diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
index c569d503a..17a1fe382 100755
--- a/.clusterfuzzlite/build.sh
+++ b/.clusterfuzzlite/build.sh
@@ -17,4 +17,8 @@
 # Only meant to run inside ClusterFuzzLite or OSS-Fuzz, which provide
 # compile_native_go_fuzzer_v2.
 
-compile_native_go_fuzzer_v2 github.com/urunc-dev/urunc/pkg/unikontainers FuzzGetUnikernelConfig FuzzGetUnikernelConfig
+fuzzer=FuzzGetUnikernelConfig
+compile_native_go_fuzzer_v2 github.com/urunc-dev/urunc/pkg/unikontainers "$fuzzer" "$fuzzer"
+
+# compile_native_go_fuzzer_v2 exits 0 when it cannot find the function.
+test -x "$OUT/$fuzzer"
diff --git a/.dockerignore b/.dockerignore
index fd1cd5d31..501f816a3 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,7 @@
 # Keep .git: needed by git describe for version embedding.
 # COMMIT is also passed as a build-arg from CI to avoid a -dirty suffix.
 *
+!/.clusterfuzzlite
 !/.git
 !/cmd
 !/deployment
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c35a64525..dfc4c65be 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,6 +13,11 @@ updates:
           - "minor"
           - "patch"
 
+  - package-ecosystem: "docker"
+    directory: "/.clusterfuzzlite"
+    schedule:
+      interval: "weekly"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/.github/workflows/fuzz_batch.yml b/.github/workflows/fuzz_batch.yml
new file mode 100644
index 000000000..8ddc9005a
--- /dev/null
+++ b/.github/workflows/fuzz_batch.yml
@@ -0,0 +1,85 @@
+name: urunc fuzzing (batch)
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+# Shared with fuzz_prune.yml. Both download the corpus, change it and upload
+# it again, so overlapping runs would overwrite each other's corpus.
+concurrency:
+  group: clusterfuzzlite-corpus
+  cancel-in-progress: false
+
+jobs:
+  fuzz:
+    name: ClusterFuzzLite batch fuzzing
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    # The ClusterFuzzLite actions run mutable :v1 images, so this job only
+    # gets read access. The upload-sarif job uploads the results.
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      build: ${{ steps.build.outcome }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
+        with:
+          egress-policy: audit
+
+      - name: Build fuzz targets
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: go
+
+      - name: Run fuzz targets
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          language: go
+          mode: batch
+          fuzz-seconds: 1800
+          output-sarif: true
+
+      - name: Save SARIF results
+        if: always() && steps.build.outcome == 'success'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fuzz-sarif
+          path: cifuzz-sarif/results.sarif
+          if-no-files-found: error
+          retention-days: 7
+
+  upload-sarif:
+    name: Upload SARIF
+    needs: fuzz
+    # Also after a crash, which fails the fuzz job.
+    if: always() && needs.fuzz.outputs.build == 'success'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      # for github/codeql-action/upload-sarif to upload SARIF results
+      security-events: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
+        with:
+          egress-policy: audit
+
+      - name: Download SARIF results
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: fuzz-sarif
+          path: cifuzz-sarif
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          sarif_file: cifuzz-sarif/results.sarif
+          checkout_path: cifuzz-sarif
diff --git a/.github/workflows/fuzz_nightly.yml b/.github/workflows/fuzz_nightly.yml
deleted file mode 100644
index 21a96bcd9..000000000
--- a/.github/workflows/fuzz_nightly.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: urunc fuzzing (nightly)
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *'
-
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-
-jobs:
-  fuzz:
-    name: ClusterFuzzLite batch fuzzing
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
-        with:
-          egress-policy: audit
-
-      - name: Build fuzz targets
-        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
-        with:
-          language: go
-
-      - name: Run fuzz targets
-        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          language: go
-          mode: batch
-          fuzz-seconds: 1800
-          output-sarif: true
diff --git a/.github/workflows/fuzz_prune.yml b/.github/workflows/fuzz_prune.yml
index 58c4cc40a..8f50b32c5 100644
--- a/.github/workflows/fuzz_prune.yml
+++ b/.github/workflows/fuzz_prune.yml
@@ -3,17 +3,25 @@ name: urunc fuzzing (corpus pruning)
 on:
   workflow_dispatch:
   schedule:
-    - cron: '30 13 * * *'
+    - cron: '30 13 * * 0'
 
 permissions:
   contents: read
-  actions: read
+
+# Shared with fuzz_batch.yml. Both download the corpus, change it and upload
+# it again, so overlapping runs would overwrite each other's corpus.
+concurrency:
+  group: clusterfuzzlite-corpus
+  cancel-in-progress: false
 
 jobs:
   prune:
     name: ClusterFuzzLite corpus pruning
     runs-on: ubuntu-24.04
     timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a981364e9..4cc9077bb 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -78,6 +78,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v3.29.5
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: results.sarif