diff --git a/Dockerfile b/Dockerfile
index d7d21fe..61f5e60 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,13 +9,20 @@ RUN make fmt-check
 # Called directly: make lint is itself a docker build of this stage.
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Test stage: run full test suite
-# golang 1.22.12 (2025-02-04)
+# Test stage: run full test suite under the race detector
+# golang 1.22.12 (Debian-based; -race needs its C toolchain), 2025-02-04
 FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
-# Depend on lint stage so both stages always run
-COPY --from=lint /src/go.sum /dev/null
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make test
+# Called directly: make test is itself a docker build of this stage.
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
+
+# Final stage: the copies make a plain docker build run both stages above.
+# golang 1.22.12 (2025-02-04)
+FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
diff --git a/README.md b/README.md
index 5d0d7f5..d9aa4b8 100644
--- a/README.md
+++ b/README.md
@@ -145,7 +145,9 @@ alpine. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
-- `script/test` — run the test suite (`go test -v ./...`)
+- `script/test` — run the test suite under the race detector in Docker by
+  building only the `test` stage of the `Dockerfile`, without the build cache,
+  so every run tests; the image is tagged `simplelog-test`
 - `script/lint` — run golangci-lint in Docker by building only the `lint`
   stage of the `Dockerfile` (which also runs the format check), without the
   build cache, so every run lints; the image is tagged `simplelog-lint`
diff --git a/TODO.md b/TODO.md
index 4a3b4ec..b16ca6a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -24,6 +24,10 @@ files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
 
 # Completed Steps
 
+* 2026-10-06: the tests run under the race detector, in Docker:
+    `script/test` builds the `test` stage of the `Dockerfile`, which runs
+    `go test -race`, and a new final stage makes a plain `docker build`
+    run both the `lint` and `test` stages
 * 2026-10-06: the linter runs only in Docker: `script/lint` builds the
     `lint` stage of the `Dockerfile`, every `docker build` in `script/`
     runs without the build cache, and `script/bootstrap` no longer
diff --git a/script/test b/script/test
index 98bd019..cd239f2 100755
--- a/script/test
+++ b/script/test
@@ -1,12 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -v ./...
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"