diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dad4c8e..b532843 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,4 +1,10 @@
 ---
+workflow:
+  rules:
+  - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  - if: '$CI_COMMIT_TAG'
+  - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
 stages:
 - test
 - publish
diff --git a/.gitlab/ci/cv-gitlab-ci.yml b/.gitlab/ci/cv-gitlab-ci.yml
index 3a1c816..f6f097a 100644
--- a/.gitlab/ci/cv-gitlab-ci.yml
+++ b/.gitlab/ci/cv-gitlab-ci.yml
@@ -1,15 +1,28 @@
 ---
 .use-cv-builder:
-  image: ${IMAGE_NAME}:master-8b42c9fd
+  image: ${IMAGE_NAME}:master-cb8a29c7
 
 .test-conditions:
-  only:
-    refs:
-    - merge_requests
-  except:
+  rules:
+  - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    when: always
+  - if:
     changes:
     - docker/Dockerfile
     - __output/*
+    when: never
+
+.publish-conditions:
+  rules:
+  - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "dananglin/cv"'
+    when: always
+  - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    when: never
+  - if:
+    changes:
+    - docker/Dockerfile
+    - __output/*
+    when: never
 
 test:spellcheck:
   before_script:
@@ -21,9 +34,6 @@ test:spellcheck:
   stage: test
   script:
   - make spellcheck
-  only:
-    refs:
-    - merge_requests
 
 test:pdf:
   artifacts:
@@ -33,14 +43,14 @@ test:pdf:
   extends:
   - .use-cv-builder
   - .test-conditions
-  before_script:
-  - make clean
   stage: test
   script:
-  - make
+  - make clean pdf
 
 publish:pdf:
-  extends: .use-cv-builder
+  extends: 
+  - .use-cv-builder
+  - .publish-conditions
   before_script:
   - eval $(ssh-agent -s)
   - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
@@ -50,18 +60,10 @@ publish:pdf:
   - git remote set-url origin git@gitlab.com:${CI_PROJECT_PATH}.git
   - git config --global user.email "${GITLAB_USER_EMAIL}"
   - git config --global user.name "${GITLAB_USER_NAME}"
-  - make clean
   stage: publish
   script:
-  - make
+  - make clean pdf
   - git checkout master
   - git add __output/cv.pdf
   - 'git commit -m "auto: update CV."'
   - git push origin master
-  only:
-    refs:
-    - master@dananglin/cv
-  except:
-    changes:
-    - docker/Dockerfile
-    - __output/*
diff --git a/.gitlab/ci/docker-gitlab-ci.yml b/.gitlab/ci/docker-gitlab-ci.yml
index e1b2f96..1dfd049 100644
--- a/.gitlab/ci/docker-gitlab-ci.yml
+++ b/.gitlab/ci/docker-gitlab-ci.yml
@@ -1,45 +1,58 @@
 ---
-.docker-dind-service:
+.docker-build-setup:
+  image: docker:19.03.12
   services:
   - docker:19.03.12-dind
-
-.use-docker:
-  image: docker:19.03.12
-
-.install-deps: &install-deps
-- apk add --no-cache make
-
-test:docker-image:
-  extends:
-  - .docker-dind-service
-  - .use-docker
-  script:
-  - *install-deps
-  - make image
-  stage: test
-  only:
-    refs:
-    - merge_requests
-    changes:
-    - docker/Dockerfile
-  except:
-    refs:
-    - master
-
-publish:docker-image:
-  extends:
-  - .use-docker
-  - .docker-dind-service
   before_script:
+  - apk add --no-cache make
+
+.dockerfile-lint:
+  stage: test
+  image: hadolint/hadolint:v1.18.0-alpine
+  script:
+  - "hadolint docker/Dockerfile"
+
+.dockerbuild-test:
+  stage: test
+  extends: .docker-build-setup
+
+.docker-publish:
+  stage: publish
+  extends: .docker-build-setup
+  before_script:
+  - apk add --no-cache make
   - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
   after_script:
   - docker logout ${CI_REGISTRY}
-  script:
-  - *install-deps
-  - make publish
-  stage: publish
-  only:
+
+.test-docker-rules:
+  rules:
+  - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     changes:
-    - docker/Dockerfile
-    refs:
-    - master@dananglin/cv
+    - "docker/Dockerfile"
+    when: always
+
+test:dockerfile:lint:
+  extends:
+  - .dockerfile-lint
+  - .test-docker-rules
+
+test:docker:build:
+  extends:
+  - .dockerbuild-test
+  - .test-docker-rules
+  script:
+  - make image
+
+publish:docker-image:
+  extends:
+  - .docker-publish
+  script:
+  - make publish
+  rules:
+  - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "dananglin/cv"'
+    changes:
+    - "docker/Dockerfile"
+    when: always
+  - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    when: never
diff --git a/docker/Dockerfile b/docker/Dockerfile
index d65359a..4e1aec0 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -4,19 +4,20 @@ FROM golang:1.14.6-buster
 RUN \
     apt-get update && \
     apt-get install -y --no-install-recommends \
-        fonts-crosextra-carlito \
-        rsync \
+        fonts-crosextra-carlito=20130920-1 \
+        rsync=3.1.3-6 \
     && \
     apt-get clean autoclean && \
     apt-get autoremove -y && \
-    rm -rf /var/lib/apt/lists/* /tmp/*
+    rm -rf /var/lib/apt/lists/* /tmp/* && \
+    mkdir /opt/context
+
+WORKDIR /opt/context
 
 # Install ConTeXt standalone
 RUN \
-    mkdir /opt/context && \
-    cd /opt/context && \
-    curl -LO http://minimals.contextgarden.net/setup/first-setup.sh && \
-    sh ./first-setup.sh \
+    curl -L http://minimals.contextgarden.net/setup/first-setup.sh -o /opt/context/first-setup.sh && \
+    sh /opt/context/first-setup.sh \
         --context=current \
         --engine=luatex \
     && \