diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index c41c661..c316a02 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -83,6 +83,7 @@ jobs:
               deploy/bird/*)                               bird_conf=true ;;
               deploy/docker/bird/*)                        docker_bird=true; docker_go=true ;;
               deploy/docker/gobinary/*)                    docker_go=true ;;
+              deploy/docker/docker-bake.hcl)               docker_go=true; docker_web=true ;;
               deploy/docker/evobgp-agent/*)                docker_go=true ;;
               deploy/docker/evobgp-web/*)                  docker_web=true ;;
               deploy/docker/bird2/*)                       docker_bird=true ;;
@@ -129,7 +130,9 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.24"
+          cache: true
+          cache-dependency-path: go.sum
       - name: Vet
         run: go vet ./...
       - name: Test
@@ -183,14 +186,10 @@ jobs:
           done
 
   # ---------------------------------------------------------------------------
-  # Docker: Go-бинарники (api, all, scheduler, ingest, render, deploy, node, agent).
-  # Запускается если изменился Go-код или Go-Dockerfile.
-  # Если Go-код менялся — требуем успех go-тестов; если только Dockerfile — go skipped, ОК.
-  #
-  # docker-go-prime: один раз собирает stage `deps` (go mod download) и пишет BuildKit cache
-  # в registry — матрица docker-go не качает модули восемь раз подряд.
+  # Docker: все Go-образы одним buildx bake (один go mod download, одна компиляция cmd/*,
+  # birdc собирается один раз для api/all). Registry cache: evobgp-buildcache:go-buildcache.
   # ---------------------------------------------------------------------------
-  docker-go-prime:
+  docker-go:
     needs: [changes, go]
     if: >-
       always() &&
@@ -200,91 +199,6 @@ jobs:
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
       (needs.changes.outputs.go == 'true' || needs.changes.outputs.docker_go == 'true')
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Prepare image metadata
-        id: meta
-        run: |
-          set -euo pipefail
-          owner_lc="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
-          echo "owner_lc=$owner_lc" >> "$GITHUB_OUTPUT"
-      - name: Log in to Gitea Registry
-        uses: docker/login-action@v3
-        with:
-          registry: git.shts.su
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.ACTIONS_PAT || gitea.token }}
-      - name: Prime Go module layer (deps)
-        env:
-          OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
-        run: |
-          set -euxo pipefail
-          WS="${{ github.workspace }}"
-          CACHE_REF="git.shts.su/${OWNER_LC}/evobgp-buildcache:go-buildcache"
-          cd "$WS"
-          docker buildx build \
-            --platform linux/amd64 \
-            --file deploy/docker/gobinary/Dockerfile \
-            --target deps \
-            --cache-from "type=registry,ref=${CACHE_REF}" \
-            --cache-to "type=registry,ref=${CACHE_REF},mode=max" \
-            "$WS"
-
-  docker-go:
-    needs: [changes, go, docker-go-prime]
-    if: >-
-      always() &&
-      needs.changes.result == 'success' &&
-      needs.go.result != 'failure' &&
-      needs.docker-go-prime.result == 'success' &&
-      github.event_name == 'push' &&
-      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
-      (needs.changes.outputs.go == 'true' || needs.changes.outputs.docker_go == 'true')
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: evobgp-api
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-api
-            birdc: "1"
-            evobgp_upstream: ""
-          - image: evobgp-all
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-all
-            birdc: "1"
-            evobgp_upstream: ""
-          - image: evobgp-scheduler
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-scheduler
-            birdc: "0"
-            evobgp_upstream: ""
-          - image: evobgp-ingest
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-ingest
-            birdc: "0"
-            evobgp_upstream: ""
-          - image: evobgp-render
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-render
-            birdc: "0"
-            evobgp_upstream: ""
-          - image: evobgp-deploy
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-deploy
-            birdc: "0"
-            evobgp_upstream: ""
-          - image: evobgp-node
-            dockerfile: deploy/docker/gobinary/Dockerfile
-            bin: evobgp-node
-            birdc: "0"
-            evobgp_upstream: ""
-          - image: evobgp-agent
-            dockerfile: deploy/docker/evobgp-agent/Dockerfile
-            evobgp_upstream: ""
     steps:
       - uses: actions/checkout@v4
       - name: Set up Docker Buildx
@@ -303,46 +217,23 @@ jobs:
           registry: git.shts.su
           username: ${{ gitea.actor }}
           password: ${{ secrets.ACTIONS_PAT || gitea.token }}
-      - name: Build and push ${{ matrix.image }}
+      - name: Build and push Go images (bake)
         env:
           OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
           SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
-          DF: ${{ matrix.dockerfile }}
-          IMAGE: ${{ matrix.image }}
-          BIN: ${{ matrix.bin }}
-          BIRDC: ${{ matrix.birdc }}
-          EVOBGP_UPSTREAM: ${{ matrix.evobgp_upstream }}
         run: |
           set -euxo pipefail
-          WS="${{ github.workspace }}"
-          cd "$WS"
-
-          CACHE_REF="git.shts.su/${OWNER_LC}/evobgp-buildcache:go-buildcache"
-          IMG="git.shts.su/${OWNER_LC}/${IMAGE}"
-          BUILD_ARGS=()
-          if [ -n "${BIN:-}" ]; then
-            BUILD_ARGS+=(--build-arg "BIN=${BIN}")
-            BUILD_ARGS+=(--build-arg "INSTALL_BIRDC=${BIRDC:-0}")
-          fi
-          if [ -n "${EVOBGP_UPSTREAM:-}" ]; then
-            BUILD_ARGS+=(--build-arg "EVOBGP_UPSTREAM=${EVOBGP_UPSTREAM}")
-          fi
-
-          docker buildx build \
-            --platform linux/amd64 \
-            --file "$DF" \
-            "${BUILD_ARGS[@]}" \
-            --cache-from "type=registry,ref=${CACHE_REF}" \
-            --cache-to "type=registry,ref=${CACHE_REF},mode=max" \
-            --tag "${IMG}:latest" \
-            --tag "${IMG}:${SHORT_SHA}" \
-            --tag "${IMG}:sha-${{ github.sha }}" \
+          cd "${{ github.workspace }}/deploy/docker"
+          docker buildx bake -f docker-bake.hcl go-images \
             --push \
-            "$WS"
+            --set "*.REGISTRY=git.shts.su/${OWNER_LC}" \
+            --set "*.IMAGE_TAG=latest" \
+            --set "*.SHORT_SHA=${SHORT_SHA}" \
+            --set "*.SHA_FULL=${{ github.sha }}" \
+            --set "*.CACHE_REF_GO=git.shts.su/${OWNER_LC}/evobgp-buildcache:go-buildcache"
 
   # ---------------------------------------------------------------------------
-  # Docker: Web-фронтенд (evobgp-web, evobgp-web-all).
-  # Не зависит от Go-тестов — SvelteKit собирается отдельно.
+  # Docker: Web (evobgp-web, evobgp-web-all) — один npm ci (кэш) + два nginx-тега.
   # ---------------------------------------------------------------------------
   docker-web:
     needs: [changes]
@@ -351,16 +242,6 @@ jobs:
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
       (needs.changes.outputs.web == 'true' || needs.changes.outputs.docker_web == 'true')
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: evobgp-web
-            dockerfile: deploy/docker/evobgp-web/Dockerfile
-            evobgp_upstream: ""
-          - image: evobgp-web-all
-            dockerfile: deploy/docker/evobgp-web/Dockerfile
-            evobgp_upstream: evobgp-all
     steps:
       - uses: actions/checkout@v4
       - name: Set up Docker Buildx
@@ -379,33 +260,20 @@ jobs:
           registry: git.shts.su
           username: ${{ gitea.actor }}
           password: ${{ secrets.ACTIONS_PAT || gitea.token }}
-      - name: Build and push ${{ matrix.image }}
+      - name: Build and push Web images (bake)
         env:
           OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
           SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
-          DF: ${{ matrix.dockerfile }}
-          IMAGE: ${{ matrix.image }}
-          EVOBGP_UPSTREAM: ${{ matrix.evobgp_upstream }}
         run: |
           set -euxo pipefail
-          WS="${{ github.workspace }}"
-          cd "$WS"
-
-          IMG="git.shts.su/${OWNER_LC}/${IMAGE}"
-          BUILD_ARGS=()
-          if [ -n "${EVOBGP_UPSTREAM:-}" ]; then
-            BUILD_ARGS+=(--build-arg "EVOBGP_UPSTREAM=${EVOBGP_UPSTREAM}")
-          fi
-
-          docker buildx build \
-            --platform linux/amd64 \
-            --file "$DF" \
-            "${BUILD_ARGS[@]}" \
-            --tag "${IMG}:latest" \
-            --tag "${IMG}:${SHORT_SHA}" \
-            --tag "${IMG}:sha-${{ github.sha }}" \
+          cd "${{ github.workspace }}/deploy/docker"
+          docker buildx bake -f docker-bake.hcl web-images \
             --push \
-            "$WS"
+            --set "*.REGISTRY=git.shts.su/${OWNER_LC}" \
+            --set "*.IMAGE_TAG=latest" \
+            --set "*.SHORT_SHA=${SHORT_SHA}" \
+            --set "*.SHA_FULL=${{ github.sha }}" \
+            --set "*.CACHE_REF_WEB=git.shts.su/${OWNER_LC}/evobgp-buildcache:web-buildcache"
 
   # ---------------------------------------------------------------------------
   # Docker: BIRD2 (evobgp-bird2).
@@ -436,20 +304,16 @@ jobs:
           registry: git.shts.su
           username: ${{ gitea.actor }}
           password: ${{ secrets.ACTIONS_PAT || gitea.token }}
-      - name: Build and push evobgp-bird2
+      - name: Build and push evobgp-bird2 (bake)
         env:
           OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
           SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
         run: |
           set -euxo pipefail
-          WS="${{ github.workspace }}"
-          IMG="git.shts.su/${OWNER_LC}/evobgp-bird2"
-
-          docker buildx build \
-            --platform linux/amd64 \
-            --file deploy/docker/bird2/Dockerfile \
-            --tag "${IMG}:latest" \
-            --tag "${IMG}:${SHORT_SHA}" \
-            --tag "${IMG}:sha-${{ github.sha }}" \
+          cd "${{ github.workspace }}/deploy/docker"
+          docker buildx bake -f docker-bake.hcl evobgp-bird2 \
             --push \
-            "$WS"
+            --set "*.REGISTRY=git.shts.su/${OWNER_LC}" \
+            --set "*.IMAGE_TAG=latest" \
+            --set "*.SHORT_SHA=${SHORT_SHA}" \
+            --set "*.SHA_FULL=${{ github.sha }}"
diff --git a/deploy/docker/README.md b/deploy/docker/README.md
new file mode 100644
index 0000000..e8975fe
--- /dev/null
+++ b/deploy/docker/README.md
@@ -0,0 +1,40 @@
+# Docker-образы EvoBGP
+
+## CI (Gitea Actions)
+
+Сборка образов — **`docker buildx bake`** (`deploy/docker/docker-bake.hcl`), а не матрица из восьми отдельных `docker build`.
+
+| Было | Стало |
+|------|--------|
+| 8× `go mod download` + 8× `go build` (разные BIN) | 1× download + 1× компиляция всех `cmd/*` |
+| 2× сборка BIRD из исходников (api, all) | 1× stage `birdc`, копируется в runtime |
+| 2× `npm ci` (web, web-all) | 1× `web-deps` + два nginx-образа |
+| 8 runner'ов с checkout/login | 1 job `docker-go`, 1 job `docker-web` |
+
+Кэш registry (переменные bake):
+
+- `git.shts.su/<owner>/evobgp-buildcache:go-buildcache`
+- `git.shts.su/<owner>/evobgp-buildcache:web-buildcache`
+
+Локально BuildKit также кэширует `/go/pkg/mod` и `~/.cache/go-build` через `RUN --mount=type=cache`.
+
+## Локальная сборка
+
+Из корня репозитория:
+
+```bash
+cd deploy/docker
+docker buildx bake -f docker-bake.hcl go-images
+docker buildx bake -f docker-bake.hcl web-images
+```
+
+Один образ (legacy):
+
+```bash
+docker build -f deploy/docker/gobinary/Dockerfile \
+  --target build-all \
+  --build-arg BIN=evobgp-api \
+  -t evobgp-api:local .
+```
+
+Runtime-образы в bake ожидают stage `build-all` (через bake contexts), не отдельный `--build-arg BIN` на старый target `build`.
diff --git a/deploy/docker/docker-bake.hcl b/deploy/docker/docker-bake.hcl
new file mode 100644
index 0000000..9245b3a
--- /dev/null
+++ b/deploy/docker/docker-bake.hcl
@@ -0,0 +1,227 @@
+# Единая сборка образов EvoBGP для CI (buildx bake из deploy/docker/).
+# Переменные: REGISTRY, IMAGE_TAG, CACHE_REF_GO, CACHE_REF_WEB
+
+variable "REGISTRY" {
+  default = "git.shts.su/evobgp"
+}
+
+variable "IMAGE_TAG" {
+  default = "latest"
+}
+
+variable "SHORT_SHA" {
+  default = "dev"
+}
+
+variable "SHA_FULL" {
+  default = ""
+}
+
+variable "CACHE_REF_GO" {
+  default = ""
+}
+
+variable "CACHE_REF_WEB" {
+  default = ""
+}
+
+function "go-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_GO) ? ["type=registry,ref=${CACHE_REF_GO}"] : []
+}
+
+function "go-cache-to" {
+  params = []
+  result = notequal("", CACHE_REF_GO) ? ["type=registry,ref=${CACHE_REF_GO},mode=max"] : []
+}
+
+function "web-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_WEB) ? ["type=registry,ref=${CACHE_REF_WEB}"] : []
+}
+
+function "web-cache-to" {
+  params = []
+  result = notequal("", CACHE_REF_WEB) ? ["type=registry,ref=${CACHE_REF_WEB},mode=max"] : []
+}
+
+group "default" {
+  targets = ["go-images", "web-images", "evobgp-bird2"]
+}
+
+group "go-images" {
+  targets = [
+    "evobgp-api",
+    "evobgp-all",
+    "evobgp-scheduler",
+    "evobgp-ingest",
+    "evobgp-render",
+    "evobgp-deploy",
+    "evobgp-node",
+    "evobgp-agent",
+  ]
+}
+
+group "web-images" {
+  targets = ["evobgp-web", "evobgp-web-all"]
+}
+
+# --- Go: go mod download → все cmd/* → birdc (один раз) → runtime-образы ---
+
+target "go-deps" {
+  context    = "../.."
+  dockerfile = "gobinary/Dockerfile"
+  target     = "deps"
+  platforms  = ["linux/amd64"]
+  cache-from = go-cache-from()
+  cache-to   = go-cache-to()
+}
+
+target "go-build-all" {
+  context    = "../.."
+  dockerfile = "gobinary/Dockerfile"
+  target     = "build-all"
+  platforms  = ["linux/amd64"]
+  contexts = {
+    deps = "target:go-deps"
+  }
+  cache-from = go-cache-from()
+  cache-to   = go-cache-to()
+}
+
+target "go-birdc" {
+  context    = "../.."
+  dockerfile = "gobinary/Dockerfile"
+  target     = "birdc"
+  platforms  = ["linux/amd64"]
+  cache-from = go-cache-from()
+  cache-to   = go-cache-to()
+}
+
+target "_go-runtime" {
+  context    = "../.."
+  dockerfile = "gobinary/Dockerfile"
+  target     = "runtime"
+  platforms  = ["linux/amd64"]
+  contexts = {
+    build-all = "target:go-build-all"
+  }
+  cache-from = go-cache-from()
+  cache-to   = go-cache-to()
+}
+
+target "_go-runtime-birdc" {
+  context    = "../.."
+  dockerfile = "gobinary/Dockerfile"
+  target     = "runtime-birdc"
+  platforms  = ["linux/amd64"]
+  contexts = {
+    build-all = "target:go-build-all"
+    birdc     = "target:go-birdc"
+  }
+  cache-from = go-cache-from()
+  cache-to   = go-cache-to()
+}
+
+function "image-tags" {
+  params = [name]
+  result = notequal("", SHA_FULL) ? [
+    "${REGISTRY}/${name}:${IMAGE_TAG}",
+    "${REGISTRY}/${name}:${SHORT_SHA}",
+    "${REGISTRY}/${name}:sha-${SHA_FULL}",
+  ] : [
+    "${REGISTRY}/${name}:${IMAGE_TAG}",
+    "${REGISTRY}/${name}:${SHORT_SHA}",
+  ]
+}
+
+target "evobgp-api" {
+  inherits = ["_go-runtime-birdc"]
+  args     = { BIN = "evobgp-api" }
+  tags     = image-tags("evobgp-api")
+}
+
+target "evobgp-all" {
+  inherits = ["_go-runtime-birdc"]
+  args     = { BIN = "evobgp-all" }
+  tags     = image-tags("evobgp-all")
+}
+
+target "evobgp-scheduler" {
+  inherits = ["_go-runtime"]
+  args     = { BIN = "evobgp-scheduler" }
+  tags     = image-tags("evobgp-scheduler")
+}
+
+target "evobgp-ingest" {
+  inherits = ["_go-runtime"]
+  args     = { BIN = "evobgp-ingest" }
+  tags     = image-tags("evobgp-ingest")
+}
+
+target "evobgp-render" {
+  inherits = ["_go-runtime"]
+  args     = { BIN = "evobgp-render" }
+  tags     = image-tags("evobgp-render")
+}
+
+target "evobgp-deploy" {
+  inherits = ["_go-runtime"]
+  args     = { BIN = "evobgp-deploy" }
+  tags     = image-tags("evobgp-deploy")
+}
+
+target "evobgp-node" {
+  inherits = ["_go-runtime"]
+  args     = { BIN = "evobgp-node" }
+  tags     = image-tags("evobgp-node")
+}
+
+target "evobgp-agent" {
+  context    = "../.."
+  dockerfile = "evobgp-agent/Dockerfile"
+  platforms  = ["linux/amd64"]
+  contexts = {
+    build-all = "target:go-build-all"
+  }
+  cache-from = go-cache-from()
+  cache-to   = go-cache-to()
+  tags       = image-tags("evobgp-agent")
+}
+
+# --- Web: npm ci (кэш) → build → nginx ---
+
+target "web-deps" {
+  context    = "../.."
+  dockerfile = "evobgp-web/Dockerfile"
+  target     = "deps"
+  platforms  = ["linux/amd64"]
+  cache-from = web-cache-from()
+  cache-to   = web-cache-to()
+}
+
+target "evobgp-web" {
+  context    = "../.."
+  dockerfile = "evobgp-web/Dockerfile"
+  platforms  = ["linux/amd64"]
+  contexts = {
+    deps = "target:web-deps"
+  }
+  args       = { EVOBGP_UPSTREAM = "evobgp-api" }
+  cache-from = web-cache-from()
+  cache-to   = web-cache-to()
+  tags       = image-tags("evobgp-web")
+}
+
+target "evobgp-web-all" {
+  inherits   = ["evobgp-web"]
+  args       = { EVOBGP_UPSTREAM = "evobgp-all" }
+  tags       = image-tags("evobgp-web-all")
+}
+
+target "evobgp-bird2" {
+  context    = "../.."
+  dockerfile = "bird2/Dockerfile"
+  platforms  = ["linux/amd64"]
+  tags       = image-tags("evobgp-bird2")
+}
diff --git a/deploy/docker/evobgp-agent/Dockerfile b/deploy/docker/evobgp-agent/Dockerfile
index 0cfff27..174a7af 100644
--- a/deploy/docker/evobgp-agent/Dockerfile
+++ b/deploy/docker/evobgp-agent/Dockerfile
@@ -1,19 +1,10 @@
-# evobgp-agent + bird2 из репозитория Ubuntu Noble (тот же стек, что evobgp-bird2).
-# См. gobinary/Dockerfile — ECR Public вместо прямого pull с Docker Hub.
-# Порядок слоёв как в gobinary: кэш модулей отдельно от исходников (CI/CD BuildKit).
-FROM public.ecr.aws/docker/library/golang:1.24-bookworm AS deps
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-
-FROM deps AS build
-COPY . .
-RUN go build -trimpath -ldflags="-s -w" -o /out/evobgp-agent ./cmd/evobgp-agent
-
+# syntax=docker/dockerfile:1.7
+# Агент: бинарь из общего build-all (docker-bake.hcl → contexts.build-all), bird2 из apt.
 FROM public.ecr.aws/docker/library/ubuntu:noble
 RUN apt-get update \
-	&& apt-get install -y --no-install-recommends bird2 ca-certificates \
-	&& rm -rf /var/lib/apt/lists/*
-COPY --from=build /out/evobgp-agent /usr/local/bin/evobgp-agent
+    && apt-get install -y --no-install-recommends bird2 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+ARG BIN=evobgp-agent
+COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp-agent
 WORKDIR /etc/bird
 ENTRYPOINT ["/usr/local/bin/evobgp-agent"]
diff --git a/deploy/docker/evobgp-web/Dockerfile b/deploy/docker/evobgp-web/Dockerfile
index ad66e29..d2459fe 100644
--- a/deploy/docker/evobgp-web/Dockerfile
+++ b/deploy/docker/evobgp-web/Dockerfile
@@ -1,14 +1,18 @@
-# Статическая панель EvoBGP (SvelteKit) + nginx как reverse-proxy к evobgp-api (/v1, /metrics).
-# ECR Public — то же содержимое, что library/node и library/nginx на Docker Hub.
-FROM public.ecr.aws/docker/library/node:22-alpine AS build
+# syntax=docker/dockerfile:1.7
+# Статическая панель EvoBGP (SvelteKit) + nginx.
+FROM public.ecr.aws/docker/library/node:22-alpine AS deps
 WORKDIR /web
 COPY web/package.json web/package-lock.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm,sharing=locked \
+    npm ci
+
+FROM deps AS build
 COPY web/ ./
 RUN npm run build
 
 FROM public.ecr.aws/docker/library/nginx:1.27-alpine
 ARG EVOBGP_UPSTREAM=evobgp-api
 COPY deploy/docker/evobgp-web/nginx.conf /tmp/nginx-default.conf
-RUN sed -e "s/evobgp-api/${EVOBGP_UPSTREAM}/g" /tmp/nginx-default.conf > /etc/nginx/conf.d/default.conf && rm -f /tmp/nginx-default.conf
+RUN sed -e "s/evobgp-api/${EVOBGP_UPSTREAM}/g" /tmp/nginx-default.conf > /etc/nginx/conf.d/default.conf \
+    && rm -f /tmp/nginx-default.conf
 COPY --from=build /web/build /usr/share/nginx/html
diff --git a/deploy/docker/gobinary/Dockerfile b/deploy/docker/gobinary/Dockerfile
index d229eab..f41e87e 100644
--- a/deploy/docker/gobinary/Dockerfile
+++ b/deploy/docker/gobinary/Dockerfile
@@ -1,30 +1,49 @@
-# Универсальная сборка бинаря из cmd/* (ARG BIN=evobgp-api | evobgp-all).
-# INSTALL_BIRDC=1 собирает BIRD 2.14 из исходников (birdc) для EVOBGP_BIRDC_SOCKET; иначе пакет Debian не используется.
-# Базовые образы из ECR Public (официальное зеркало library/*), чтобы CI не зависел от auth.docker.io.
-# Отдельный stage для кэша модулей (CI: один раз --target deps, затем параллельные сборки с cache-from).
+# syntax=docker/dockerfile:1.7
+# Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
+# INSTALL_BIRDC=1 — birdc из stage birdc (собирается один раз, переиспользуется api/all).
+# CI: docker buildx bake -f deploy/docker/docker-bake.hcl
 FROM public.ecr.aws/docker/library/golang:1.24-bookworm AS deps
 WORKDIR /src
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+    go mod download
 
+FROM deps AS build-all
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
+    set -eux; \
+    mkdir -p /out; \
+    for d in cmd/*/; do \
+      name="$(basename "$d")"; \
+      CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o "/out/${name}" "./cmd/${name}"; \
+    done
+
+# Один бинарь (локальная сборка); в CI — build-all + runtime.
 FROM deps AS build
 COPY . .
 ARG BIN=evobgp-api
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/evobgp ./cmd/${BIN}
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/evobgp "./cmd/${BIN}"
 
-FROM public.ecr.aws/docker/library/debian:bookworm-slim
-ARG INSTALL_BIRDC=0
+FROM public.ecr.aws/docker/library/debian:bookworm-slim AS birdc
 ARG BIRD_VERSION=2.14
 COPY deploy/docker/bird/bird-from-source.sh /tmp/bird-from-source.sh
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
-  && if [ "$INSTALL_BIRDC" = "1" ]; then \
-    chmod +x /tmp/bird-from-source.sh \
+RUN chmod +x /tmp/bird-from-source.sh \
     && BIRD_VERSION="${BIRD_VERSION}" /tmp/bird-from-source.sh \
-    && rm -f /tmp/bird-from-source.sh; \
-  else \
-    rm -f /tmp/bird-from-source.sh; \
-  fi \
-  && rm -rf /var/lib/apt/lists/*
-COPY --from=build /out/evobgp /usr/local/bin/evobgp
+    && rm -f /tmp/bird-from-source.sh
+
+FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+FROM runtime-base AS runtime
+ARG BIN=evobgp-api
+COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
+
+FROM runtime AS runtime-birdc
+COPY --from=birdc /usr/local/sbin/bird /usr/local/sbin/birdc /usr/local/sbin/