diff --git a/deployment/cloud/Dockerfile b/deployment/cloud/Dockerfile
index 519b67447..cc44d3fcf 100644
--- a/deployment/cloud/Dockerfile
+++ b/deployment/cloud/Dockerfile
@@ -7,6 +7,9 @@ FROM oven/bun:1-debian
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates curl unzip \
  && rm -rf /var/lib/apt/lists/*
 COPY --from=oauth2proxy /bin/oauth2-proxy /usr/local/bin/oauth2-proxy
+# Real Node for the repo's `node internal/...` scripts: bun's node shim runs `node --check` files
+# instead of only parsing them, which hung the production build.
+COPY --from=node:22-bookworm-slim /usr/local/bin/node /usr/local/bin/node
 # Go, to build Rudder's local engine (backend/rudder-engine, go 1.22) when RUDDER_ENGINE=1.
 COPY --from=golang:1.22-bookworm /usr/local/go /usr/local/go
 ENV PATH="/usr/local/go/bin:${PATH}"
diff --git a/deployment/cloud/build-cdn.sh b/deployment/cloud/build-cdn.sh
index 7eb3c694f..7a0d9de04 100755
--- a/deployment/cloud/build-cdn.sh
+++ b/deployment/cloud/build-cdn.sh
@@ -1,11 +1,16 @@
 #!/bin/bash
 # build-cdn.sh — one production build of the pulled commit into /data/cdn, one at a time.
 #   snapshot (so the pull loop can't change files mid-build) -> apply the public exclusions ->
-#   BUILD_ALLOW=1 bun run build (memory-capped) -> check the output -> atomic swap of /data/cdn/current.
-# Exit 75 = another build holds the lock.
+#   the build steps WITHOUT the gates (memory-capped) -> check the output -> the exclusion check again
+#   (refuses the swap) -> atomic swap of /data/cdn/current.
+# No gates here: they already passed before the commit reached main, and a full gate run on a
+# 2-vCPU container takes most of an hour. The public exclusions are NOT a gate and always run.
+# Exit 75 = another build holds the lock. To stop a build, kill the PID in /tmp/build-cdn.pid
+# (never a process group: inside a container the group can be PID 1, i.e. the whole container).
 set -u
 exec 9>/tmp/build-cdn.lock
 flock -n 9 || { echo "another build is running"; exit 75; }
+echo $$ > /tmp/build-cdn.pid
 cd /app/repo
 SHA=$(git rev-parse --short HEAD); SNAP=/tmp/build-$SHA
 rm -rf "$SNAP"; mkdir -p "$SNAP"
@@ -14,11 +19,13 @@ bash /app/repo/deployment/cloud/apply-exclusions.sh "$SNAP"
 ln -s /app/repo/node_modules "$SNAP/node_modules"
 cd "$SNAP"
 echo "$(date -u +%FT%TZ) building $SHA"
-NODE_OPTIONS="--max-old-space-size=${BUILD_MAX_OLD_SPACE_MB:-1536}" BUILD_ALLOW=1 nice -n 10 bun run build \
-  || { echo "build failed"; rm -rf "$SNAP"; exit 1; }
+export NODE_OPTIONS="--max-old-space-size=${BUILD_MAX_OLD_SPACE_MB:-1536}"
+for step in clean token build:bundles tree check:sri; do
+  nice -n 10 bun run "$step" || { echo "build failed at $step"; rm -rf "$SNAP"; exit 1; }
+done
 OUT="$SNAP/public/dx-maps"
 [ -f "$OUT/manifest.json" ] || { echo "no manifest.json in the output"; rm -rf "$SNAP"; exit 1; }
-printf 'window.MAP_API_BASE=%s;\n' "$(printf '%s' "${PUBLIC_API_BASE:-}" | python3 -c 'import json,sys;print(json.dumps(sys.stdin.read()))')" > "$OUT/runtime-config.js"
+bun -e 'console.log("window.MAP_API_BASE=" + JSON.stringify(process.env.PUBLIC_API_BASE || "") + ";")' > "$OUT/runtime-config.js"
 NEW=/data/cdn/build-$SHA
 rm -rf "$NEW"; mkdir -p /data/cdn; mv "$SNAP/public" "$NEW"
 bash /app/repo/deployment/cloud/apply-exclusions.sh --check "$NEW" || { echo "REFUSED: excluded content in the build; not published"; rm -rf "$NEW" "$SNAP"; exit 1; }