diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 11898cf0fb..67aef9f1b6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -194,7 +194,7 @@ jobs:
           ref: ${{ inputs.ref || github.sha }}
           persist-credentials: false
       - name: Build Docker image
-        run: docker build -t ironclaw-test:ci .
+        run: docker build --target runtime -t ironclaw-test:ci .
 
   version-check:
     name: Version Bump Check
diff --git a/Dockerfile b/Dockerfile
index 9c015e8331..2f1c208e2e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,7 +8,7 @@
 # database reopen), so we use glibc.
 #
 # Build:
-#   docker build --platform linux/amd64 -t ironclaw:latest .
+#   docker build --platform linux/amd64 --target runtime -t ironclaw:latest .
 #
 # Run:
 #   docker run --env-file .env -p 3000:3000 ironclaw:latest
@@ -68,11 +68,18 @@ COPY profiles/ profiles/
 RUN cargo build --profile dist --bin ironclaw
 
 # Stage 4b: Build all WASM extensions from source (only used by runtime-staging)
-FROM builder AS wasm-builder
-ARG CACHE_BUST
+#
+# Inherits from chef (not builder) so WASM extensions only rebuild when
+# tools-src/, channels-src/, registry/, or wit/ change — not on every
+# src/ edit. The extensions are standalone crates with their own lockfiles.
+FROM chef AS wasm-builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends jq && rm -rf /var/lib/apt/lists/*
-RUN echo "cache-bust=${CACHE_BUST}"
+
+COPY tools-src/ tools-src/
+COPY channels-src/ channels-src/
+COPY registry/ registry/
+COPY wit/ wit/
 
 RUN set -eux; \
     mkdir -p /app/wasm-bundles/tools /app/wasm-bundles/channels; \
@@ -134,12 +141,14 @@ ENV RUST_LOG=ironclaw=info
 
 ENTRYPOINT ["ironclaw"]
 
-# Stage 5b: Staging runtime (with pre-built WASM extensions)
+# Stage 5b: Production runtime (no pre-bundled extensions)
+FROM runtime-base AS runtime
+USER ironclaw
+
+# Stage 5c: Staging runtime (with pre-built WASM extensions)
+# Last stage = default target. Railway doesn't support --target, so this
+# must be last for Railway deploys. CI uses explicit --target flags.
 FROM runtime-base AS runtime-staging
 COPY --from=wasm-builder --chown=ironclaw:ironclaw /app/wasm-bundles/tools/ /home/ironclaw/.ironclaw/tools/
 COPY --from=wasm-builder --chown=ironclaw:ironclaw /app/wasm-bundles/channels/ /home/ironclaw/.ironclaw/channels/
 USER ironclaw
-
-# Stage 5c: Production runtime (default — no pre-bundled extensions)
-FROM runtime-base AS runtime
-USER ironclaw
diff --git a/railway.toml b/railway.toml
index 5515cd9006..b7e7e9a01d 100644
--- a/railway.toml
+++ b/railway.toml
@@ -1,7 +1,6 @@
 [build]
 builder = "dockerfile"
 dockerfilePath = "Dockerfile"
-target = "runtime-staging"
 
 [deploy]
 healthcheckPath = "/api/health"