diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-check.yml
similarity index 63%
rename from .github/workflows/docker-build.yml
rename to .github/workflows/docker-check.yml
index 24ece3fa4..e11f9830d 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-check.yml
@@ -1,5 +1,7 @@
-# If we decide to run build-image.yml on every PR, we could deprecate this workflow.
-name: Docker Build
+# This workflow performs a quick Docker build check on PRs and pushes to master.
+# It builds the Docker image and runs a basic smoke test to ensure the image works.
+# This is a lightweight check - for full multi-platform builds and publishing, see docker-image.yml
+name: Docker Check
 
 on:
   workflow_dispatch:
@@ -15,7 +17,20 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  docker-build:
+  lint:
+    if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v5
+      - uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile
+          failure-threshold: warning
+          verbose: true
+          format: tty
+
+  build:
     if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 10
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 6d89c2980..4564c060e 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -1,3 +1,7 @@
+# This workflow builds and publishes official Docker images to Docker Hub.
+# It handles multi-platform builds (amd64, arm/v7, arm64/v8) and pushes tagged releases.
+# This workflow is triggered on tags, specific branches, and can be manually dispatched.
+# For quick build checks during development, see docker-check.yml
 name: Docker Push
 
 on:
diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 000000000..78b3d23bf
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,13 @@
+# Hadolint configuration for Kubo Docker image
+# https://github.com/hadolint/hadolint
+
+# Ignore specific rules
+ignored:
+  # DL3008: Pin versions in apt-get install
+  # We use stable base images and prefer smaller layers over version pinning
+  - DL3008
+
+# Trust base images from these registries
+trustedRegistries:
+  - docker.io
+  - gcr.io
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 0db5f33b4..6d43beefa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,9 +8,9 @@ ENV SRC_DIR=/kubo
 
 # Cache go module downloads between builds for faster rebuilds
 COPY go.mod go.sum $SRC_DIR/
+WORKDIR $SRC_DIR
 RUN --mount=type=cache,target=/go/pkg/mod \
-  cd $SRC_DIR \
-  && go mod download
+  go mod download
 
 COPY . $SRC_DIR
 
@@ -25,8 +25,7 @@ ARG MAKE_TARGET=build
 # mkdir .git/objects allows git rev-parse to read commit hash for version info
 RUN --mount=type=cache,target=/go/pkg/mod \
   --mount=type=cache,target=/root/.cache/go-build \
-  cd $SRC_DIR \
-  && mkdir -p .git/objects \
+  mkdir -p .git/objects \
   && GOOS=$TARGETOS GOARCH=$TARGETARCH GOFLAGS=-buildvcs=false make ${MAKE_TARGET} IPFS_PLUGINS=$IPFS_PLUGINS
 
 # Extract required runtime tools from Debian.
diff --git a/config/plugins.go b/config/plugins.go
index 08a1acb34..0c438cbd7 100644
--- a/config/plugins.go
+++ b/config/plugins.go
@@ -7,5 +7,5 @@ type Plugins struct {
 
 type Plugin struct {
 	Disabled bool
-	Config   interface{}
+	Config   interface{} `json:",omitempty"`
 }
diff --git a/test/cli/harness/node.go b/test/cli/harness/node.go
index 6403a2f1a..0315e81df 100644
--- a/test/cli/harness/node.go
+++ b/test/cli/harness/node.go
@@ -245,6 +245,14 @@ func (n *Node) Init(ipfsArgs ...string) *Node {
 		cfg.Swarm.DisableNatPortMap = true
 		cfg.Discovery.MDNS.Enabled = n.EnableMDNS
 		cfg.Routing.LoopbackAddressesOnLanDHT = config.True
+		// Telemetry disabled by default in tests.
+		cfg.Plugins = config.Plugins{
+			Plugins: map[string]config.Plugin{
+				"telemetry": config.Plugin{
+					Disabled: true,
+				},
+			},
+		}
 	})
 	return n
 }
diff --git a/test/cli/telemetry_test.go b/test/cli/telemetry_test.go
index 455ea7df1..69b87e80d 100644
--- a/test/cli/telemetry_test.go
+++ b/test/cli/telemetry_test.go
@@ -25,6 +25,7 @@ func TestTelemetry(t *testing.T) {
 
 		// Create a new node
 		node := harness.NewT(t).NewNode().Init()
+		node.SetIPFSConfig("Plugins.Plugins.telemetry.Disabled", false)
 
 		// Set the opt-out environment variable
 		node.Runner.Env["IPFS_TELEMETRY"] = "off"
@@ -64,6 +65,7 @@ func TestTelemetry(t *testing.T) {
 
 		// Create a new node
 		node := harness.NewT(t).NewNode().Init()
+		node.SetIPFSConfig("Plugins.Plugins.telemetry.Disabled", false)
 
 		// Set opt-out via config
 		node.IPFS("config", "Plugins.Plugins.telemetry.Config.Mode", "off")
@@ -106,6 +108,7 @@ func TestTelemetry(t *testing.T) {
 
 		// Create a new node
 		node := harness.NewT(t).NewNode().Init()
+		node.SetIPFSConfig("Plugins.Plugins.telemetry.Disabled", false)
 
 		// Create a UUID file manually to simulate previous telemetry run
 		uuidPath := filepath.Join(node.Dir, "telemetry_uuid")
@@ -154,6 +157,7 @@ func TestTelemetry(t *testing.T) {
 
 		// Create a new node
 		node := harness.NewT(t).NewNode().Init()
+		node.SetIPFSConfig("Plugins.Plugins.telemetry.Disabled", false)
 
 		// Capture daemon output
 		stdout := &harness.Buffer{}
@@ -255,6 +259,7 @@ func TestTelemetry(t *testing.T) {
 
 		// Create a new node
 		node := harness.NewT(t).NewNode().Init()
+		node.SetIPFSConfig("Plugins.Plugins.telemetry.Disabled", false)
 
 		// Configure telemetry with a very short delay for testing
 		node.IPFS("config", "Plugins.Plugins.telemetry.Config.Delay", "100ms")
diff --git a/test/sharness/lib/test-lib.sh b/test/sharness/lib/test-lib.sh
index e8030dcc4..413d0e92f 100644
--- a/test/sharness/lib/test-lib.sh
+++ b/test/sharness/lib/test-lib.sh
@@ -205,6 +205,10 @@ test_init_ipfs() {
     ipfs init "${args[@]}" --profile=test > /dev/null
   '
 
+  test_expect_success "disable telemetry" '
+    test_config_set --bool Plugins.Plugins.telemetry.Disabled "true"
+  '
+
   test_expect_success "prepare config -- mounting" '
     mkdir mountdir ipfs ipns mfs &&
     test_config_set Mounts.IPFS "$(pwd)/ipfs" &&
@@ -227,6 +231,10 @@ test_init_ipfs_measure() {
     ipfs init "${args[@]}" --profile=test,flatfs-measure > /dev/null
   '
 
+  test_expect_success "disable telemetry" '
+    test_config_set --bool Plugins.Plugins.telemetry.Disabled "true"
+  '
+
   test_expect_success "prepare config -- mounting" '
     mkdir mountdir ipfs ipns &&
     test_config_set Mounts.IPFS "$(pwd)/ipfs" &&