diff --git a/.github/workflows/tero-release.yaml b/.github/workflows/tero-release.yaml
index 6e4354925f34d..ce3556fd90dc1 100644
--- a/.github/workflows/tero-release.yaml
+++ b/.github/workflows/tero-release.yaml
@@ -120,7 +120,11 @@ jobs:
           rustflags: ""
 
       - name: Cache cargo registry & build
-        uses: actions/cache@v4
+        # Blacksmith's cache action keeps save/restore on their colocated
+        # network — roughly an order of magnitude faster than actions/cache@v4
+        # for multi-GB `target/` payloads and not subject to GitHub's 10 GB
+        # per-repo cache cap.
+        uses: useblacksmith/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
diff --git a/distribution/docker/tero/Dockerfile b/distribution/docker/tero/Dockerfile
index 76606ff266dd8..f471f82e06505 100644
--- a/distribution/docker/tero/Dockerfile
+++ b/distribution/docker/tero/Dockerfile
@@ -1,9 +1,11 @@
-# Tero Vector — runtime image
+# Tero Vector — runtime image.
 #
-# Receives a prebuilt `vector` binary in the build context and bakes it into
-# a minimal Debian-slim runtime. Build orchestration lives in
-# `.github/workflows/tero-release.yaml`, which compiles the binary natively
-# on amd64 and arm64 runners and supplies the right binary per --platform.
+# Mirrors `distribution/docker/debian/Dockerfile` (same base, same apt set)
+# but skips upstream's two-stage `.deb` install — the binary is supplied
+# directly via the build context by `.github/workflows/tero-release.yaml`.
+# libssl3t64 + libstdc++6 are listed explicitly here because upstream gets
+# them transitively from the .deb's Depends; we have no .deb so we install
+# them by name.
 #
 # Build args:
 #   TARGETARCH      Set automatically by buildx (`amd64` | `arm64`). Selects
@@ -13,38 +15,37 @@
 #   amd64/vector    Linux x86_64 binary
 #   arm64/vector    Linux aarch64 binary
 #   LICENSE         License file (copied for OCI metadata)
-#   README.md       Optional, included for OCI metadata
 
-FROM docker.io/library/debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb AS runtime
+FROM docker.io/debian:trixie-slim@sha256:b6e2a152f22a40ff69d92cb397223c906017e1391a73c952b588e51af8883bf8
 
 ARG TARGETARCH
 
-# Common Vector runtime dependencies plus libstdc++ for Vectorscan.
+LABEL org.opencontainers.image.url="https://vector.dev"
+LABEL org.opencontainers.image.source="https://github.com/usetero/vector"
+LABEL org.opencontainers.image.documentation="https://vector.dev/docs"
+LABEL org.opencontainers.image.title="vector"
+LABEL org.opencontainers.image.description="Tero distribution of Vector with the policy transform enabled."
+LABEL org.opencontainers.image.licenses="MPL-2.0"
+LABEL org.opencontainers.image.vendor="Tero"
+
+# we want the latest versions of these
 # hadolint ignore=DL3008
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
+RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
         tzdata \
         libsasl2-2 \
-        libssl3 \
+        libssl3t64 \
         libstdc++6 \
     && rm -rf /var/lib/apt/lists/*
 
-LABEL org.opencontainers.image.title="vector"
-LABEL org.opencontainers.image.description="Tero distribution of Vector with the policy transform enabled."
-LABEL org.opencontainers.image.source="https://github.com/usetero/vector"
-LABEL org.opencontainers.image.licenses="MPL-2.0"
-LABEL org.opencontainers.image.vendor="Tero"
-
-# Pull the per-arch binary from the build context. The workflow places
-# binaries under `amd64/vector` and `arm64/vector` before invoking buildx.
 COPY --chmod=0755 ${TARGETARCH}/vector /usr/bin/vector
 COPY LICENSE /usr/share/doc/vector/LICENSE
 
-# Smoke test — fail the image build if the binary can't even print its version.
+RUN mkdir -p /var/lib/vector
+
+# Smoke test
 RUN ["vector", "--version"]
 
-# Vector's API listens on 8686 by default.
 EXPOSE 8686
 
 ENTRYPOINT ["/usr/bin/vector"]
diff --git a/distribution/docker/tero/Dockerfile.dockerignore b/distribution/docker/tero/Dockerfile.dockerignore
new file mode 100644
index 0000000000000..124007411494f
--- /dev/null
+++ b/distribution/docker/tero/Dockerfile.dockerignore
@@ -0,0 +1,4 @@
+*
+!LICENSE
+!amd64
+!arm64