diff --git a/Dockerfile b/Dockerfile
index 31c56bf..7617cda 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,20 +1,21 @@
-# Lint stage: format check + golangci-lint
+# Check stage: the full verification suite (fmt-check + lint + test) via
+# `make check`, so any check failure fails the image build.
 # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS check
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make fmt-check
-RUN make lint
+RUN make check
 
-# Test stage: run full test suite
+# Build stage: compile on the Go toolchain the module targets. Copying
+# from the check stage makes the build depend on it, so `docker build .`
+# runs the checks first and only then builds.
 # golang 1.22.12 (2025-02-04)
-FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
-# Depend on lint stage so both stages always run
-COPY --from=lint /src/go.sum /dev/null
+FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS build
+COPY --from=check /src/go.sum /dev/null
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make test
+RUN go build ./... && go build -o /out/example ./cmd/example
diff --git a/script/check b/script/check
index 3e1778c..1d0b52b 100755
--- a/script/check
+++ b/script/check
@@ -1,14 +1,14 @@
 #!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
+# script/check: run all checks (fmt-check, lint, test). Our own
 # extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/test"
 }
 
 main "$@"