diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index a52778c75..30b7723d5 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -23,6 +23,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup Scala
+        uses: olafurpg/setup-scala@v14
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
+
+      - name: Cache sbt/coursier
+        uses: coursier/cache-action@v6.3
+
+      - name: Stage Docker image with sbt
+        run: sbt -Dsbt.supershell=false -J-Xmx4G "Docker / stage"
+
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
@@ -43,10 +54,20 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx (multi-arch)
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        with:
+          platforms: linux/amd64,linux/arm64
+
       - name: Build and push image
         uses: docker/build-push-action@v5
         with:
-          context: .
+          context: ./target/docker/stage
+          file: ./target/docker/stage/Dockerfile
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/docker/prism-test/run-e2e.sh b/docker/prism-test/run-e2e.sh
index 35a6c5f05..a66184b11 100755
--- a/docker/prism-test/run-e2e.sh
+++ b/docker/prism-test/run-e2e.sh
@@ -31,13 +31,21 @@ if docker volume ls --format '{{.Name}}' | grep '^prism-test_node-testnet$' >/de
 	docker volume rm prism-test_node-testnet >/dev/null 2>&1 || true
 fi
 
-# Ensure the prism-node image is available locally; build/publishLocal if missing.
+# Ensure the prism-node image is available locally; try pull first, then build only if the tag matches the local version.
 if ! docker image inspect "inputoutput/prism-node:${PRISM_NODE_VERSION}" >/dev/null 2>&1; then
-	echo "Local image inputoutput/prism-node:${PRISM_NODE_VERSION} not found. Building via sbt Docker / publishLocal..."
-	(
-		cd "$REPO_ROOT"
-		sbt -Dsbt.supershell=false "Docker / publishLocal"
-	)
+	echo "Image inputoutput/prism-node:${PRISM_NODE_VERSION} not found locally. Attempting pull..."
+	if docker pull "inputoutput/prism-node:${PRISM_NODE_VERSION}" >/dev/null 2>&1; then
+		echo "Pulled inputoutput/prism-node:${PRISM_NODE_VERSION}"
+	elif [[ "${PRISM_NODE_VERSION}" == "$(detect_version)" ]]; then
+		echo "Pull failed, building local image for version ${PRISM_NODE_VERSION} via sbt Docker / publishLocal..."
+		(
+			cd "$REPO_ROOT"
+			sbt -Dsbt.supershell=false "Docker / publishLocal"
+		)
+	else
+		echo "ERROR: image inputoutput/prism-node:${PRISM_NODE_VERSION} not available and local build version differs. Aborting." >&2
+		exit 1
+	fi
 fi
 
 docker compose -f "$COMPOSE_FILE" up -d
diff --git a/e2e/src/it/scala/io/iohk/atala/prism/e2e/VdrNegativeSpec.scala b/e2e/src/it/scala/io/iohk/atala/prism/e2e/VdrNegativeSpec.scala
index 77210d4d4..9e56e6e50 100644
--- a/e2e/src/it/scala/io/iohk/atala/prism/e2e/VdrNegativeSpec.scala
+++ b/e2e/src/it/scala/io/iohk/atala/prism/e2e/VdrNegativeSpec.scala
@@ -362,7 +362,7 @@ class VdrNegativeSpec extends VdrTestUtils {
           ex.getStatus.getCode shouldBe io.grpc.Status.INVALID_ARGUMENT.getCode
         case Right(resp) =>
           val opId = operationIdOrFail(requireOutput(resp.output, "unknown key id"))
-          awaitRejectedOrPending(opId) should (be(common_models.OperationStatus.CONFIRMED_AND_REJECTED)
+          awaitRejectedOrPending(opId, 240.seconds) should (be(common_models.OperationStatus.CONFIRMED_AND_REJECTED)
             .or(be(common_models.OperationStatus.PENDING_SUBMISSION)))
       }
     }
@@ -396,7 +396,7 @@ class VdrNegativeSpec extends VdrTestUtils {
           ex.getStatus.getCode shouldBe io.grpc.Status.INVALID_ARGUMENT.getCode
         case Right(resp) =>
           val opId = operationIdOrFail(requireOutput(resp.output, "malformed signature"))
-          awaitRejectedOrPending(opId) should (be(common_models.OperationStatus.CONFIRMED_AND_REJECTED)
+          awaitRejectedOrPending(opId, 240.seconds) should (be(common_models.OperationStatus.CONFIRMED_AND_REJECTED)
             .or(be(common_models.OperationStatus.PENDING_SUBMISSION)))
       }
     }
@@ -436,7 +436,8 @@ class VdrNegativeSpec extends VdrTestUtils {
           val updateOut = resp.outputs(1)
 
           val createId = operationIdOrFail(createOut)
-          awaitFinal(createId, 180.seconds) shouldBe common_models.OperationStatus.CONFIRMED_AND_APPLIED
+
+          awaitFinal(createId, 240.seconds) shouldBe common_models.OperationStatus.CONFIRMED_AND_APPLIED
 
           // The invalid update should surface an error eagerly or produce a rejected operation id.
           updateOut.operationMaybe.error.orElse(updateOut.operationMaybe.operationId) should not be empty
@@ -444,10 +445,10 @@ class VdrNegativeSpec extends VdrTestUtils {
             err should not be empty
           }
           updateOut.operationMaybe.operationId.foreach { id =>
-            awaitRejectedOrPending(id) should (be(common_models.OperationStatus.CONFIRMED_AND_REJECTED)
+            awaitRejectedOrPending(id, 240.seconds) should (be(common_models.OperationStatus.CONFIRMED_AND_REJECTED)
               .or(be(common_models.OperationStatus.PENDING_SUBMISSION)))
-          }
       }
     }
   }
 }
+}