diff --git a/Cargo.toml b/Cargo.toml
index d5e630c..cac14bc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,6 +5,14 @@ edition = "2024"
 
 [profile.release]
 lto = "thin"
+codegen-units = 1
+strip = true
+
+# Docker 构建专用 profile：关闭 LTO、提高 codegen-units 并行度
+[profile.docker-release]
+inherits = "release"
+lto = false
+codegen-units = 16
 strip = true
 
 [features]
diff --git a/Dockerfile b/Dockerfile
index 6d10c55..58bc22b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,8 +10,9 @@ RUN cargo chef prepare --recipe-path recipe.json
 
 FROM node:24-alpine AS frontend-builder
 WORKDIR /app/admin-ui
-COPY admin-ui/package.json ./
-RUN npm install -g pnpm && pnpm install
+# 单独复制依赖文件，利用层缓存：只有依赖变化时才重新安装
+COPY admin-ui/package.json admin-ui/bun.lock* ./
+RUN npm install -g pnpm && pnpm install --frozen-lockfile
 COPY admin-ui ./
 RUN pnpm build
 
@@ -20,11 +21,15 @@ FROM chef AS builder
 # 可选：启用敏感日志输出（仅用于排障）
 ARG ENABLE_SENSITIVE_LOGS=false
 
+# 可按需在构建时覆盖：docker compose build --build-arg CARGO_BUILD_JOBS=48
+ARG CARGO_BUILD_JOBS=8
+ENV CARGO_BUILD_JOBS=${CARGO_BUILD_JOBS}
+
 COPY --from=planner /app/recipe.json recipe.json
 RUN if [ "$ENABLE_SENSITIVE_LOGS" = "true" ]; then \
-        cargo chef cook --release --features sensitive-logs --recipe-path recipe.json; \
+        cargo chef cook --profile docker-release --features sensitive-logs --recipe-path recipe.json; \
     else \
-        cargo chef cook --release --recipe-path recipe.json; \
+        cargo chef cook --profile docker-release --recipe-path recipe.json; \
     fi
 
 COPY Cargo.toml Cargo.lock* ./
@@ -32,9 +37,9 @@ COPY src ./src
 COPY --from=frontend-builder /app/admin-ui/dist /app/admin-ui/dist
 
 RUN if [ "$ENABLE_SENSITIVE_LOGS" = "true" ]; then \
-        cargo build --release --features sensitive-logs; \
+        cargo build --profile docker-release --features sensitive-logs; \
     else \
-        cargo build --release; \
+        cargo build --profile docker-release; \
     fi
 
 FROM alpine:3.21
@@ -42,7 +47,8 @@ FROM alpine:3.21
 RUN apk add --no-cache ca-certificates
 
 WORKDIR /app
-COPY --from=builder /app/target/release/kiro-rs /app/kiro-rs
+# docker-release profile 产物路径为 target/docker-release/
+COPY --from=builder /app/target/docker-release/kiro-rs /app/kiro-rs
 
 VOLUME ["/app/config"]