diff --git a/.github/workflows/ha-build.yml b/.github/workflows/ha-build.yml
index 91a7e59d5..db9676be1 100644
--- a/.github/workflows/ha-build.yml
+++ b/.github/workflows/ha-build.yml
@@ -37,6 +37,34 @@ jobs:
           echo "image_repo=${REPO}" >> "$GITHUB_OUTPUT"
           echo "short_sha=${SHORT_SHA}"  >> "$GITHUB_OUTPUT"
 
+      - name: Install .NET SDK
+        # Build on the runner host filesystem (native I/O) to avoid DinD
+        # overlay-on-overlay throttling which makes dotnet publish ~20x slower.
+        run: |
+          DOTNET_INSTALL_DIR="$HOME/.dotnet"
+          mkdir -p "$DOTNET_INSTALL_DIR"
+          if ! "$DOTNET_INSTALL_DIR/dotnet" --version 2>/dev/null | grep -q "^10\\."; then
+            curl -fsSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 10.0 --install-dir "$DOTNET_INSTALL_DIR"
+          fi
+          echo "DOTNET_ROOT=$DOTNET_INSTALL_DIR" >> "$GITHUB_ENV"
+          echo "PATH=$DOTNET_INSTALL_DIR:$PATH" >> "$GITHUB_ENV"
+
+      - name: Restore NuGet packages
+        run: |
+          export PATH="$HOME/.dotnet:$PATH"
+          dotnet restore Jellyfin.Server/Jellyfin.Server.csproj --runtime linux-x64
+
+      - name: Publish Jellyfin server
+        run: |
+          export PATH="$HOME/.dotnet:$PATH"
+          dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+            --configuration Release \
+            --runtime linux-x64 \
+            --self-contained false \
+            --no-restore \
+            -p:TreatWarningsAsErrors=false \
+            --output ./publish-output
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -44,7 +72,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: Dockerfile
+          file: Dockerfile.runtime
           platforms: linux/amd64
           push: true
           provenance: false
diff --git a/Dockerfile.runtime b/Dockerfile.runtime
new file mode 100644
index 000000000..547ad3cb3
--- /dev/null
+++ b/Dockerfile.runtime
@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1
+# Runtime-only image — the .NET publish step runs on the CI host (runner),
+# not inside this Dockerfile. This avoids DinD overlay-on-overlay I/O throttling
+# which makes `dotnet publish` inside Docker-in-Docker prohibitively slow on k3s.
+
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+
+# Install FFmpeg and native dependencies required by SkiaSharp and fontconfig.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ffmpeg \
+      fontconfig \
+      libfontconfig1 \
+      libfreetype6 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /jellyfin
+
+# Copy the pre-built publish output produced by `dotnet publish` on the CI host.
+COPY publish-output/ .
+
+# Jellyfin default ports
+EXPOSE 8096
+EXPOSE 8920
+
+# Data / config volumes
+VOLUME ["/config", "/cache", "/media"]
+
+ENV JELLYFIN_DATA_DIR=/config \
+    JELLYFIN_CACHE_DIR=/cache \
+    JELLYFIN_LOG_DIR=/config/log \
+    JELLYFIN_CONFIG_DIR=/config
+
+ENTRYPOINT ["./jellyfin", \
+            "--datadir", "/config", \
+            "--cachedir", "/cache"]