diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 8bffd496c..e0a6e7410 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -52,10 +52,23 @@ jobs:
 
           # Unified AuthBridge binary (Envoy + authbridge in one container)
           # Drop-in replacement for envoy-with-processor
+          # DEPRECATED: use authbridge-envoy instead
           - name: authbridge-unified
             context: ./authbridge
             dockerfile: cmd/authbridge/Dockerfile
 
+          # AuthBridge with Envoy (envoy-sidecar mode)
+          # New canonical name for authbridge-unified
+          - name: authbridge-envoy
+            context: ./authbridge
+            dockerfile: cmd/authbridge/Dockerfile
+
+          # Lightweight AuthBridge (Go binary only, no Envoy)
+          # Used for waypoint and proxy-sidecar modes
+          - name: authbridge-light
+            context: ./authbridge
+            dockerfile: cmd/authbridge/Dockerfile.light
+
           # Demo application for testing
           - name: demo-app
             context: ./authbridge/authproxy/quickstart/demo-app
diff --git a/authbridge/cmd/authbridge/Dockerfile b/authbridge/cmd/authbridge/Dockerfile
index 8adfd1445..a038f7d3c 100644
--- a/authbridge/cmd/authbridge/Dockerfile
+++ b/authbridge/cmd/authbridge/Dockerfile
@@ -1,10 +1,14 @@
 # AuthBridge unified image — Envoy + authbridge binary in one container.
 # Drop-in replacement for envoy-with-processor (Dockerfile.envoy).
 #
+# Uses UBI9-micro base (~24 MB) instead of UBI9-minimal (~134 MB)
+# for a ~42% smaller image while remaining glibc-compatible for Envoy.
+# Total image size: ~140 MB (24 MB base + 87 MB Envoy + 26 MB authbridge).
+#
 # Build context: ./authbridge (needs access to both authlib/ and cmd/authbridge/)
 
 # Stage 1: Build authbridge binary
-FROM golang:1.24-alpine AS builder
+FROM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
 
 RUN apk add --no-cache git
 
@@ -23,18 +27,15 @@ RUN cd cmd/authbridge && CGO_ENABLED=0 GOOS=linux go build -o /authbridge .
 # Stage 2: Get Envoy binary
 FROM docker.io/envoyproxy/envoy:v1.37.1 AS envoy-source
 
-# Stage 3: Runtime — same base as Dockerfile.envoy
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:83006d535923fcf1345067873524a3980316f51794f01d8655be55d6e9387183
-
-RUN microdnf install -y ca-certificates && microdnf clean all
-
-COPY --from=envoy-source /usr/local/bin/envoy /usr/local/bin/envoy
-COPY --from=builder /authbridge /usr/local/bin/authbridge
-COPY cmd/authbridge/entrypoint.sh /usr/local/bin/entrypoint.sh
+# Stage 3: Runtime — UBI9-micro (glibc-compatible, ~24 MB)
+# UBI9-micro has no package manager and no CA certificates.
+# CA certs are copied from the Alpine builder for HTTPS (JWKS, Keycloak).
+FROM registry.access.redhat.com/ubi9/ubi-micro@sha256:2173487b3b72b1a7b11edc908e9bbf1726f9df46a4f78fd6d19a2bab0a701f38
 
-RUN chmod 755 /usr/local/bin/entrypoint.sh \
-              /usr/local/bin/envoy \
-              /usr/local/bin/authbridge
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=envoy-source --chmod=755 /usr/local/bin/envoy /usr/local/bin/envoy
+COPY --from=builder --chmod=755 /authbridge /usr/local/bin/authbridge
+COPY --chmod=755 cmd/authbridge/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 # Envoy writes hot-restart lock files and admin socket here
 RUN mkdir -p /tmp/envoy && chmod 775 /tmp/envoy
diff --git a/authbridge/cmd/authbridge/Dockerfile.light b/authbridge/cmd/authbridge/Dockerfile.light
new file mode 100644
index 000000000..731b4afac
--- /dev/null
+++ b/authbridge/cmd/authbridge/Dockerfile.light
@@ -0,0 +1,33 @@
+# AuthBridge lightweight image — Go binary only, no Envoy.
+# Used for waypoint and proxy-sidecar modes where Envoy is not needed.
+# For envoy-sidecar mode, use the main Dockerfile which includes Envoy.
+#
+# Uses distroless base (~2 MB) for minimal attack surface.
+# The binary is statically linked (CGO_ENABLED=0), so no glibc needed.
+# No shell — debug via kubectl logs, not kubectl exec.
+#
+# Build context: ./authbridge (needs access to both authlib/ and cmd/authbridge/)
+
+# Stage 1: Build authbridge binary
+FROM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
+
+RUN apk add --no-cache git
+
+WORKDIR /app
+
+# Copy both modules with Docker-compatible layout
+COPY authlib/ authlib/
+COPY cmd/authbridge/ cmd/authbridge/
+
+ENV GOWORK=off
+RUN cd cmd/authbridge && CGO_ENABLED=0 GOOS=linux go build -o /authbridge .
+
+# Stage 2: Runtime — distroless static (~2 MB, includes CA certs)
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:a9329520abc449e3b14d5bc3a6ffae065bdde0f02667fa10880c49b35c109fd1
+
+COPY --from=builder --chmod=755 /authbridge /usr/local/bin/authbridge
+
+# ext_authz/ext_proc (9090), forward proxy (8080), reverse proxy (8081)
+EXPOSE 9090 8080 8081
+
+ENTRYPOINT ["/usr/local/bin/authbridge"]