diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
index 6c1a8c5c..edda8d7d 100644
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -66,6 +66,7 @@ jobs:
   bake:
     if: >
       !failure() && !cancelled()
+      && inputs.machines
       && fromJSON(inputs.machines)[0] != null
       && fromJSON(inputs.bake_targets)[0] != null
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d7b368d9..6734dfba 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -141,7 +141,7 @@ jobs:
           {"cargo_profile": "release-max-perf", "rust_toolchain": "stable"},
           {"cargo_profile": "release-max-perf", "feat_set": "default"},
           {"cargo_profile": "release-max-perf", "feat_set": "none"},
-          {"cargo_profile": "release"}
+          {"cargo_profile": "release-debuginfo"}
         ]
 
   package:
@@ -166,9 +166,12 @@ jobs:
           {"cargo_profile": "test"},
           {"cargo_profile": "release-debuginfo", "feat_set": "default"},
           {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release-debuginfo", "bake_target": "oci"},
           {"cargo_profile": "release-max-perf", "feat_set": "default"},
           {"cargo_profile": "release-max-perf", "rust_toolchain": "stable"},
           {"cargo_profile": "release-max-perf", "feat_set": "default"},
+          {"cargo_profile": "release-max-perf", "bake_target": "docker"},
+          {"cargo_profile": "release-max-perf", "bake_target": "oci"},
           {"cargo_profile": "release", "rust_toolchain": "nightly"}
         ]
 
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 46b6b36d..45967e8c 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -63,14 +63,14 @@ jobs:
           "book": {"dst": "book", "src": "/book"},
         }
 
-  build_standalone:
+  binary:
     if: >
       !failure() && !cancelled()
 
-    name: Standalone
+    name: Binaries
     uses: ./.github/workflows/bake.yml
     with:
-      bake_targets: '["standalone", "tuwunel"]'
+      bake_targets: '["static"]'
       cargo_profiles: ${{inputs.cargo_profiles}}
       feat_sets: ${{inputs.feat_sets}}
       rust_toolchains: ${{inputs.rust_toolchains}}
@@ -83,18 +83,41 @@ jobs:
       includes: ${{inputs.includes}}
       artifact: >
         {
-          "standalone": {"dst": "tuwunel", "src": "/usr/bin/tuwunel" },
-          "tuwunel": {"dst": "tuwunel-docker.tar.gz", "img": true }
+          "static": {"dst": "tuwunel", "src": "/usr/bin/tuwunel" },
         }
 
-  build_pkgs:
+  container:
+    if: >
+      !failure() && !cancelled()
+
+    name: Containers
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["docker", "oci"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      artifact: >
+        {
+          "docker": {"dst": "tuwunel-docker.tar.gz", "img": true },
+          "oci": {"dst": "tuwunel-oci.tar.zst", "runner": true }
+        }
+
+  pkgs:
     if: >
       !failure() && !cancelled()
       && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
       && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
       && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
 
-    name: Build Pkgs
+    name: Distro Pkgs
     uses: ./.github/workflows/bake.yml
     with:
       bake_targets: '["pkg-deb", "pkg-rpm"]'
@@ -120,9 +143,10 @@ jobs:
       && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
       && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
       && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && false
 
     name: Check Pkgs
-    needs: [build_pkgs]
+    needs: [pkgs]
     uses: ./.github/workflows/bake.yml
     with:
       bake_targets: '["pkg-deb-install", "pkg-rpm-install"]'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 86920f4d..4f595d83 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -50,7 +50,7 @@ jobs:
       && inputs.docker_repo != ''
       && github.ref == 'refs/heads/main'
 
-    name: Publish containers
+    name: Containers
     runs-on: ${{matrix.machine}}
     permissions: write-all
     continue-on-error: false
diff --git a/docker/bake.hcl b/docker/bake.hcl
index ee2d1675..67af092d 100644
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -280,7 +280,7 @@ target "github" {
     output = ["type=registry,compression=zstd,mode=min,compression-level=${image_compress_level}"]
     matrix = cargo_rust_feat_sys
     inherits = [
-        elem("tuwunel", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+        elem("docker", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
 }
 
@@ -294,7 +294,7 @@ target "dockerhub" {
     output = ["type=registry,compression=zstd,mode=min,compression-level=${image_compress_level}"]
     matrix = cargo_rust_feat_sys
     inherits = [
-        elem("tuwunel", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+        elem("docker", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
 }
 
@@ -520,8 +520,9 @@ target "smoketest" {
 group "installs" {
     targets = [
         "install",
-        "standalone",
-        "tuwunel",
+        "static",
+        "docker",
+        "oci",
     ]
 }
 
@@ -539,14 +540,26 @@ install_labels = {
     "org.opencontainers.image.version" = "${package_version}"
 }
 
-target "tuwunel" {
-    name = elem("tuwunel", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+target "oci" {
+    name = elem("oci", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     tags = [
-        elem_tag("tuwunel", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+        elem_tag("oci", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    output = ["type=oci,dest=tuwunel-oci.tar.zst,mode=min,compression-level=${image_compress_level}"]
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("docker", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+}
+
+target "docker" {
+    name = elem("docker", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("docker", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
     ]
     matrix = cargo_rust_feat_sys
     inherits = [
-        elem("standalone", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+        elem("static", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
         elem("install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
@@ -555,22 +568,22 @@ target "tuwunel" {
             || cargo_profile == "release-max-perf"
             || cargo_profile == "release"
             || cargo_profile == "release-debuginfo"?
-                elem("target:standalone", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
+                elem("target:static", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
                 elem("target:install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
     }
-    target = "tuwunel"
+    target = "image"
     dockerfile-inline =<<EOF
-        FROM input AS tuwunel
+        FROM input AS image
         EXPOSE 8008 8448
         ENTRYPOINT ["tuwunel"]
 EOF
 }
 
-target "standalone" {
-    name = elem("standalone", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+target "static" {
+    name = elem("static", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     tags = [
-        elem_tag("standalone", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+        elem_tag("static", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
     ]
     matrix = cargo_rust_feat_sys
     inherits = [
@@ -579,9 +592,9 @@ target "standalone" {
     contexts = {
         input = elem("target:install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     }
-    target = "standalone"
+    target = "static"
     dockerfile-inline =<<EOF
-        FROM scratch AS standalone
+        FROM scratch AS static
         COPY --from=input /usr/bin/tuwunel /usr/bin/tuwunel
 EOF
 }
@@ -592,7 +605,7 @@ target "install" {
         elem_tag("install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
     ]
     labels = install_labels
-    output = ["type=docker,compression=zstd,mode=min,compression-level=${cache_compress_level}"]
+    output = ["type=docker,compression=zstd,mode=min,compression-level=${image_compress_level}"]
     cache_to = ["type=local,compression=zstd,mode=min,compression-level=${cache_compress_level}"]
     dockerfile = "${docker_dir}/Dockerfile.install"
     target = "install"