diff --git a/Dockerfile b/Dockerfile
index 7e2236c..4e36225 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,15 @@
 # validate commands) throws "Invalid URL" on $ref, so no ace command starts.
 ARG NODE_VERSION=24.16
 
+# The Rust worker (before the app: its image carries edge-bench). Registry and target dir are build caches, so a rebuild only compiles what changed.
+FROM rust:1-bookworm AS edge-build
+WORKDIR /src
+COPY edge ./
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/src/target \
+    cargo build --release --locked --bin edge-node --bin edge-bench \
+ && cp target/release/edge-node target/release/edge-bench /usr/local/bin/
+
 # The app, compiled, with production dependencies only.
 FROM node:${NODE_VERSION}-bookworm AS app-build
 WORKDIR /src
@@ -28,15 +37,6 @@ USER node
 # Every service picks its own command, e.g. `node ace coordinator:run`.
 CMD ["node", "ace", "list"]
 
-# The Rust worker. Registry and target dir are build caches, so a rebuild only compiles what changed.
-FROM rust:1-bookworm AS edge-build
-WORKDIR /src
-COPY edge ./
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/src/target \
-    cargo build --release --locked --bin edge-node --bin edge-bench \
- && cp target/release/edge-node target/release/edge-bench /usr/local/bin/
-
 FROM debian:bookworm-slim AS edge
 COPY --from=edge-build /usr/local/bin/edge-node /usr/local/bin/edge-node
 # edge-bench replays the corpus for the grouping sweeps (deploy/corpus_sweep.py).