diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 0e0f2f52..e1a592f1 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,5 +1,3 @@
-
-
 name: format
 
 on:
@@ -11,20 +9,10 @@ on:
 jobs:
   format:
     name: format
-    strategy:
-      matrix:
-        ocaml-compiler:
-            - '5.3'
-    runs-on: 'ubuntu-latest'
+    runs-on: ubuntu-latest
+    container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-4.14:latest
+
     steps:
-      - uses: actions/checkout@main
-      - name: Use OCaml ${{ matrix.ocaml-compiler }}
-        uses: ocaml/setup-ocaml@v3
-        with:
-          ocaml-compiler: ${{ matrix.ocaml-compiler }}
-          dune-cache: true
-          allow-prerelease-opam: true
+      - uses: actions/checkout@v6
 
-      - run: opam install ocamlformat.0.27.0 lwt.6.1.1
       - run: opam exec -- make format-check
-
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index a7c05904..4e43cbaf 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -8,27 +8,23 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-5.4:latest
+
     steps:
-      - uses: actions/checkout@main
-
-      # needed for depext to work
-      - run: sudo apt-get update && sudo apt-get install mccs
-
-      - uses: ocaml/setup-ocaml@v3
+      - uses: actions/checkout@v6
         with:
-          ocaml-compiler: '5.1.x'
-          dune-cache: true
-          allow-prerelease-opam: true
+          submodules: recursive
 
-      - run: |
-          opam pin trace https://github.com/ocaml-tracing/ocaml-trace.git#main -y -n
-          opam pin https://github.com/ocaml-tracing/ambient-context.git#main -y -n
+      - name: Install local packages
+        run: opam exec -- dune build @install && opam exec -- dune install
 
-      - name: Deps
-        run: opam install odig opentelemetry opentelemetry-client opentelemetry-lwt opentelemetry-cohttp opentelemetry-client-ocurl opentelemetry-client-ocurl-lwt opentelemetry-cohttp-lwt opentelemetry-cohttp-eio
-
-      - name: Build
-        run: opam exec -- odig odoc --cache-dir=_doc/ opentelemetry opentelemetry-client opentelemetry-lwt opentelemetry-cohttp opentelemetry-client-ocurl opentelemetry-client-ocurl-lwt opentelemetry-cohttp-lwt opentelemetry-cohttp-eio
+      - name: Build documentation
+        run: |
+          opam exec -- odig odoc --cache-dir=_doc/ \
+            opentelemetry opentelemetry-client opentelemetry-lwt \
+            opentelemetry-cohttp-lwt opentelemetry-client-ocurl \
+            opentelemetry-client-ocurl-lwt opentelemetry-client-cohttp-lwt \
+            opentelemetry-client-cohttp-eio opentelemetry-logs
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 53aa0b0b..454e9456 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,65 +11,37 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-latest
-            #- windows-latest
-            #- macos-latest
-        ocaml-compiler:
-          - 4.08.x
-          - 4.13.x
-          - 5.0.x
-          - 5.3.x
+        include:
+          - ocaml-version: "4.08"
+            container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-4.08:latest
+            eio: false
+          - ocaml-version: "4.14"
+            container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-4.14:latest
+            eio: false
+          - ocaml-version: "5.4"
+            container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-5.4:latest
+            eio: true
 
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
+    container: ${{ matrix.container }}
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
-      # needed for depext to work
-      - run: sudo apt-get update && sudo apt-get install mccs
-        if: ${{ matrix.os == 'ubuntu-latest' }}
+      - name: Build
+        run: opam exec -- dune build @install -p opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-cohttp-lwt,opentelemetry-client-ocurl,opentelemetry-client-ocurl-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs
 
-      - name: Use OCaml ${{ matrix.ocaml-compiler }}
-        uses: ocaml/setup-ocaml@v3
-        with:
-          ocaml-compiler: ${{ matrix.ocaml-compiler }}
-          opam-depext-flags: --with-test
-          dune-cache: true
-          allow-prerelease-opam: true
+      - name: Build eio packages
+        if: ${{ matrix.eio }}
+        run: opam exec -- dune build @install -p opentelemetry-client-cohttp-eio,opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-cohttp-lwt,opentelemetry-client-ocurl,opentelemetry-client-ocurl-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs
 
-      - run: |
-          opam install pbrt.4.0 -y
-          opam install ambient-context lwt.5.9.2
+      - name: Lint (protoc check)
+        run: opam exec -- dune build @lint
 
-      # We cannot install packages that need eio on ocaml versions before 5
-      - run: |
-          packages=$(ls ./*.opam | grep -v eio)
-          opam install $packages --deps-only --with-test --solver=mccs
-        if: ${{ ! (startsWith(matrix.ocaml-compiler, '5')) }}
+      - name: Check no generated files changed
+        run: git diff --exit-code
 
-      # We should be able to install all packages on ocaml 5
-      - run: opam install . --deps-only --with-test --solver=mccs
-        if: ${{ startsWith(matrix.ocaml-compiler, '5') }}
-
-      - run: opam exec -- dune build @install -p opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-client-ocurl,opentelemetry-cohttp-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs
-
-      - run: opam install trace
-      - run: opam exec -- dune build @install -p opentelemetry
-
-      - run: opam install lwt.6.1.1 -y
-        if: ${{ matrix.ocaml-compiler == '5.3.x' }}
-      - run: opam exec -- dune build @install -p opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-client-cohttp-lwt
-        if: ${{ matrix.ocaml-compiler == '5.3.x' }}
-
-      - run: opam install ocaml-protoc
-      - run: opam exec -- dune build @lint
-
-      # check that nothing changed
-      - run: git diff --exit-code
-
-      - run: opam exec -- dune build @runtest
-        if: ${{ matrix.os == 'ubuntu-latest' }}
+      - name: Run tests
+        run: opam exec -- dune build @runtest
diff --git a/.gitignore b/.gitignore
index 85d4d798..8f820f02 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ _opam
 *.install
 *.exe
 *.tmp
+/.env
diff --git a/Makefile b/Makefile
index d7f9a4ff..2780da81 100644
--- a/Makefile
+++ b/Makefile
@@ -36,6 +36,8 @@ WATCH ?= @all
 watch:
 	@dune build $(WATCH) -w $(OPTS)
 
+include deps/Makefile.ci
+
 VERSION=$(shell awk '/^version:/ {print $$2}' opentelemetry.opam)
 update_next_tag:
 	@echo "update version to $(VERSION)..."
diff --git a/deps/Makefile.ci b/deps/Makefile.ci
new file mode 100644
index 00000000..4b639198
--- /dev/null
+++ b/deps/Makefile.ci
@@ -0,0 +1,44 @@
+# CI Docker images — included by top-level Makefile
+CI_REGISTRY = ghcr.io/ocaml-tracing/ocaml-opentelemetry
+CI_VERSIONS = 4.08 4.14 5.4
+# To update: curl -s https://api.github.com/repos/ocaml/opam-repository/commits/master | jq -r .sha
+OPAM_REPO_COMMIT ?= 67472cd54293d750a62d6d4423024d55f77268b0
+CI_BASE_OS_PACKAGES = pkg-config libcurl4-openssl-dev libgmp-dev mccs
+
+CI_COMMON_PACKAGES = ptime hmap pbrt pbrt_yojson ambient-context mtime \
+    thread-local-storage lwt_ppx ambient-context-lwt \
+    cohttp cohttp-lwt cohttp-lwt-unix \
+    ezcurl ezcurl-lwt ocurl logs alcotest containers \
+    trace ocaml-protoc
+
+CI_PACKAGES_408 = $(CI_COMMON_PACKAGES) lwt.5.9.2
+CI_PACKAGES_414 = $(CI_COMMON_PACKAGES) lwt.5.9.2 ocamlformat.0.27.0
+CI_PACKAGES_54  = $(CI_COMMON_PACKAGES) lwt.6.1.1 \
+    ambient-context-eio cohttp-eio tls-eio ca-certs mirage-crypto-rng eio_main odig
+
+CI_BUILD = docker build -f deps/dockerfile.ocaml \
+    --build-arg OPAM_REPO_COMMIT=$(OPAM_REPO_COMMIT) \
+    --build-arg "BASE_OS_PACKAGES=$(CI_BASE_OS_PACKAGES)"
+
+build-ci-docker:
+	$(CI_BUILD) --build-arg OCAML_VERSION=4.08.1 --build-arg "BASE_PACKAGES=$(CI_PACKAGES_408)" -t $(CI_REGISTRY)/ci-4.08:latest .
+	$(CI_BUILD) --build-arg OCAML_VERSION=4.14.2 --build-arg "BASE_PACKAGES=$(CI_PACKAGES_414)" -t $(CI_REGISTRY)/ci-4.14:latest .
+	$(CI_BUILD) --build-arg OCAML_VERSION=5.4.1  --build-arg "BASE_PACKAGES=$(CI_PACKAGES_54)"  -t $(CI_REGISTRY)/ci-5.4:latest .
+
+CI_NON_EIO_PACKAGES = opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-cohttp-lwt,opentelemetry-client-ocurl,opentelemetry-client-ocurl-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs
+CI_RUN = docker run --pull=never --rm -t -v $(PWD):/src:z -w /src
+
+run-ci:
+	@for v in $(CI_VERSIONS); do \
+		echo "=== OCaml $$v ===" ; \
+		$(CI_RUN) $(CI_REGISTRY)/ci-$$v:latest \
+			sh -c "opam exec -- dune build @install -p $(CI_NON_EIO_PACKAGES) && opam exec -- dune build @runtest" \
+		|| exit 1 ; \
+	done
+	$(CI_RUN) $(CI_REGISTRY)/ci-5.4:latest \
+		opam exec -- dune build @install -p opentelemetry-client-cohttp-eio
+
+upload-ci-docker:
+	@for v in $(CI_VERSIONS); do \
+		docker push $(CI_REGISTRY)/ci-$$v:latest ; \
+	done || ( echo  "to login:  docker login ghcr.io -u <your-github-username>" ; exit 1 )
diff --git a/deps/dockerfile.ocaml b/deps/dockerfile.ocaml
new file mode 100644
index 00000000..ca178db3
--- /dev/null
+++ b/deps/dockerfile.ocaml
@@ -0,0 +1,38 @@
+ARG BASE_OS=ubuntu:24.04
+
+# --- Stage 1: base (shared, no OCaml) ---
+FROM $BASE_OS AS base
+ARG BASE_OS_PACKAGES=""
+ENV OPAMROOTISOK=1 OPAMYES=1 OPAMCONFIRMLEVEL=unsafe-yes
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates curl git unzip build-essential $BASE_OS_PACKAGES && \
+    rm -rf /var/lib/apt/lists/* && \
+    curl -fsSL https://github.com/ocaml/opam/releases/download/2.5.0/opam-2.5.0-x86_64-linux -o /usr/local/bin/opam && \
+    chmod +x /usr/local/bin/opam && \
+    git config --global --add safe.directory '*'
+WORKDIR /root/w
+
+# --- Stage 2: opam-setup (builds the switch, discarded) ---
+FROM base AS opam-setup
+ARG OCAML_VERSION
+ARG OPAM_REPO_COMMIT=master
+ARG BASE_PACKAGES=""
+
+RUN git init /tmp/opam-repo && cd /tmp/opam-repo && \
+    git remote add origin https://github.com/ocaml/opam-repository.git && \
+    git fetch --depth 1 origin $OPAM_REPO_COMMIT && \
+    git checkout FETCH_HEAD
+
+RUN opam init --disable-sandboxing --bare --no-setup -k local /tmp/opam-repo && \
+    opam switch create /root/w --packages=ocaml-base-compiler.$OCAML_VERSION
+
+RUN opam install --no-depexts $BASE_PACKAGES && \
+    opam clean -a -y && \
+    rm -rf /tmp/opam-repo
+
+# --- Stage 3: final image (base + switch only) ---
+FROM base
+COPY --from=opam-setup /root/.opam /root/.opam
+COPY --from=opam-setup /root/w/_opam /root/w/_opam
+ENV OPAMROOT=/root/.opam OPAMSWITCH=/root/w PATH=/root/w/_opam/bin:$PATH
+WORKDIR /root/w