diff --git a/.github/workflows/benchmark-machine.yml b/.github/workflows/benchmark-machine.yml
index 6846c41abc..1352b6d507 100644
--- a/.github/workflows/benchmark-machine.yml
+++ b/.github/workflows/benchmark-machine.yml
@@ -43,7 +43,7 @@ jobs:
           echo "Remote instance reachable now after $SECONDS seconds"
           remote_ip=`aws ec2 describe-instances --filters 'Name=instance-state-name,Values=running' 'Name=instance-id,Values=${{ env.INSTANCE_ID }}' --query 'Reservations[*].Instances[*].[PublicIpAddress]' --output text`
           echo "Running instances ip address: $remote_ip"
-          echo "::set-output name=remote_ip::$remote_ip"
+          echo "remote_ip=$remote_ip" >> $GITHUB_OUTPUT
 
       # exit status should propagate through ssh
       - name: Remotely benchmark machine
diff --git a/.github/workflows/benchmark-runtime-weights.yml b/.github/workflows/benchmark-runtime-weights.yml
index 2fa4ef343e..43f6ab200d 100644
--- a/.github/workflows/benchmark-runtime-weights.yml
+++ b/.github/workflows/benchmark-runtime-weights.yml
@@ -33,6 +33,8 @@ env:
   INSTANCE_ID: ${{ secrets.BENCHMARK_INSTANCE_ID }}  # remote AWS host to run benchmarking
   BENCHMARK_SSH_USER: ${{ secrets.BENCHMARK_SSH_USER }}
   BENCHMARK_SSH_KEYPATH: ${{ secrets.BENCHMARK_SSH_KEYPATH }}
+  DOCKER_BUILDKIT: 1
+
 jobs:
   ## build docker image with runtime-benchmarks feature
   build-docker:
@@ -112,7 +114,7 @@ jobs:
           echo "Remote instance reachable now after $SECONDS seconds"
           remote_ip=`aws ec2 describe-instances --filters 'Name=instance-state-name,Values=running' 'Name=instance-id,Values=${{ env.INSTANCE_ID }}' --query 'Reservations[*].Instances[*].[PublicIpAddress]' --output text`
           echo "Running instances ip address: $remote_ip"
-          echo "::set-output name=remote_ip::$remote_ip"
+          echo "remote_ip=$remote_ip" >> $GITHUB_OUTPUT
 
       # exit status should propagate through ssh
       - name: Remotely benchmark pallets ${{ github.event.inputs.pallets }} for ${{ env.CHAIN }}
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index ef99c2285c..a25f9afa8c 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -19,6 +19,10 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  DOCKER_BUILDKIT: 1
+  # the branch or tag on which this workflow is triggered
+  # `head_ref` will only be set if the triggering event is `pull_request`
+  REF_VERSION: ${{ github.head_ref || github.ref_name }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -73,8 +77,14 @@ jobs:
       - name: Run cargo fmt check
         run: make fmtcheck
 
-      - name: Install taplo
-        run: cargo install taplo-cli --locked
+      - name: Install pre-built taplo
+        run: |
+          mkdir -p $HOME/.local/bin
+          wget -q https://github.com/tamasfe/taplo/releases/latest/download/taplo-linux-x86_64.gz
+          gzip -d taplo-linux-x86_64.gz
+          cp taplo-linux-x86_64 $HOME/.local/bin/taplo
+          chmod a+x $HOME/.local/bin/taplo
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
       - name: Run taplo fmt check
         run: make taplocheck
@@ -145,6 +155,10 @@ jobs:
         run: |
           [ -z "$(docker images --filter=dangling=true -q)" ] || docker rmi -f $(docker images --filter=dangling=true -q)
 
+      - name: Fail-fast; cancel other jobs
+        if: failure()
+        uses: andymckay/cancel-action@0.2
+
   run-ts-tests:
     runs-on: ubuntu-latest
     needs: build-docker
@@ -204,7 +218,7 @@ jobs:
           default: true
 
       - name: Run unittests
-        run: cargo test --release -p pallet-* --lib
+        run: cargo test --locked --release -p pallet-* --lib
 
       - name: Fail-fast; cancel other jobs
         if: failure()
@@ -228,7 +242,7 @@ jobs:
           default: true
 
       - name: Run benchmarks
-        run: cargo test --release -p pallet-* --lib --features runtime-benchmarks
+        run: cargo test --locked --release -p pallet-* --lib --features runtime-benchmarks
 
       - name: Fail-fast; cancel other jobs
         if: failure()
@@ -241,16 +255,17 @@ jobs:
   # This is required when setting github merge rules to protected branch,
   # where you can only select one of `run-cargo-runtime-tests` and `run-cargo-runtime-tests(litmus)`.
   # If you put if-check on the job level, it can't fit every possible case.
+  #
+  # Tried https://github.com/Swatinem/rust-cache too but it didn't work so well
   run-cargo-runtime-tests:
     runs-on: ubuntu-latest
     needs: [check-cargo-fmt, check-file-change]
     env:
-      RUST_BACKTRACE: full
       RUSTC_WRAPPER: sccache
       SCCACHE_CACHE_SIZE: 10G
       SCCACHE_DIR: /home/runner/.cache/sccache
-      CARGO_INCREMENTAL: 0
     strategy:
+      fail-fast: true
       matrix:
         chain:
           - litmus
@@ -273,10 +288,9 @@ jobs:
       # use sccache to accelerate binary compilation
       # see https://www.infinyon.com/blog/2021/04/github-actions-best-practices/
       - name: Install sccache
-        if: needs.check-file-change.outputs.src == 'true'
         env:
           LINK: https://github.com/mozilla/sccache/releases/download
-          SCCACHE_VERSION: v0.2.15
+          SCCACHE_VERSION: v0.3.0
         run: |
           SCCACHE_FILE=sccache-$SCCACHE_VERSION-x86_64-unknown-linux-musl
           mkdir -p $HOME/.local/bin
@@ -287,29 +301,31 @@ jobs:
 
       - name: Cache cargo registry
         if: needs.check-file-change.outputs.src == 'true'
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         continue-on-error: false
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-          key: cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: cargo-${{ env.REF_VERSION }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
+            cargo-${{ env.REF_VERSION }}-
             cargo-
 
       - name: Cache sccache
         if: needs.check-file-change.outputs.src == 'true'
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         continue-on-error: false
         with:
           path: /home/runner/.cache/sccache
-          key: sccache-${{ hashFiles('**/Cargo.lock') }}
+          key: sccache-${{ env.REF_VERSION }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
+            sccache-${{ env.REF_VERSION }}-
             sccache-
 
       - name: Run runtime integration tests
         if: needs.check-file-change.outputs.src == 'true'
-        run: cargo test --release -p ${{ matrix.chain }}-parachain-runtime --lib
+        run: cargo test --locked --release -p ${{ matrix.chain }}-parachain-runtime --lib
 
       - name: Print sccache stats
         if: needs.check-file-change.outputs.src == 'true'
@@ -343,7 +359,7 @@ jobs:
           docker load -i litentry-parachain.tar
 
       - name: Dockerhub login
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
diff --git a/.github/workflows/build-docker-with-args.yml b/.github/workflows/build-docker-with-args.yml
index 54162ccc69..9d7bc4f907 100644
--- a/.github/workflows/build-docker-with-args.yml
+++ b/.github/workflows/build-docker-with-args.yml
@@ -21,6 +21,8 @@ on:
         default: ''
         required: false
 
+env:
+    DOCKER_BUILDKIT: 1
 
 jobs:
   ## build docker image of client binary with args ##
diff --git a/.github/workflows/create-release-draft.yml b/.github/workflows/create-release-draft.yml
index 0c5bd63769..3e3c60974e 100644
--- a/.github/workflows/create-release-draft.yml
+++ b/.github/workflows/create-release-draft.yml
@@ -33,6 +33,7 @@ env:
   RELEASE_TAG: ${{ github.event.inputs.release_tag }}
   DIFF_TAG: ${{ github.event.inputs.diff_tag }}
   GENESIS_RELEASE: ${{ github.event.inputs.genesis_release }}
+  DOCKER_BUILDKIT: 1
 
 jobs:
   set-release-type:
@@ -52,7 +53,7 @@ jobs:
             echo "::error::Please select at least one release type."
             exit 1
           fi
-          echo "::set-output name=release_type::${release_type}"
+          echo "release_type=${release_type}" >> $GITHUB_OUTPUT
     outputs:
       release_type: ${{ steps.vars.outputs.release_type }}
 
diff --git a/README.md b/README.md
index cf47ca82cc..aa17a653fb 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # litentry-parachain
 [![Build & Test](https://github.com/litentry/litentry-parachain/actions/workflows/build-and-test.yml/badge.svg)](https://github.com/litentry/litentry-parachain/actions/workflows/build-and-test.yml)
 [![Build wasm](https://github.com/litentry/litentry-parachain/actions/workflows/build-wasm.yml/badge.svg)](https://github.com/litentry/litentry-parachain/actions/workflows/build-wasm.yml)
-[![Benchmark](https://github.com/litentry/litentry-parachain/actions/workflows/benchmark-runtime-weights.yml/badge.svg)](https://github.com/litentry/litentry-parachain/actions/workflows/benchmark-runtime-weights.yml)
+[![Benchmark runtime weights](https://github.com/litentry/litentry-parachain/actions/workflows/benchmark-runtime-weights.yml/badge.svg)](https://github.com/litentry/litentry-parachain/actions/workflows/benchmark-runtime-weights.yml)
 [![Release](https://github.com/litentry/litentry-parachain/actions/workflows/create-release-draft.yml/badge.svg)](https://github.com/litentry/litentry-parachain/actions/workflows/create-release-draft.yml)
 
 The Litentry parachain.
diff --git a/docker/Dockerfile b/docker/Dockerfile
index b440fb47b6..20010c71bd 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -7,6 +7,7 @@ ARG PROFILE
 # our host is based on bullseye/sid => rust:latest
 # ==========================
 FROM rust:latest as builder
+
 WORKDIR /litentry
 COPY . /litentry
 
@@ -14,9 +15,28 @@ RUN apt-get update && \
 	apt-get upgrade -y && \
 	apt-get install -yq openssl clang libclang-dev cmake
 
+# install sccache, must before `ARG RUSTC_WRAPPER`
+# otherwise the wrapper is set but sccache is not installed
+RUN cargo install sccache
+
 ARG BUILD_ARGS
 ARG PROFILE
-RUN cargo build --locked --profile $PROFILE $BUILD_ARGS
+ARG RUSTC_WRAPPER
+
+RUN type sccache && sccache --version
+ENV SCCACHE_CACHE_SIZE=10G
+ENV SCCACHE_DIR=/root/.cache/sccache
+ENV RUSTC_WRAPPER=$RUSTC_WRAPPER
+
+# please note this only works for self-hosted runner (i.e. on the same host)
+# CI across different GH-runners won't work well, my understanding is docker only considers
+# image layers as "bulid cache", and mounted cache doesn't belong to it and therefore not
+# exported/imported with build-push-action
+#
+# see https://github.com/docker/build-push-action/issues/716
+#     https://github.com/moby/buildkit/issues/1512
+#     https://github.com/moby/buildkit/issues/1673
+RUN --mount=type=cache,target=/root/.cache/sccache cargo build --locked --profile $PROFILE $BUILD_ARGS && sccache --show-stats
 
 # ==========================
 # stage 2: packaging
diff --git a/runtime/litmus/src/lib.rs b/runtime/litmus/src/lib.rs
index 8716d280cc..535d6fd786 100644
--- a/runtime/litmus/src/lib.rs
+++ b/runtime/litmus/src/lib.rs
@@ -145,8 +145,7 @@ pub const VERSION: RuntimeVersion = RuntimeVersion {
 	spec_name: create_runtime_str!("litmus-parachain"),
 	impl_name: create_runtime_str!("litmus-parachain"),
 	authoring_version: 1,
-	// same versioning-mechanism as polkadot:
-	// last digit is used for minor updates, like 9110 -> 9111 in polkadot
+	// same versioning-mechanism as polkadot: use last digit for minor updates
 	spec_version: 9115,
 	impl_version: 0,
 	apis: RUNTIME_API_VERSIONS,
diff --git a/scripts/build-docker.sh b/scripts/build-docker.sh
index 89b393cf28..283d9f7bb1 100755
--- a/scripts/build-docker.sh
+++ b/scripts/build-docker.sh
@@ -18,6 +18,7 @@ NOCACHE_FLAG=
 
 case "$PROFILE" in
     release)
+        RUSTC_WRAPPER=sccache
         ;;
     production)
         NOCACHE_FLAG="--no-cache" ;;
@@ -51,6 +52,7 @@ echo "Building ${GITUSER}/${GITREPO}:${TAG} docker image ..."
 docker build ${NOCACHE_FLAG} --pull -f ./docker/Dockerfile \
     --build-arg PROFILE="$PROFILE" \
     --build-arg BUILD_ARGS="$ARGS" \
+    --build-arg RUSTC_WRAPPER="$RUSTC_WRAPPER" \
     -t ${GITUSER}/${GITREPO}:${TAG} .
 
 # Tag it with latest if no tag parameter was provided