diff --git a/.github/workflows/external-rpc-checks.yml b/.github/workflows/external-rpc-checks.yml
index aa954427ff1..8f289392afa 100644
--- a/.github/workflows/external-rpc-checks.yml
+++ b/.github/workflows/external-rpc-checks.yml
@@ -4,23 +4,113 @@ permissions:
   issues: write
 
 concurrency:
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 on:
   workflow_dispatch:
+    inputs:
+      forest_image:
+        description: "Test this image instead of building one."
+        required: false
+        type: string
+  pull_request:
+    branches:
+      - main
+    types: [opened, synchronize, reopened, labeled, unlabeled]
   schedule:
     - cron: "0 13 * * *" # Runs every day at 13:00 UTC
 
 jobs:
+  # scheduled runs skip this and test the published image instead
+  build:
+    name: Build Forest
+    if: |-
+      ${{ github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'pull_request'
+      && (contains(github.event.pull_request.labels.*.name, 'RPC')
+      || contains(github.event.pull_request.labels.*.name, 'Release'))) }}
+    runs-on: ubuntu-24.04-arm
+    env:
+      RUSTC_WRAPPER: sccache
+      CC: sccache clang
+      CXX: sccache clang++
+      AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+      AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+    steps:
+      - name: Configure SCCache variables
+        run: |
+          # External PRs do not have access to 'vars' or 'secrets'.
+          if [[ "${{secrets.AWS_ACCESS_KEY_ID}}" != "" ]]; then
+            {
+              echo "SCCACHE_ENDPOINT=${{ vars.SCCACHE_ENDPOINT}}"
+              echo "SCCACHE_BUCKET=${{ vars.SCCACHE_BUCKET}}"
+              echo "SCCACHE_REGION=${{ vars.SCCACHE_REGION}}"
+            } >> "$GITHUB_ENV"
+          fi
+      - uses: rui314/setup-mold@v1
+        with:
+          make-default: false
+      - name: Checkout Sources
+        uses: actions/checkout@v7
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.11
+        timeout-minutes: 5
+        continue-on-error: true
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: "go.work"
+          cache-dependency-path: "**/go.sum"
+      - uses: jdx/mise-action@v4
+      - name: Install Forest
+        env:
+          # To minimize compile times: https://nnethercote.github.io/perf-book/build-configuration.html#minimizing-compile-times
+          RUSTFLAGS: "-C linker=clang -C link-arg=-fuse-ld=mold"
+        run: mise run install --slim quick
+      - uses: actions/upload-artifact@v7
+        with:
+          name: "forest-${{ runner.os }}"
+          path: |
+            ~/.cargo/bin/forest*
+          if-no-files-found: error
+
   rpc-checks:
     name: RPC checks against the data.riba.plus dataset
-    runs-on: warp-ubuntu-2404-x64-8x
+    runs-on: warp-ubuntu-2404-arm64-8x
+    needs: build
+    # `build` only runs for dispatches and labelled pull requests; scheduled runs skip
+    # it and test `edge-fat`. Unlabelled pull requests do not run the checks at all.
+    if: |-
+      ${{ always()
+      && (needs.build.result == 'success' || needs.build.result == 'skipped')
+      && (github.event_name != 'pull_request'
+      || contains(github.event.pull_request.labels.*.name, 'RPC')
+      || contains(github.event.pull_request.labels.*.name, 'Release')) }}
     defaults:
       run:
         working-directory: scripts/tests/external-rpc-checks
     steps:
       - name: Checkout Sources
         uses: actions/checkout@v7
+      - name: Download the build
+        if: ${{ needs.build.result == 'success' }}
+        uses: actions/download-artifact@v8
+        with:
+          name: "forest-${{ runner.os }}"
+      - name: Build an image from those binaries
+        if: ${{ needs.build.result == 'success' && inputs.forest_image == '' }}
+        working-directory: .
+        run: |
+          docker build --platform linux/arm64 --file scripts/devnet/forest_ci.dockerfile --tag forest-under-test:ci .
+          # overwrites the .env FOREST_IMAGE envvar
+          echo "FOREST_IMAGE=forest-under-test:ci" >> "$GITHUB_ENV"
+      - name: Use the image given to the dispatch
+        if: ${{ inputs.forest_image != '' }}
+        working-directory: .
+        env:
+          FOREST_IMAGE_INPUT: ${{ inputs.forest_image }}
+        run: |
+          echo "FOREST_IMAGE=${FOREST_IMAGE_INPUT}" >> "$GITHUB_ENV"
       - name: Run the RPC checks
         run: ./setup.sh
       - name: Dump docker logs
diff --git a/scripts/tests/external-rpc-checks/.env b/scripts/tests/external-rpc-checks/.env
index bd2497d7964..0156692e5c4 100644
--- a/scripts/tests/external-rpc-checks/.env
+++ b/scripts/tests/external-rpc-checks/.env
@@ -1,2 +1,4 @@
+# Prefer a `fat` image: it ships the filecoin proof parameters, which a slim one downloads on first boot.
+FOREST_IMAGE=ghcr.io/chainsafe/forest:edge-fat
 FOREST_RPC_PORT=2345
 FOREST_HEALTHZ_RPC_PORT=2346
diff --git a/scripts/tests/external-rpc-checks/docker-compose.yaml b/scripts/tests/external-rpc-checks/docker-compose.yaml
index ad49d91976d..0613cd737eb 100644
--- a/scripts/tests/external-rpc-checks/docker-compose.yaml
+++ b/scripts/tests/external-rpc-checks/docker-compose.yaml
@@ -1,7 +1,7 @@
 name: external-rpc-checks
 
 x-forest-service: &forest-service
-  image: ghcr.io/chainsafe/forest:edge-fat
+  image: ${FOREST_IMAGE}
   volumes:
     - node-data:/data
   environment: