diff --git a/.dockerignore b/.dockerignore
index 30af078..220fbee 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -10,4 +10,5 @@
 coverage
 npm-debug.log*
 terrain-tiles
+mosquitto
 *.log
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 40d308a..fdd7e68 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -174,12 +174,23 @@ jobs:
           MQTT_USERNAME: backend
           MQTT_PASSWORD: ci-mqtt-password
           MOSQUITTO_CONFIG_DIR: /tmp/meshcore-ci-mosquitto
+          MOSQUITTO_IMAGE: eclipse-mosquitto@sha256:9cfdd46ad59f3e3e5f592f6baf57ab23e1ad00605509d0f5c1e9b179c5314d87
         run: |
           install -d -m 700 "$MOSQUITTO_CONFIG_DIR"
           cp mosquitto/mosquitto.conf "$MOSQUITTO_CONFIG_DIR/mosquitto.conf"
           scripts/bootstrap-mosquitto.sh
-          test "$(stat -c '%a' "$MOSQUITTO_CONFIG_DIR/passwd")" = 640
-          test "$(stat -c '%a' "$MOSQUITTO_CONFIG_DIR/acl")" = 640
+          for credential in passwd acl; do
+            mode="$(
+              docker run --rm \
+                --user 1000:1883 \
+                --cap-drop ALL \
+                --entrypoint stat \
+                -v "$MOSQUITTO_CONFIG_DIR:/mosquitto/config:ro" \
+                "$MOSQUITTO_IMAGE" \
+                -c '%a' "/mosquitto/config/$credential"
+            )"
+            test "$mode" = 640
+          done
       - name: Validate Compose configuration
         env:
           POSTGRES_PASSWORD: ci-postgres-password
@@ -220,7 +231,9 @@ jobs:
               down --volumes --remove-orphans
           }
           trap cleanup EXIT
-          scripts/bootstrap-mosquitto.sh
+          # Keep the files writable by the runner while adding the CI-only
+          # publisher, then restore the production 1000:1883 ownership.
+          MOSQUITTO_BACKEND_UID="$(id -u)" scripts/bootstrap-mosquitto.sh
           docker run --rm \
             --user "$(id -u):$(id -g)" \
             -v "$PWD/mosquitto:/mosquitto/config" \
@@ -230,6 +243,7 @@ jobs:
           printf '\nuser %s\ntopic write meshcore-test/CI/%s/packets\ntopic write meshcore-test/CI/%s/status\n' \
             "$publisher_user" "$observer" "$observer" >>mosquitto/acl
           chmod 640 mosquitto/passwd mosquitto/acl
+          scripts/bootstrap-mosquitto.sh
           docker build \
             --build-arg SOURCE_REVISION="$SOURCE_REVISION" \
             --build-arg VITE_APP_HOSTNAME=app.ukmesh.com \
diff --git a/scripts/benchmark-hopreach.sh b/scripts/benchmark-hopreach.sh
index a3bf814..cd1d1af 100755
--- a/scripts/benchmark-hopreach.sh
+++ b/scripts/benchmark-hopreach.sh
@@ -24,15 +24,32 @@ go test ./internal/propagation -run '^$' \
   -bench 'BenchmarkRasterUKFixtures/(Optimized|UpstreamReference)/(Standard|PrecisionTile)/UK4600$' \
   -benchtime=1x -count=3 -benchmem > "$gate_output"
 
-average_ns() {
+median_ns() {
   pattern=$1
-  awk -v pattern="$pattern" '$1 ~ pattern { sum += $3; count += 1 } END { if (count == 0) exit 1; printf "%.0f", sum/count }' "$gate_output"
+  awk -v pattern="$pattern" '
+    $1 ~ pattern { values[++count] = $3 }
+    END {
+      if (count == 0) exit 1
+      for (i = 2; i <= count; i++) {
+        value = values[i]
+        j = i - 1
+        while (j >= 1 && values[j] > value) {
+          values[j + 1] = values[j]
+          j--
+        }
+        values[j + 1] = value
+      }
+      middle = int((count + 1) / 2)
+      if (count % 2 == 1) printf "%.0f", values[middle]
+      else printf "%.0f", (values[middle] + values[middle + 1]) / 2
+    }
+  ' "$gate_output"
 }
 
 check_time_gate() {
   tier=$1
-  optimized=$(average_ns "Optimized/$tier/UK4600-")
-  reference=$(average_ns "UpstreamReference/$tier/UK4600-")
+  optimized=$(median_ns "Optimized/$tier/UK4600-")
+  reference=$(median_ns "UpstreamReference/$tier/UK4600-")
   awk -v optimized="$optimized" -v reference="$reference" -v tier="$tier" 'BEGIN {
     ratio = optimized / reference
     printf "%s: optimized %.3fs, upstream %.3fs, ratio %.3f\n", tier, optimized/1e9, reference/1e9, ratio