package.json", "utf8")); pkg.workspaces.packages = ["server", "shared", "apps/mcp-server", "packages/ksuid", "packages/mcp", "packages/stripe-sync", "packages/autumn-js", "packages/sdk"]; delete pkg.dependencies; delete pkg.devDependencies; delete pkg.scripts; fs.writeFileSync("package.json", JSON.stringify(pkg, null, 2));'
+# Keep turbo's pruned bun.lock (derived from the committed lockfile) so versions
+# stay pinned and bun only reconciles the workspace-list delta. Deleting it forces
+# a full from-scratch registry resolve, which is slow and can hang.
 RUN --mount=type=cache,target=/root/.bun/install/cache \
-	rm -f bun.lock && bun install --ignore-scripts
+	bun install --ignore-scripts
 
 COPY --from=pruner /app/out/full/ .