diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 3649054..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: Test fast (no changes to Dockerfile)
-
-on:
-  pull_request:
-  merge_group:
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  check-container:
-    runs-on: ubuntu-latest
-    outputs:
-      exists: ${{ steps.check.outputs.exists }}
-    steps:
-      - name: Check if Docker image exists
-        id: check
-        run: |
-          if docker manifest inspect cometbft/cometbft-db-testing:v1.0.3 &>/dev/null; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-
-  test-fast:
-    needs: check-container
-    if: needs.check-container.outputs.exists == 'true'
-    runs-on: ubuntu-latest
-    container: cometbft/cometbft-db-testing:v1.0.3
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Configure Git Safe Directory
-        run: git config --global --add safe.directory /__w/cometbft-db/cometbft-db
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: test & coverage report creation
-        run: |
-          NON_INTERACTIVE=1 make test-all-with-coverage
-
-      - uses: codecov/codecov-action@v4
-        with:
-          file: ./coverage.txt
-
-  test-slow:
-    needs: check-container
-    if: needs.check-container.outputs.exists == 'false'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Build
-        uses: docker/setup-buildx-action@v3.8.0
-        with:
-          driver: docker
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Build Docker image (arm64) to ensure it works
-        uses: docker/build-push-action@v6
-        with:
-          context: ./tools
-          file: ./tools/Dockerfile.arm64
-          platforms: linux/arm64
-
-      - name: Build Docker image (amd64) to be used in the next step
-        uses: docker/build-push-action@v6
-        with:
-          context: ./tools
-          file: ./tools/Dockerfile
-          tags: "cometbft/cometbft-db-testing:latest"
-          platforms: linux/amd64
-          load: true
-
-      - name: test & coverage report creation
-        run: |
-          NON_INTERACTIVE=1 make docker-test
-
-      - uses: codecov/codecov-action@v4
-        with:
-          file: ./coverage.txt
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 18a608b..8cbc717 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -10,7 +10,6 @@
 # supported CodeQL languages.
 #
 name: "CodeQL"
-
 on:
   workflow_dispatch:  # allow running workflow manually
   push:
diff --git a/.github/workflows/conventional-pr-title.yml b/.github/workflows/conventional-pr-title.yml
index d58e82f..6dcd3f5 100644
--- a/.github/workflows/conventional-pr-title.yml
+++ b/.github/workflows/conventional-pr-title.yml
@@ -1,5 +1,4 @@
 name: "Conventional PR Title"
-
 on:
   pull_request_target:
     types:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d317cff..eb51257 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,62 +1,90 @@
-# This workflow builds and pushes a new version of the build container image
-# when the tools directory changes on main. Edit tools/Dockerfile.
-#
-# This workflow does not push a new image until it is merged, so tests that
-# depend on changes in this image will not pass until this workflow succeeds.
-# For that reason, changes here should be done in a separate PR in advance of
-# work that depends on them.
-#
-# To build the test image locally, run:
-#   make docker-test-image
-
-name: Docker testing image
+name: Build Docker Image
 on:
-  workflow_dispatch:  # allow running workflow manually
+  workflow_dispatch:
     inputs:
-      refName:
-        description: 'Git ref name'
+      tag:
+        description: "The tag of the image to build"
         required: true
-        default: 'main'
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"               # Push events to matching v*, i.e. v1.0, v20.15.10
-      - "v[0-9]+.[0-9]+.[0-9]+-alpha.[0-9]+"  # e.g. v0.37.0-alpha.1, v0.38.0-alpha.10
-      - "v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+"   # e.g. v0.37.0-beta.1, v0.38.0-beta.10
-      - "v[0-9]+.[0-9]+.[0-9]+-rc[0-9]+"      # e.g. v0.37.0-rc1, v0.38.0-rc10
+        type: string
+      is_latest:
+        description: "Push as latest?"
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  ORG: cometbft
+  IMAGE_NAME: cometbft-db-testing
+  GIT_TAG: "${{ inputs.tag }}"
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  build-image-at-tag:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    outputs:
+      digest-${{ matrix.platform }}: ${{ steps.build.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: "${{ env.GIT_TAG }}"
+          fetch-depth: 0
 
-      - name: Set up Docker Build
-        uses: docker/setup-buildx-action@v3.8.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
+        if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Publish to Docker Hub (amd64)
+      - name: Build and push image
+        id: build
         uses: docker/build-push-action@v6
         with:
-          context: ./tools
+          platforms: ${{ matrix.platform }}
           file: ./tools/Dockerfile
-          platforms: linux/amd64
-          push: true
           tags: |
-            cometbft/cometbft-db-testing:latest
-            cometbft/cometbft-db-testing:${{ github.event.inputs.refName }}
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}:${{ env.GIT_TAG }}
+          push: true
 
-      - name: Publish to Docker Hub (arm64)
-        uses: docker/build-push-action@v6
+  merge:
+    runs-on: ubuntu-latest
+    needs: build-image-at-tag
+    steps:
+      - name: Get sanitized Docker tag
+        run: echo "DOCKER_TAG=$(echo $GIT_TAG | sed 's/[^a-zA-Z0-9\.]/-/g')" >> $GITHUB_ENV
+
+      - name: Login to DockerHub
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: docker/login-action@v3
         with:
-          context: ./tools
-          file: ./tools/Dockerfile.arm64
-          platforms: linux/arm64
-          push: true
-          tags: |
-            cometbft/cometbft-db-testing:latest
-            cometbft/cometbft-db-testing:${{ github.event.inputs.refName }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Create Multi-Arch Manifest
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.ORG }}/${{ env.IMAGE_NAME }}:${{ env.DOCKER_TAG }} \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/amd64 }} \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/arm64 }}
+
+      - name: Tag and Push Latest (if applicable)
+        if: ${{ inputs.is_latest == true }}
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.ORG }}/${{ env.IMAGE_NAME }}:latest \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/amd64 }} \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/arm64 }}
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
deleted file mode 100644
index 0965973..0000000
--- a/.github/workflows/govulncheck.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: Check for Go vulnerabilities
-# Runs https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck to proactively
-# check for vulnerabilities in code packages if there were any changes made to
-# any Go code or dependencies.
-#
-# Run `make vulncheck` from the root of the repo to run this workflow locally.
-on:
-  pull_request:
-  merge_group:
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  govulncheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-      - uses: technote-space/get-diff-action@v6
-        with:
-          PATTERNS: |
-            **/*.go
-            go.mod
-            go.sum
-            Makefile
-      - name: govulncheck
-        run: make vulncheck
-        if: "env.GIT_DIFF != ''"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 41594b1..d5f3e77 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,5 +1,4 @@
 name: Lint
-
 on:
   pull_request:
   merge_group:
@@ -11,23 +10,27 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+env:
+  ORG: cometbft
+  IMAGE_NAME: cometbft-db-testing
+
 jobs:
   golangci:
-    # We need to run the linter on the same image we use for building, since it
-    # needs the C libraries installed for the dependencies to typecheck.
     runs-on: ubuntu-latest
-    container: cometbft/cometbft-db-testing
     steps:
       - uses: actions/checkout@v4
 
-      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      - uses: actions/setup-go@v5
+      - name: Build and load
+        uses: docker/build-push-action@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          platforms: linux/amd64
+          file: ./tools/Dockerfile
+          tags: "${{ env.ORG }}/${{ env.IMAGE_NAME }}:latest"
+          load: true
 
-      - uses: golangci/golangci-lint-action@v6.2.0
-        with:
-          args: --timeout 10m
-          version: latest
-          github-token: ${{ secrets.github_token }}
+      - name: lint
+        run: |
+          NON_INTERACTIVE=1 make docker-lint
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..bd7ca92
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,48 @@
+name: Test
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  ORG: cometbft
+  IMAGE_NAME: cometbft-db-testing
+
+jobs:
+  test:
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and load
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.platform }}
+          file: ./tools/Dockerfile
+          tags: "${{ env.ORG }}/${{ env.IMAGE_NAME }}:latest"
+          load: true
+
+      - name: test & coverage report creation
+        run: |
+          NON_INTERACTIVE=1 make docker-test
+
+      - uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage.txt
diff --git a/Makefile b/Makefile
index a027556..4e1f0c2 100644
--- a/Makefile
+++ b/Makefile
@@ -91,6 +91,15 @@ docker-test:
 		make test-all-with-coverage
 .PHONY: docker-test
 
+docker-lint:
+	@docker run $(DOCKER_TEST_INTERACTIVE_FLAGS) --rm --name cometbft-db-test \
+		-v `pwd`:/cometbft \
+		-w /cometbft \
+		--entrypoint "" \
+		$(DOCKER_TEST_IMAGE):$(DOCKER_TEST_IMAGE_VERSION) \
+		make lint
+.PHONY: docker-lint
+
 #? tools: Install tools
 tools:
 	go get -v $(GOTOOLS)
diff --git a/RELEASES.md b/RELEASES.md
index abde6e1..76b080e 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -11,5 +11,7 @@ DB.
    branch.
 5. Create a [GitHub release] from the new tag, and include a link from the
    description to the heading associated with the new version in the changelog.
+6. Build and push the Docker image associated with the new release by running
+   `Build Docker Image` GH action with the newly created tag `vX.X.X`.
 
 [GitHub release]: https://docs.github.com/en/github/administering-a-repository/releasing-projects-on-github/managing-releases-in-a-repository#creating-a-release
diff --git a/goleveldb_iterator.go b/goleveldb_iterator.go
index 6a3c445..de29e97 100644
--- a/goleveldb_iterator.go
+++ b/goleveldb_iterator.go
@@ -48,7 +48,7 @@ func newGoLevelDBIterator(source iterator.Iterator, start, end []byte, isReverse
 }
 
 // Domain implements Iterator.
-func (itr *goLevelDBIterator) Domain() ([]byte, []byte) {
+func (itr *goLevelDBIterator) Domain() (start []byte, end []byte) {
 	return itr.start, itr.end
 }
 
diff --git a/memdb_iterator.go b/memdb_iterator.go
index b56320a..d34e654 100644
--- a/memdb_iterator.go
+++ b/memdb_iterator.go
@@ -115,7 +115,7 @@ func (i *memDBIterator) Close() error {
 }
 
 // Domain implements Iterator.
-func (i *memDBIterator) Domain() ([]byte, []byte) {
+func (i *memDBIterator) Domain() (start []byte, end []byte) {
 	return i.start, i.end
 }
 
diff --git a/pebble.go b/pebble.go
index 3eb2672..ca55d00 100644
--- a/pebble.go
+++ b/pebble.go
@@ -336,7 +336,7 @@ func newPebbleDBIterator(source *pebble.Iterator, start, end []byte, isReverse b
 }
 
 // Domain implements Iterator.
-func (itr *pebbleDBIterator) Domain() ([]byte, []byte) {
+func (itr *pebbleDBIterator) Domain() (start []byte, end []byte) {
 	return itr.start, itr.end
 }
 
diff --git a/tools/Dockerfile b/tools/Dockerfile
index a419117..5379839 100644
--- a/tools/Dockerfile
+++ b/tools/Dockerfile
@@ -1,19 +1,5 @@
-# This file defines the container image used to build and test tm-db in CI.
-# The CI workflows use the latest tag of cometbft/cometbft-db-testing built
-# from these settings.
-#
-# The jobs defined in the Build & Push workflow will build and update the image
-# when changes to this file are merged.  If you have other changes that require
-# updates here, merge the changes here first and let the image get updated (or
-# push a new version manually) before PRs that depend on them.
-
-# PLEASE BUMP THE VERSION OF THE IMAGE IN `.github/workflows/ci.yml` WHEN YOU
-# MODIFY THIS FILE.
-
 FROM golang:1.23.6
 
-ENV LD_LIBRARY_PATH=/usr/local/lib
-
 RUN apt update \
     && apt install -y \
        libbz2-dev libgflags-dev libsnappy-dev libzstd-dev zlib1g-dev liblz4-dev \
@@ -29,5 +15,6 @@ RUN \
   && cd rocksdb-${ROCKSDB} \
   && DEBUG_LEVEL=0 make -j4 shared_lib \
   && make install-shared \
+  && ldconfig \
   && cd .. \
   && rm -rf v${ROCKSDB}.tar.gz rocksdb-${ROCKSDB}
diff --git a/tools/Dockerfile.arm64 b/tools/Dockerfile.arm64
deleted file mode 100644
index 6414c01..0000000
--- a/tools/Dockerfile.arm64
+++ /dev/null
@@ -1,15 +0,0 @@
-# This file defines the container image used to build and test tm-db in CI.
-# The CI workflows use the latest tag of cometbft/cometbft-db-testing built
-# from these settings.
-#
-# The jobs defined in the Build & Push workflow will build and update the image
-# when changes to this file are merged.  If you have other changes that require
-# updates here, merge the changes here first and let the image get updated (or
-# push a new version manually) before PRs that depend on them.
-
-# PLEASE BUMP THE VERSION OF THE IMAGE IN `.github/workflows/ci.yml` WHEN YOU
-# MODIFY THIS FILE.
-
-FROM golang:1.23.6
-
-RUN apt update && apt install -y libleveldb-dev libleveldb1d