diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4d65854e..168f68c2 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,7 +42,7 @@ jobs:
       publish: ${{vars.PUBLISH != 'false'}}
       build_nix: ${{vars.BUILD_NIX != 'false'}}
       build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/test' || contains(github.ref, 'tags/v')}}
-      check_pkgs: ${{vars.CHECK_PKGS || 'false'}}
+      check_pkgs: ${{vars.CHECK_PKGS || github.ref == 'refs/heads/test'}}
       complement: ${{vars.COMPLEMENT != 'false'}}
       complement_runner: 'het'
       docker_repo: ${{vars.DOCKER_REPO}}
diff --git a/docker/Dockerfile.install b/docker/Dockerfile.install
index c1d419e6..0bdbf002 100644
--- a/docker/Dockerfile.install
+++ b/docker/Dockerfile.install
@@ -15,15 +15,17 @@ ENV src_path="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}/tuwunel
 ENV dst_path="${install_prefix}/bin/tuwunel"
 COPY --from=bins $src_path $dst_path
 RUN <<EOF
-    ret=$(ldd "${dst_path}")
+    ldd -v "${dst_path}"
+    ret=$?
     if [ "$ret" = "0" ] && [ "$assert_linkage" = "static" ]; then
+        echo "($ret) expected a static binary"
         exit 1
     elif [ "$ret" != "0" ] && [ "$assert_linkage" = "dynamic" ]; then
+        echo "($ret) expected a dynamic binary"
         exit 1
     fi
 
     set -eux
-    ldd -v ${dst_path} || true
-    du -h ${dst_path}
-    sha1sum ${dst_path}
+    du -h "${dst_path}"
+    sha1sum "${dst_path}"
 EOF
diff --git a/docker/bake.hcl b/docker/bake.hcl
index 0895ee0c..36ce080c 100644
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -868,6 +868,12 @@ target "install" {
     }
     args = {
         install_prefix = install_prefix
+        assert_linkage = (
+            substr(cargo_profile, 0, 5) == "bench"?     "static":
+            substr(cargo_profile, 0, 7) == "release"?   "static":
+            substr(rust_toolchain, 0, 6) == "stable"?   "static":
+            ""
+        )
     }
 }