diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9927f0e..71ccd60 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,7 @@
 name: ci
 on:
   push:
-    branches: ['*']
+    branches: ['**']
     tags-ignore: ['*']
   pull_request:
 jobs:
diff --git a/Changes b/Changes
index ceb93d6..21ea24d 100644
--- a/Changes
+++ b/Changes
@@ -1,5 +1,13 @@
 {{$NEXT}}
 
+    - Docker: build Alien::FFI against the system libffi (apt libffi-dev) instead
+      of fetching a libffi tarball from a GitHub release page, which broke the
+      image build intermittently in CI (Alien::Build itself warns the
+      release-page download negotiator "will typically not work"). The runtime
+      image now ships libffi8 for the dynamically linked FFI::Platypus. The
+      vendored libgit2 (share) build is unchanged, so the runtime stays
+      self-contained.
+
 0.302     2026-06-21 23:04:42Z
 
     - `karr board` now renders a compact, Markdown-flavoured plaintext board
diff --git a/Dockerfile b/Dockerfile
index fc21d85..228236c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,11 +2,18 @@ FROM perl:5.40-slim AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential cmake pkg-config \
-    libssl-dev zlib1g-dev libssh2-1-dev git \
+    libssl-dev zlib1g-dev libssh2-1-dev libffi-dev git \
     && rm -rf /var/lib/apt/lists/*
 
 COPY . /tmp/karr-src
 
+# Install Alien::FFI against the system libffi (libffi-dev above) up front, so it
+# links the packaged libffi.so instead of fetching a libffi tarball from a GitHub
+# release page — that download is fragile and rate-limited (Alien::Build itself
+# warns the release-page negotiator "will typically not work"), and it is what
+# broke CI builds intermittently.
+RUN ALIEN_INSTALL_TYPE=system cpanm --notest Alien::FFI
+
 # Force Alien::Libgit2 to vendor libgit2 (share build) so the runtime image is
 # self-contained — the slim runtime has no system libgit2 to dynamically link.
 ENV ALIEN_INSTALL_TYPE=share
@@ -17,11 +24,12 @@ RUN cpanm --notest --installdeps /tmp/karr-src \
 
 FROM perl:5.40-slim AS runtime-base
 
-# git + runtime shared libs the vendored libgit2.so links against
-# (OpenSSL for HTTPS, libssh2 for SSH, zlib for compression).
+# git + runtime shared libs: the vendored libgit2.so links against OpenSSL
+# (HTTPS), libssh2 (SSH) and zlib (compression); FFI::Platypus now links the
+# system libffi (see builder stage), so libffi8 must be present at runtime too.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git gosu passwd \
-    libssl3 libssh2-1 zlib1g \
+    libssl3 libssh2-1 zlib1g libffi8 \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /usr/local/lib/perl5/site_perl/ /usr/local/lib/perl5/site_perl/