diff --git a/.github/FILTERS.md b/.github/FILTERS.md
index 1d5bfa1c36a3..d2912f2def84 100644
--- a/.github/FILTERS.md
+++ b/.github/FILTERS.md
@@ -15,7 +15,8 @@ When you open a PR, CI checks which files changed and runs only relevant jobs:
 | `snapshot_vllm` / `snapshot_sglang` / `snapshot_trtllm` | That framework's DynamoCheckpoint deploy suite |
 | `deploy` | Deploy-specific tests |
 | `vllm` / `sglang` / `trtllm` | Backend-specific tests |
-| `sidecar` | Nothing directly; sidecar source and proto files also match `rust` |
+| `vllm_sidecar` / `sglang_sidecar` / `trtllm_sidecar` | That engine's multi-architecture sidecar container build; `lib/sidecar/common/**` changes trigger all three |
+| `sidecar` | Nothing directly (classification only) |
 | `benchmarks` | Dynamo runtime pipeline (runs `tests/benchmarks/**` pytest suite) |
 | `sample` | Sample-backend unified test (piggybacks on vllm image) |
 | `efa` | EFA runtime image builds for vLLM, SGLang, TRT-LLM (`container/templates/aws.Dockerfile` change) |
@@ -25,7 +26,7 @@ When you open a PR, CI checks which files changed and runs only relevant jobs:
 | `ignore` | Nothing (classification only) |
 | `rust` | Rust pre merge checks |
 
-> **Note:** `docs`, `ignore`, and `sidecar` don't directly trigger CI jobs. They exist to satisfy coverage requirements - every file must match at least one filter. Sidecar source and proto files also match `rust`, which runs the workspace Rust checks.
+> **Note:** `ignore` and `sidecar` don't directly trigger CI jobs. They exist to satisfy coverage requirements - every file must match at least one filter. Sidecar source and proto files also match `rust`, which runs the workspace Rust checks.
 
 ## Fixing "Uncovered Files" Errors
 
diff --git a/.github/actions/changed-files/action.yml b/.github/actions/changed-files/action.yml
index f6333aab8c86..631f31911eac 100644
--- a/.github/actions/changed-files/action.yml
+++ b/.github/actions/changed-files/action.yml
@@ -58,6 +58,15 @@ outputs:
   sidecar:
     description: 'Whether sidecar files changed'
     value: ${{ steps.filter.outputs.sidecar_any_modified }}
+  vllm_sidecar:
+    description: 'Whether vLLM sidecar image inputs changed'
+    value: ${{ steps.filter.outputs.vllm_sidecar_any_modified }}
+  sglang_sidecar:
+    description: 'Whether SGLang sidecar image inputs changed'
+    value: ${{ steps.filter.outputs.sglang_sidecar_any_modified }}
+  trtllm_sidecar:
+    description: 'Whether TensorRT-LLM sidecar image inputs changed'
+    value: ${{ steps.filter.outputs.trtllm_sidecar_any_modified }}
   frontend:
     description: 'Whether frontend files changed'
     value: ${{ steps.filter.outputs.frontend_any_modified }}
@@ -173,6 +182,9 @@ runs:
         echo "dgdr: ${{ steps.filter.outputs.dgdr_any_modified }}"
         echo "planner: ${{ steps.filter.outputs.planner_any_modified }}"
         echo "sidecar: ${{ steps.filter.outputs.sidecar_any_modified }}"
+        echo "vllm_sidecar: ${{ steps.filter.outputs.vllm_sidecar_any_modified }}"
+        echo "sglang_sidecar: ${{ steps.filter.outputs.sglang_sidecar_any_modified }}"
+        echo "trtllm_sidecar: ${{ steps.filter.outputs.trtllm_sidecar_any_modified }}"
         echo "vllm: ${{ steps.filter.outputs.vllm_any_modified }}"
         echo "sglang: ${{ steps.filter.outputs.sglang_any_modified }}"
         echo "trtllm: ${{ steps.filter.outputs.trtllm_any_modified }}"
@@ -199,6 +211,9 @@ runs:
         echo "dgdr: ${{ steps.filter.outputs.dgdr_all_modified_files }}"
         echo "planner: ${{ steps.filter.outputs.planner_all_modified_files }}"
         echo "sidecar: ${{ steps.filter.outputs.sidecar_all_modified_files }}"
+        echo "vllm_sidecar: ${{ steps.filter.outputs.vllm_sidecar_all_modified_files }}"
+        echo "sglang_sidecar: ${{ steps.filter.outputs.sglang_sidecar_all_modified_files }}"
+        echo "trtllm_sidecar: ${{ steps.filter.outputs.trtllm_sidecar_all_modified_files }}"
         echo "vllm: ${{ steps.filter.outputs.vllm_all_modified_files }}"
         echo "sglang: ${{ steps.filter.outputs.sglang_all_modified_files }}"
         echo "trtllm: ${{ steps.filter.outputs.trtllm_all_modified_files }}"
diff --git a/.github/filters.yaml b/.github/filters.yaml
index 4b80915e7b5f..0af15e4f0e10 100644
--- a/.github/filters.yaml
+++ b/.github/filters.yaml
@@ -16,11 +16,11 @@
 #   benchmarks -> dynamo build-test (runs tests/benchmarks/** pytest suite)
 #   efa      -> all framework EFA runtime image builds (changes to container/templates/aws.Dockerfile)
 #   examples -> recipe-check (Kustomize recipe generation and unit tests)
-#   sidecar  -> classification only; source and proto files also match rust
+#   vllm_sidecar / sglang_sidecar / trtllm_sidecar -> engine-specific sidecar image build
 #   docs     -> fern docs lint, sync, and version release (docs/ directory)
 #
 # Filters for coverage only (no CI triggered):
-#   examples, ignore, sidecar
+#   ignore, sidecar
 
 all:
   - '**'
@@ -132,6 +132,10 @@ ignore:
   # CODEOWNERS generation tooling (data + scripts). Validated by its own
   # codeowners.yml workflow (triggers on '**'); no backend CI needed here.
   - '.github/codeowners/**'
+  # Sidecar docs are intentionally excluded from the Fern docs filter and do
+  # not affect the built sidecar images.
+  - 'lib/sidecar/**/*.md'
+  - 'lib/sidecar/**/*.rst'
 
 ci: &ci
   - '.github/workflows/**'
@@ -283,6 +287,28 @@ planner:
 
 sidecar:
   - 'lib/sidecar/**'
+  - '!**/*.md'
+  - '!**/*.rst'
+
+# Engine-specific sidecar builds. Changes to common sidecar code exercise all
+# three images; engine-local changes exercise only that engine's image.
+vllm_sidecar:
+  - 'lib/sidecar/common/**'
+  - 'lib/sidecar/vllm/**'
+  - '!**/*.md'
+  - '!**/*.rst'
+
+sglang_sidecar:
+  - 'lib/sidecar/common/**'
+  - 'lib/sidecar/sglang/**'
+  - '!**/*.md'
+  - '!**/*.rst'
+
+trtllm_sidecar:
+  - 'lib/sidecar/common/**'
+  - 'lib/sidecar/trtllm/**'
+  - '!**/*.md'
+  - '!**/*.rst'
 
 vllm:
   - 'container/deps/requirements.vllm.txt'
diff --git a/.github/scripts/test-filters.js b/.github/scripts/test-filters.js
index f531b5b069a1..4584a967310b 100755
--- a/.github/scripts/test-filters.js
+++ b/.github/scripts/test-filters.js
@@ -112,33 +112,43 @@ const testCases = [
   // Sidecar Rust and proto files should trigger Rust checks without unrelated E2E
   {
     file: 'lib/sidecar/common/src/lib.rs',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'common sidecar source avoids unrelated build and E2E filters'
+    expect: { sidecar: true, vllm_sidecar: true, sglang_sidecar: true, trtllm_sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'common sidecar source triggers all sidecar images without backend E2E'
   },
   {
     file: 'lib/sidecar/vllm/proto/vllm_grpc.proto',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'vllm sidecar proto triggers Rust checks without backend E2E'
+    expect: { sidecar: true, vllm_sidecar: true, sglang_sidecar: false, trtllm_sidecar: false, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'vllm sidecar proto triggers only the vLLM image and Rust checks'
   },
   {
     file: 'lib/sidecar/sglang/src/lib.rs',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'sglang sidecar source avoids backend E2E'
+    expect: { sidecar: true, vllm_sidecar: false, sglang_sidecar: true, trtllm_sidecar: false, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'sglang sidecar source triggers only the SGLang image and Rust checks'
   },
   {
     file: 'lib/sidecar/trtllm/src/lib.rs',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'trtllm sidecar source does not route to sglang or trtllm E2E'
+    expect: { sidecar: true, vllm_sidecar: false, sglang_sidecar: false, trtllm_sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'trtllm sidecar source triggers only the TensorRT-LLM image and Rust checks'
   },
   {
     file: 'lib/sidecar/vllm/deploy/agg.yaml',
-    expect: { sidecar: true, rust: false, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'sidecar deployment config avoids Rust and E2E checks'
+    expect: { sidecar: true, vllm_sidecar: true, sglang_sidecar: false, trtllm_sidecar: false, rust: false, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'vLLM sidecar deployment config triggers only the vLLM image'
   },
   {
     file: 'lib/sidecar/README.md',
-    expect: { sidecar: true, rust: false, core: false, frontend: false, docs: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'sidecar README avoids Rust, Fern, and E2E checks'
+    expect: { sidecar: false, ignore: true, rust: false, core: false, frontend: false, docs: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'sidecar README avoids container, Rust, Fern, and E2E checks'
+  },
+  {
+    file: '.github/workflows/shared-build-image.yml',
+    expect: { sidecar: false, vllm_sidecar: false, sglang_sidecar: false, trtllm_sidecar: false, core: true },
+    desc: 'shared image build workflow does not trigger sidecar container jobs'
+  },
+  {
+    file: '.github/actions/docker-remote-build/action.yml',
+    expect: { sidecar: false, vllm_sidecar: false, sglang_sidecar: false, trtllm_sidecar: false, core: true },
+    desc: 'shared remote build action does not trigger sidecar container jobs'
   },
 
   // Doc files should be excluded from core (negation patterns)
diff --git a/.github/workflows/nightly-ci.yml b/.github/workflows/nightly-ci.yml
index b802f577b0be..7316b3ea97d2 100644
--- a/.github/workflows/nightly-ci.yml
+++ b/.github/workflows/nightly-ci.yml
@@ -329,6 +329,63 @@ jobs:
       dev_version_suffix: ${{ needs.compute-dev-version.outputs.dev_suffix }}
     secrets: inherit
 
+  vllm-sidecar-build:
+    name: vllm-sidecar
+    needs: [create-fresh-builder, resolve-source-sha]
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: vllm
+      target: sidecar
+      dockerfile: lib/sidecar/vllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.create-fresh-builder.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+      source_ref: ${{ needs.resolve-source-sha.outputs.source_sha }}
+      image_tag_suffix: '-nightly'
+    secrets: inherit
+
+  sglang-sidecar-build:
+    name: sglang-sidecar
+    needs: [create-fresh-builder, resolve-source-sha]
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: sglang
+      target: sidecar
+      dockerfile: lib/sidecar/sglang/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.create-fresh-builder.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+      source_ref: ${{ needs.resolve-source-sha.outputs.source_sha }}
+      image_tag_suffix: '-nightly'
+    secrets: inherit
+
+  trtllm-sidecar-build:
+    name: trtllm-sidecar
+    needs: [create-fresh-builder, resolve-source-sha]
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: trtllm
+      target: sidecar
+      dockerfile: lib/sidecar/trtllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.create-fresh-builder.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+      source_ref: ${{ needs.resolve-source-sha.outputs.source_sha }}
+      image_tag_suffix: '-nightly'
+    secrets: inherit
+
   # ============================================================================
   # OPTIONAL NIGHTLY IMAGES (operator, planner, frontend, runtime EFA
   # variants)
@@ -1460,7 +1517,7 @@ jobs:
     name: Clean K8s builder if exists
     runs-on: prod-default-small-v2
     if: always()
-    needs: [vllm-build, sglang-build, trtllm-build, dynamo-pipeline, operator-build, planner-build, frontend-build, vllm-efa-build, sglang-efa-build, trtllm-efa-build, create-fresh-builder]
+    needs: [vllm-build, sglang-build, trtllm-build, vllm-sidecar-build, sglang-sidecar-build, trtllm-sidecar-build, dynamo-pipeline, operator-build, planner-build, frontend-build, vllm-efa-build, sglang-efa-build, trtllm-efa-build, create-fresh-builder]
     permissions:
       contents: read
     steps:
@@ -1482,7 +1539,7 @@ jobs:
   ############################## SLACK NOTIFICATION ##############################
   notify-slack:
     if: always()
-    needs: [vllm-test, vllm-multi-gpu-test, vllm-4-gpu-test, vllm-h100-test, sglang-test, sglang-multi-gpu-test, sglang-4-gpu-test, sglang-h100-test, trtllm-test, trtllm-multi-gpu-test, trtllm-h100-test, deploy-cleanup, rust-tests]
+    needs: [vllm-test, vllm-multi-gpu-test, vllm-4-gpu-test, vllm-h100-test, sglang-test, sglang-multi-gpu-test, sglang-4-gpu-test, sglang-h100-test, trtllm-test, trtllm-multi-gpu-test, trtllm-h100-test, vllm-sidecar-build, sglang-sidecar-build, trtllm-sidecar-build, deploy-cleanup, rust-tests]
     permissions:
       contents: read
       actions: read   # grant the reusable notifier read access to list this run's jobs
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index bc898f074bf3..78ac589fb6b1 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -3,6 +3,10 @@
 
 name: PR
 
+permissions:
+  contents: read
+  packages: read
+
 on:
   push:
     branches:
@@ -40,6 +44,9 @@ jobs:
       frontend: ${{ steps.changes.outputs.frontend }}
       benchmarks: ${{ steps.changes.outputs.benchmarks }}
       sample: ${{ steps.changes.outputs.sample }}
+      vllm_sidecar: ${{ steps.changes.outputs.vllm_sidecar }}
+      sglang_sidecar: ${{ steps.changes.outputs.sglang_sidecar }}
+      trtllm_sidecar: ${{ steps.changes.outputs.trtllm_sidecar }}
       efa: ${{ steps.changes.outputs.efa }}
       base_ref: ${{ steps.changes.outputs.base_ref }}
       merge_base_sha: ${{ steps.changes.outputs.merge_base_sha }}
@@ -159,6 +166,9 @@ jobs:
       - frontend-build
       - frontend-test
       - frontend-copy-to-acr
+      - vllm-sidecar-build
+      - sglang-sidecar-build
+      - trtllm-sidecar-build
     if: always()
     steps:
       - name: Check all dependent jobs
@@ -337,6 +347,64 @@ jobs:
       - name: Lint and test Helm chart
         run: make -C deploy/helm/charts/power-agent lint test
 
+# ============================================================================
+# SIDECAR CONTAINERS
+# ============================================================================
+
+  vllm-sidecar-build:
+    name: vllm-sidecar
+    needs: [changed-files]
+    if: needs.changed-files.outputs.vllm_sidecar == 'true'
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: vllm
+      target: sidecar
+      dockerfile: lib/sidecar/vllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.changed-files.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+    secrets: inherit
+
+  sglang-sidecar-build:
+    name: sglang-sidecar
+    needs: [changed-files]
+    if: needs.changed-files.outputs.sglang_sidecar == 'true'
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: sglang
+      target: sidecar
+      dockerfile: lib/sidecar/sglang/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.changed-files.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+    secrets: inherit
+
+  trtllm-sidecar-build:
+    name: trtllm-sidecar
+    needs: [changed-files]
+    if: needs.changed-files.outputs.trtllm_sidecar == 'true'
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: trtllm
+      target: sidecar
+      dockerfile: lib/sidecar/trtllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.changed-files.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+    secrets: inherit
+
 # ============================================================================
 # FRAMEWORK PIPELINES (Build → Test → Copy)
 # ============================================================================
@@ -1969,6 +2037,9 @@ jobs:
       - trtllm-multi-gpu-test
       - trtllm-efa-build
       - dynamo-pipeline
+      - vllm-sidecar-build
+      - sglang-sidecar-build
+      - trtllm-sidecar-build
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
diff --git a/.github/workflows/shared-build-image.yml b/.github/workflows/shared-build-image.yml
index 27e44ac6ec83..cc1e0ccc6c3d 100644
--- a/.github/workflows/shared-build-image.yml
+++ b/.github/workflows/shared-build-image.yml
@@ -15,6 +15,16 @@ on:
         required: false
         type: string
         default: 'runtime'
+      dockerfile:
+        description: 'Existing Dockerfile to build instead of rendering one. Empty uses container/render.py.'
+        required: false
+        type: string
+        default: ''
+      build_target:
+        description: 'Docker build target override. Empty uses the target input.'
+        required: false
+        type: string
+        default: ''
       cuda_version:
         description: 'CUDA versions to build as a JSON array'
         required: true
@@ -27,6 +37,11 @@ on:
         description: 'Buildkit builder name'
         required: true
         type: string
+      builder_flavor:
+        description: 'BuildKit worker flavor override. Empty derives the flavor from framework.'
+        required: false
+        type: string
+        default: ''
       build_timeout_minutes:
         description: 'Timeout in minutes for the build step'
         required: false
@@ -73,7 +88,7 @@ on:
         type: string
         default: ''
       build_only:
-        description: 'Build and push only — skip tests and prepare branch tags'
+        description: 'Build and push only — skip the test image build'
         required: false
         type: boolean
         default: false
@@ -294,11 +309,16 @@ jobs:
       - name: Calculate Builder Flavor
         id: calculate-builder-flavor
         shell: bash
+        env:
+          BUILDER_FLAVOR: ${{ inputs.builder_flavor }}
+          FRAMEWORK: ${{ inputs.framework }}
         run: |
-          if [[ ${{ inputs.framework }} != @(vllm|sglang|trtllm) ]]; then
+          if [ -n "${BUILDER_FLAVOR}" ]; then
+            echo "builder_flavor=${BUILDER_FLAVOR}" >> "$GITHUB_OUTPUT"
+          elif [[ "${FRAMEWORK}" != @(vllm|sglang|trtllm) ]]; then
             echo "builder_flavor=general" >> $GITHUB_OUTPUT
           else
-            echo "builder_flavor=${{ inputs.framework }}" >> $GITHUB_OUTPUT
+            echo "builder_flavor=${FRAMEWORK}" >> $GITHUB_OUTPUT
           fi
       - name: Initialize Dynamo Builder
         uses: $/.github/actions/init-dynamo-builder
@@ -451,6 +471,7 @@ jobs:
           namespace: ${{ vars.BUILDKIT_NAMESPACE }}
       - name: Generate Dockerfile
         id: gen-dockerfile
+        if: inputs.dockerfile == ''
         shell: bash
         run: |
           echo "Generating Dockerfile for target: ${{ inputs.target }} and framework: ${{ inputs.framework }}"
@@ -483,6 +504,17 @@ jobs:
           STEM=$(grep -E '^ARG BASELINE_SBOM_FILE=' container/rendered.Dockerfile | head -1 \
                  | sed -E 's/^ARG BASELINE_SBOM_FILE="?([^"]*)"?$/\1/' || true)
           echo "baseline_stem=${STEM}" >> "$GITHUB_OUTPUT"
+      - name: Use supplied Dockerfile
+        if: inputs.dockerfile != ''
+        shell: bash
+        env:
+          DOCKERFILE: ${{ inputs.dockerfile }}
+        run: |
+          if [ ! -f "${DOCKERFILE}" ]; then
+            echo "::error::Dockerfile not found: ${DOCKERFILE}"
+            exit 1
+          fi
+          cp -- "${DOCKERFILE}" container/rendered.Dockerfile
       - name: Apply nightly dev version
         if: inputs.dev_version_suffix != ''
         shell: bash
@@ -495,7 +527,7 @@ jobs:
           image_tag: ${{ steps.calculate-target-tag.outputs.image_uri }}
           framework: ${{ inputs.framework }}
           target: ${{ inputs.target }}
-          build_target: ${{ (inputs.make_efa && (inputs.target == 'runtime' || inputs.target == 'dev')) && 'aws' || inputs.target }}
+          build_target: ${{ inputs.build_target != '' && inputs.build_target || ((inputs.make_efa && (inputs.target == 'runtime' || inputs.target == 'dev')) && 'aws' || inputs.target) }}
           platform: ${{ inputs.platform }}
           cuda_version: ${{ matrix.cuda_version }}
           aws_default_region: ${{ vars.AWS_DEFAULT_REGION }}
@@ -616,7 +648,7 @@ jobs:
           # RC promotions inherit the source archive.
           archive_sources: ${{ inputs.archive_sources }}
       - name: Refresh BuildKit builder
-        if: ${{ inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.target != 'frontend' }}
+        if: ${{ !inputs.build_only && inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.target != 'frontend' }}
         uses: $/.github/actions/builder-refresher
         with:
           builder_name: ${{ inputs.builder_name }}
@@ -625,7 +657,7 @@ jobs:
           cuda_version: ${{ matrix.cuda_version }}
           namespace: ${{ vars.BUILDKIT_NAMESPACE }}
       - name: Build and Push Test Image
-        if: ${{ !inputs.compliance_only && inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.target != 'frontend' }}
+        if: ${{ !inputs.build_only && !inputs.compliance_only && inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.target != 'frontend' }}
         shell: bash
         run: |
           PUSH_ARGS=""
diff --git a/lib/sidecar/sglang/Dockerfile b/lib/sidecar/sglang/Dockerfile
index 6b3343dbc916..82d6432b876b 100644
--- a/lib/sidecar/sglang/Dockerfile
+++ b/lib/sidecar/sglang/Dockerfile
@@ -7,7 +7,11 @@
 #
 #   docker build -f lib/sidecar/sglang/Dockerfile -t dynamo-sglang-sidecar:1.3.0 .
 
-FROM rust:1.96.1-bookworm AS builder
+# CI sets DOCKER_PROXY to the authenticated Docker Hub mirror. It remains empty
+# for the documented local build command.
+ARG DOCKER_PROXY=
+
+FROM ${DOCKER_PROXY}library/rust:1.96.1-bookworm AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
         cmake \
         clang \
@@ -23,7 +27,7 @@ COPY . .
 RUN cargo build --release --locked -p dynamo-sglang-sidecar \
     && strip target/release/dynamo-sglang-sidecar
 
-FROM debian:bookworm-slim AS runtime
+FROM ${DOCKER_PROXY}library/debian:bookworm-slim AS runtime
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
     && rm -rf /var/lib/apt/lists/* \
diff --git a/lib/sidecar/trtllm/Dockerfile b/lib/sidecar/trtllm/Dockerfile
index 864f647e5d22..9d32a0498ae6 100644
--- a/lib/sidecar/trtllm/Dockerfile
+++ b/lib/sidecar/trtllm/Dockerfile
@@ -7,7 +7,11 @@
 #
 #   docker build -f lib/sidecar/trtllm/Dockerfile -t dynamo-trtllm-sidecar:1.3.0 .
 
-FROM rust:1.96.1-bookworm AS builder
+# CI sets DOCKER_PROXY to the authenticated Docker Hub mirror. It remains empty
+# for the documented local build command.
+ARG DOCKER_PROXY=
+
+FROM ${DOCKER_PROXY}library/rust:1.96.1-bookworm AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
         cmake \
         clang \
@@ -23,7 +27,7 @@ COPY . .
 RUN cargo build --release --locked -p dynamo-trtllm-sidecar \
     && strip target/release/dynamo-trtllm-sidecar
 
-FROM debian:bookworm-slim AS runtime
+FROM ${DOCKER_PROXY}library/debian:bookworm-slim AS runtime
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
     && rm -rf /var/lib/apt/lists/* \
diff --git a/lib/sidecar/vllm/Dockerfile b/lib/sidecar/vllm/Dockerfile
index 3abdc9e35133..f653fe3a2dc2 100644
--- a/lib/sidecar/vllm/Dockerfile
+++ b/lib/sidecar/vllm/Dockerfile
@@ -11,9 +11,13 @@
 # Build from the repository root (the workspace is needed to compile the crate):
 #   docker build -f lib/sidecar/vllm/Dockerfile -t dynamo-vllm-sidecar:1.3.0 .
 
+# CI sets DOCKER_PROXY to the authenticated Docker Hub mirror. It remains empty
+# for the documented local build command.
+ARG DOCKER_PROXY=
+
 # ---- builder ----------------------------------------------------------------
 # Pinned to the workspace toolchain (rust-toolchain.toml: 1.96.1).
-FROM rust:1.96.1-bookworm AS builder
+FROM ${DOCKER_PROXY}library/rust:1.96.1-bookworm AS builder
 
 # aws-lc-sys/ring need cmake + a C toolchain (+perl); bindgen needs libclang;
 # tonic-build (build.rs) needs protoc. libprotobuf-dev supplies the well-known
@@ -39,7 +43,7 @@ RUN cargo build --release --locked -p dynamo-vllm-sidecar \
     && strip target/release/dynamo-vllm-sidecar
 
 # ---- runtime (minimal) ------------------------------------------------------
-FROM debian:bookworm-slim AS runtime
+FROM ${DOCKER_PROXY}library/debian:bookworm-slim AS runtime
 
 # ca-certificates: HTTPS to Hugging Face for the tokenizer, and rustls TLS to
 # etcd/NATS. TLS crypto (aws-lc-rs) is statically linked, so no libssl needed.