diff --git a/docs/CHAT-RELAY.md b/docs/CHAT-RELAY.md
index 577f5613b5..021538c1d1 100644
--- a/docs/CHAT-RELAY.md
+++ b/docs/CHAT-RELAY.md
@@ -144,7 +144,7 @@ Instead of the binary and `systemd` setup above, you can build and run the relay
    cp .env.example .env
    ```
 
-   Set `RELAY_NAME` (display name), `RELAY_WEB_DOMAIN` (the domain previews are served from), and `POSTGRES_PASSWORD`. `CHAT_REF` pins the `simplex-chat` tag that is built.
+   Set `RELAY_NAME` (display name), `RELAY_WEB_DOMAIN` (the domain previews are served from), and `POSTGRES_PASSWORD`. `CHAT_REF` pins the `simplex-chat` ref that is built (tag, branch or commit). `RELAY_RTS_OPTS` overrides the GHC runtime options the relay runs with, given without the `+RTS`/`-RTS` markers.
 
 3. Create the directory the relay writes previews and the CORS file to, owned by the container's user (UID `1000`):
 
diff --git a/scripts/relay/.env.example b/scripts/relay/.env.example
index 3917532c2a..b8d7a84560 100644
--- a/scripts/relay/.env.example
+++ b/scripts/relay/.env.example
@@ -9,5 +9,8 @@ POSTGRES_USER=simplex
 POSTGRES_DB=simplex_chat_relay
 POSTGRES_PASSWORD=change-me
 
-# Source tag to build (relay mode requires v7.0.0-beta.4 or later).
-CHAT_REF=v7.0.0-beta.5
+# Source ref to build: tag, branch or commit.
+CHAT_REF=88df79d1e26921c7d1835fc8484fade596356fb6
+
+# GHC runtime options for the relay. Uncomment to override the default.
+#RELAY_RTS_OPTS="-N -F1.2 -A16m -I0.01 -Iw15"
diff --git a/scripts/relay/Dockerfile b/scripts/relay/Dockerfile
index 6323cadcd0..f439124e5f 100644
--- a/scripts/relay/Dockerfile
+++ b/scripts/relay/Dockerfile
@@ -3,7 +3,7 @@
 # slim runtime with only the libraries the binary links against. A bare
 # `scratch` image cannot run this dynamically-linked binary.
 
-ARG CHAT_REF=v7.0.0-beta.5
+ARG CHAT_REF=88df79d1e26921c7d1835fc8484fade596356fb6
 ARG GHC=9.6.3
 ARG CABAL=3.10.1.0
 
@@ -31,16 +31,19 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org \
     && ghcup set cabal "${CABAL}" \
     && cabal update
 
-# CHAT_REF is declared here, after the toolchain layers, so changing the tag
-# reuses everything above and rebuilds only the clone + compile below.
+# CHAT_REF is declared here, after the toolchain layers, so changing the ref
+# reuses everything above and rebuilds only the fetch + compile below. The
+# fetch form accepts a commit hash as well as a tag or branch.
 ARG CHAT_REF
-RUN git clone --depth 1 --branch "${CHAT_REF}" \
-      https://github.com/simplex-chat/simplex-chat /project
 WORKDIR /project
+RUN git init -q . \
+    && git remote add origin https://github.com/simplex-chat/simplex-chat \
+    && git fetch -q --depth 1 origin "${CHAT_REF}" \
+    && git checkout -q FETCH_HEAD
 
 # Compile the executable with PostgreSQL persistence and strip it. The cabal
 # store (compiled dependencies) and dist-newstyle are cache mounts, so a
-# different tag recompiles only changed code, not every dependency.
+# different ref recompiles only changed code, not every dependency.
 RUN --mount=type=cache,target=/root/.cabal/store,sharing=locked \
     --mount=type=cache,target=/project/dist-newstyle,sharing=locked \
     cp scripts/cabal.project.local.linux cabal.project.local \
diff --git a/scripts/relay/docker-compose.yaml b/scripts/relay/docker-compose.yaml
index 3e2f1b768b..b736a2ec2d 100644
--- a/scripts/relay/docker-compose.yaml
+++ b/scripts/relay/docker-compose.yaml
@@ -5,7 +5,7 @@ services:
     build:
       context: .
       args:
-        CHAT_REF: ${CHAT_REF:-v7.0.0-beta.5}
+        CHAT_REF: ${CHAT_REF:-88df79d1e26921c7d1835fc8484fade596356fb6}
     image: chat-relay:latest                 # set your image/registry name
     container_name: chat-relay               # optional: rename
     depends_on:
@@ -14,6 +14,8 @@ services:
     environment:
       RELAY_NAME: ${RELAY_NAME}
       RELAY_WEB_DOMAIN: ${RELAY_WEB_DOMAIN}
+      # Empty falls back to the entrypoint's default RTS options.
+      RELAY_RTS_OPTS: ${RELAY_RTS_OPTS:-}
       # Password comes from PGPASSWORD (libpq reads it), so it stays out of the
       # process argv and needs no URL-encoding.
       DB_CONN: postgresql://${POSTGRES_USER}@db:5432/${POSTGRES_DB}
diff --git a/scripts/relay/entrypoint.py b/scripts/relay/entrypoint.py
index 31d3deb9a8..837aa07a4f 100755
--- a/scripts/relay/entrypoint.py
+++ b/scripts/relay/entrypoint.py
@@ -12,6 +12,7 @@ binary conn-req blob plus short-link data, re-encoded on display), so the
 relay's own output is the canonical source.
 """
 import os
+import shlex
 import subprocess
 import sys
 
@@ -20,6 +21,10 @@ WEB_ROOT = "/var/www/relay-web-channels"
 ADDR_FILE = "/out/relay-address.txt"
 CAPTURE_TIMEOUT = 180  # seconds; first address creation involves an SMP round-trip
 
+# GHC runtime options for the relay, overridable with RELAY_RTS_OPTS. The binary
+# is built with -rtsopts, so it accepts them on the command line.
+DEFAULT_RTS_OPTS = "-N -F1.2 -A16m -I0.01 -Iw15"
+
 
 def require(name):
     value = os.environ.get(name)
@@ -28,6 +33,20 @@ def require(name):
     return value
 
 
+def rts_args():
+    """Configured RTS options, wrapped in the +RTS/-RTS markers.
+
+    RELAY_RTS_OPTS holds bare options ("-N -A16m"); the markers are added here
+    and ignored if they are given anyway.
+    """
+    opts = [
+        o
+        for o in shlex.split(os.environ.get("RELAY_RTS_OPTS") or DEFAULT_RTS_OPTS)
+        if o not in ("+RTS", "-RTS")
+    ]
+    return ["+RTS", *opts, "-RTS"] if opts else []
+
+
 def find_address(text):
     for token in text.split():
         if token.startswith("https://") or token.startswith("simplex:"):
@@ -92,7 +111,7 @@ def main():
         "--relay-web-interval", "30",
         "-d", conn,
         "--create-schema",
-    ]
+    ] + rts_args()
     os.execvp(relay[0], relay)