diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 93d38f0..97c7346 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -14,6 +14,10 @@ permissions:
   contents: write
   packages: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   #linux:
   #  name: GHC ${{ matrix.ghc-version }} on ${{ matrix.os }}
@@ -157,6 +161,8 @@ jobs:
         if: ${{ env.platform == 'x86_64-linux' }}
         run: make pull-image
 
+      # XXX: only build if Dockerfile changed? 
+      # git diff --name-only ${{ github.event.after }} ${{ github.event.before }} | grep Dockerfile?
       - name: Build image (Linux only)
         if: ${{ env.platform == 'x86_64-linux' }}
         run: make build-image
@@ -212,6 +218,7 @@ jobs:
           key: ${{ steps.cache.outputs.cache-primary-key }}
 
       - name: Build 
+        # XXX: is env needed?
         env:
           SPEX_GIT_COMMIT: ${{ github.sha }}
         run: make build
@@ -230,7 +237,9 @@ jobs:
                 github.event_name == 'push' && 
                 github.ref == 'refs/heads/main' }}
         id: install
+        # XXX: is shell bash needeD?
         shell: bash
+        # XXX: is env needed?
         env:
           SPEX_GIT_COMMIT: ${{ github.sha }}
         run: make install
diff --git a/Makefile b/Makefile
index 1aeeef4..21d6c0f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,8 @@
+# This Makefile is supposed to work on Linux, MacOS and Windows (with WSL and
+# GNU make). On Linux it should build static binaries using an Alpine
+# container. All this should work both on GitHub actions CI and when run
+# locally.
+
 OS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
 PLATFORM := $(shell uname -m)-$(OS)
 CABAL_VERSION := $(shell awk '/^version:/ { print $$2 }' spex.cabal)
@@ -5,6 +10,8 @@ RELEASED_VERSION := $(shell gh release list --limit 1 \
 			--exclude-drafts --exclude-pre-releases \
 			--json tagName \
 			--jq '.[].tagName // "unreleased" | sub("^v"; "") ')
+
+# This variable is set to true on GitHub's CI.
 GITHUB_ACTIONS ?= false
 
 SPEX_GIT_COMMIT ?= $(shell git rev-parse HEAD)
@@ -33,6 +40,7 @@ NEW_VERSION = "$(shell awk -F '=' '/^new-version/ \
 endif
 
 ifeq ($(OS),linux)
+  ifeq ($(GITHUB_ACTIONS),true)
 	CABAL := docker run --rm --entrypoint=cabal \
 			--volume $(PWD):/mnt \
 			--volume $(HOME)/.cache/cabal/packages:/root/.cache/cabal/packages \
@@ -41,7 +49,16 @@ ifeq ($(OS),linux)
 			--env SPEX_GIT_COMMIT=$(SPEX_GIT_COMMIT) \
 			ghcr.io/spex-lang/spex-build:latest
 	ENABLE_STATIC := --enable-executable-static
-
+  else
+	CABAL := docker run --rm --entrypoint=cabal \
+			--volume $(PWD):/mnt \
+			--volume $(PWD)/.container-cache/cabal/packages:/root/.cache/cabal/packages \
+			--volume $(PWD)/.container-cache/cabal/store:/root/.local/state/cabal/store \
+			--volume $(PWD)/dist-newstyle:/mnt/dist-newstyle \
+			--env SPEX_GIT_COMMIT=$(SPEX_GIT_COMMIT) \
+			ghcr.io/spex-lang/spex-build:latest
+	ENABLE_STATIC := --enable-executable-static
+  endif
 else
 	CABAL := cabal
 	ENABLE_STATIC := 
@@ -52,8 +69,15 @@ all: build-deps build test bump install release
 # XXX: doesn't configure petstore...
 dist-newstyle/cache/plan.json: cabal.project cabal.project.freeze spex.cabal
 ifeq ($(OS),linux)
+  ifeq ($(GITHUB_ACTIONS),true)
+	mkdir -p $(PWD)/dist-newstyle
 	mkdir -p $(HOME)/.cache/cabal/packages
 	mkdir -p $(HOME)/.cabal/store
+  else
+	mkdir -p $(PWD)/dist-newstyle
+	mkdir -p $(PWD)/.container-cache/cabal/packages
+	mkdir -p $(PWD)/.container-cache/cabal/store
+  endif
 endif
 	$(CABAL) configure $(ENABLE_STATIC) --disable-profiling  --disable-library-for-ghci --enable-library-stripping --enable-executable-stripping --enable-tests --enable-benchmarks --disable-documentation
 	$(CABAL) update
@@ -64,6 +88,7 @@ build-deps: dist-newstyle/cache/plan.json
 	$(CABAL) build all --only-dependencies
 
 build: 
+	# XXX: shouldn't be needed?
 	$(CABAL) update
 	$(CABAL) build all
 
@@ -87,7 +112,15 @@ bump:
         endif
 
 install:
+  ifeq ($(OS),linux)
+	# Running `cabal install` inside a container will it inside the
+	# container, which isn't what we want. Instead find the binary inside
+	# dist-newstyle, which is shared with the host via a volume mount, and
+	# copy it from there to the right place.
+	find dist-newstyle/ -name 'spex*' -type f -executable -exec cp {} $(SPEX_BIN) \;
+  else
 	$(CABAL) install all --installdir=$(SPEX_BIN) --install-method=copy --overwrite-policy=always
+  endif
 
 release:
 	@echo "NEW_VERSION=$(NEW_VERSION)"
@@ -117,6 +150,8 @@ release:
   endif
 
 clean:
+	rm -rf dist-newstyle
+	rm -rf .container-cache
 
 pull-image:
 	docker pull ghcr.io/spex-lang/spex-build:latest
diff --git a/README.md b/README.md
index 5b2b821..27ea3fb 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,8 @@ range of software that can be specified and tested will extended in the
 [future](ROADMAP.md).
 
 > [!CAUTION]
-> Spex is pre-alpha and not suitable for general use yet.
+> Spex is pre-alpha and not suitable for general use yet. Please don't share
+> just yet, I'll announce it properly soon.
 
 ## Features