diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index d775a2b8d1..a1b7ddbf5f 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -183,7 +183,11 @@ jobs:
           source: artifacts
         if: always()
 
-  build:
+  # cloudserver builds the production image then the testcoverage image, which
+  # is FROM production. Building them in the same job (sharing the cloudserver
+  # cache scope) lets testcoverage reuse the production layers instead of
+  # rebuilding them, with no cache-to race since they run sequentially.
+  build-cloudserver:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -232,43 +236,88 @@ jobs:
           cache-from: type=gha,scope=cloudserver
           cache-to: type=gha,mode=max,scope=cloudserver
 
-      - name: Build and push federation image
+  # pykmip and ci-mongodb are standalone images; build them in parallel.
+  build-images:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - name: pykmip
+            context: .github/pykmip
+            tags: ghcr.io/${{ github.repository }}/pykmip:${{ github.sha }}
+            cache-scope: pykmip
+          - name: ci-mongodb
+            context: .github/docker/mongodb
+            tags: ghcr.io/${{ github.repository }}/ci-mongodb:${{ github.sha }}
+            cache-scope: mongodb
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ github.token }}
+
+      - name: Build and push ${{ matrix.name }} image
         uses: docker/build-push-action@v5
         with:
           push: true
-          context: images/federation
+          context: ${{ matrix.context }}
           provenance: false
-          build-args: |
-            CLOUDSERVER_VERSION=${{ github.sha }}
-          tags: |
-            ghcr.io/${{ github.repository }}:${{ github.sha }}-federation
+          tags: ${{ matrix.tags }}
           labels: |
             git.repository=${{ github.repository }}
             git.commit-sha=${{ github.sha }}
-          cache-from: type=gha,scope=federation
-          cache-to: type=gha,mode=max,scope=federation
+          cache-from: type=gha,scope=${{ matrix.cache-scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
 
-      - name: Build and push pykmip image
+  # Federation depends on the pushed cloudserver production image and is not
+  # consumed by any test job, so it (and the dashboards push) runs in parallel
+  # with the tests instead of blocking them.
+  build-federation:
+    runs-on: ubuntu-latest
+    needs: build-cloudserver
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ github.token }}
+
+      - name: Build and push federation image
         uses: docker/build-push-action@v5
         with:
           push: true
-          context: .github/pykmip
+          context: images/federation
+          provenance: false
+          build-args: |
+            CLOUDSERVER_VERSION=${{ github.sha }}
           tags: |
-            ghcr.io/${{ github.repository }}/pykmip:${{ github.sha }}
+            ghcr.io/${{ github.repository }}:${{ github.sha }}-federation
           labels: |
             git.repository=${{ github.repository }}
             git.commit-sha=${{ github.sha }}
-          cache-from: type=gha,scope=pykmip
-          cache-to: type=gha,mode=max,scope=pykmip
-
-      - name: Build and push MongoDB
-        uses: docker/build-push-action@v5
-        with:
-          push: true
-          context: .github/docker/mongodb
-          tags: ghcr.io/${{ github.repository }}/ci-mongodb:${{ github.sha }}
-          cache-from: type=gha,scope=mongodb
-          cache-to: type=gha,mode=max,scope=mongodb
+          cache-from: type=gha,scope=federation
+          cache-to: type=gha,mode=max,scope=federation
 
       - name: Install Oras
         run: |
@@ -286,7 +335,7 @@ jobs:
 
   multiple-backend:
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       CLOUDSERVER_IMAGE: ghcr.io/${{ github.repository }}:${{ github.sha }}-testcoverage
       MONGODB_IMAGE: ghcr.io/${{ github.repository }}/ci-mongodb:${{ github.sha }}
@@ -345,7 +394,7 @@ jobs:
 
   mongo-v0-ft-tests:
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: mem
       MPU_TESTING: 'yes'
@@ -404,7 +453,7 @@ jobs:
 
   mongo-v1-ft-tests:
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: mem
       MPU_TESTING: 'yes'
@@ -476,7 +525,7 @@ jobs:
             job-name: file-ft-tests-null-compat
     name: ${{ matrix.job-name }}
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: file
       S3VAULT: mem
@@ -551,7 +600,7 @@ jobs:
             job-name: s3c-ft-tests-v1
     name: ${{ matrix.job-name }}
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: file
       S3DATA: scality
@@ -672,7 +721,7 @@ jobs:
 
   utapi-v2-tests:
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     if: always()
     env:
       ENABLE_UTAPI_V2: t
@@ -718,7 +767,7 @@ jobs:
 
   sur-tests:
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     strategy:
       matrix:
         inflights:
@@ -776,7 +825,7 @@ jobs:
 
   kmip-ft-tests:
     runs-on: ubuntu-24.04
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: file
       S3VAULT: mem
@@ -836,7 +885,7 @@ jobs:
 
   kmip-cluster-ft-tests:
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: file
       S3VAULT: mem
@@ -926,7 +975,7 @@ jobs:
         matrix.opts.globalEncryptionEnabled && '-global' || ''
       }}
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build-cloudserver, build-images]
     env:
       S3BACKEND: file
       S3VAULT: scality