diff --git a/.github/workflows/mk-01-identity.yml b/.github/workflows/mk-01-identity.yml
index 88dcc83aa..39f3210d7 100644
--- a/.github/workflows/mk-01-identity.yml
+++ b/.github/workflows/mk-01-identity.yml
@@ -27,7 +27,7 @@ jobs:
       CARGO_PROFILE_TEST_DEBUG: '0'
     services:
       postgres:
-        image: postgres:17-alpine
+        image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
         env:
           POSTGRES_PASSWORD: postgres
         ports: ['5432:5432']
@@ -45,7 +45,7 @@ jobs:
       - name: Build disposable extension for relay independence acceptance
         working-directory: services/extensions
         run: |
-          go build -o "$RUNNER_TEMP/lmm-relay-extension" ./cmd/extensions
+          CGO_ENABLED=0 go build -mod=readonly -trimpath -o "$RUNNER_TEMP/lmm-relay-extension" ./cmd/extensions
           echo "LMM_RELAY_EXTENSION_BIN=$RUNNER_TEMP/lmm-relay-extension" >> "$GITHUB_ENV"
       - name: Check formatting
         working-directory: services/core
@@ -57,7 +57,24 @@ jobs:
       - name: Test against isolated PostgreSQL databases
         if: ${{ !cancelled() && steps.rust.outcome == 'success' }}
         working-directory: services/core
-        run: cargo test --locked --all-targets --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/identity-tests.log"
+        run: |
+          # Compile once, then bind the real Core child used by all six process tests.
+          cargo test --locked --all-targets --no-run
+          LMM_MODEL_PROCESS_CORE_BIN="$(realpath target/debug/lmm-core)"
+          LMM_MODEL_PROCESS_CORE_SHA256="$(sha256sum "$LMM_MODEL_PROCESS_CORE_BIN" | cut -d ' ' -f1)"
+          LMM_MODEL_PROCESS_ROOT="$(mktemp -d /tmp/lmm-model-XXXXXXXX)"
+          export LMM_MODEL_PROCESS_CORE_BIN LMM_MODEL_PROCESS_CORE_SHA256 LMM_MODEL_PROCESS_ROOT
+          # The non-ignored payment recovery case requires sealed Core, Go host
+          # and bootstrap binaries. The 302-second case stays ignored.
+          CGO_ENABLED=0 go test -C ../extensions -mod=readonly -c -o "$RUNNER_TEMP/lmm-payment-bootstrap" ./internal/modules/payments
+          LMM_PAYMENT_CORE_BIN="$LMM_MODEL_PROCESS_CORE_BIN"
+          LMM_PAYMENT_CORE_SHA256="$LMM_MODEL_PROCESS_CORE_SHA256"
+          LMM_PAYMENT_GO_BIN="$(realpath "$LMM_RELAY_EXTENSION_BIN")"
+          LMM_PAYMENT_GO_SHA256="$(sha256sum "$LMM_PAYMENT_GO_BIN" | cut -d ' ' -f1)"
+          LMM_PAYMENT_BOOTSTRAP_BIN="$(realpath "$RUNNER_TEMP/lmm-payment-bootstrap")"
+          LMM_PAYMENT_BOOTSTRAP_SHA256="$(sha256sum "$LMM_PAYMENT_BOOTSTRAP_BIN" | cut -d ' ' -f1)"
+          export LMM_PAYMENT_CORE_BIN LMM_PAYMENT_CORE_SHA256 LMM_PAYMENT_GO_BIN LMM_PAYMENT_GO_SHA256 LMM_PAYMENT_BOOTSTRAP_BIN LMM_PAYMENT_BOOTSTRAP_SHA256
+          cargo test --locked --all-targets --no-fail-fast 2>&1 | tee "$RUNNER_TEMP/identity-tests.log"
       - name: Repeat rejected event acknowledgement regression
         if: ${{ !cancelled() && steps.rust.outcome == 'success' }}
         working-directory: services/core