diff --git a/build.sh b/build.sh
index e0e638c..8c7262d 100755
--- a/build.sh
+++ b/build.sh
@@ -102,7 +102,7 @@ step 2 "serving tree (upstream v0.30.0 + $(ls "$HERE"/patches/*.patch | wc -l) p
 # The tree is not in this repo: this repo ships the patches, not the tree. Fetch applies the series
 # to the upstream tag and asserts the result, so a patch series that drifts fails here, not at serve.
 BASE=ced6857afa0ea7b2e3f0846a62e1394e90f15607              # tag v0.30.0
-EXPECTED_TREE=a47150d66ebe25da5b1da08bdbb86820a4aa3fac     # BASE + patches/*.patch (105), verified 2026-10-18
+EXPECTED_TREE=c9c526755364d44d8d9923d9acc9d6d1a3d58718     # BASE + patches/*.patch (106), verified 2026-10-17
 URL="${VLLM_UPSTREAM_URL:-https://github.com/vllm-project/vllm.git}"
 # git am makes a commit, so git needs a committer identity: the host's ~/.gitconfig is not there (a
 # container, a build user, a fresh box). The committer is not in the tree hash, so the assertion
@@ -293,7 +293,17 @@ elif [ -f "$MARK" ] && [ "$FORCE" = 1 ]; then
 elif [ -f "$MARK" ]; then
   read -r _ c_sha moe_sha tree_at_build < "$MARK"
   reuse=1
-  [ "$tree_at_build" = "$TREE_HEAD" ] || { echo "note: the tree moved $tree_at_build -> $TREE_HEAD; the compile below rebuilds what changed"; reuse=0; }
+  if [ "$tree_at_build" != "$TREE_HEAD" ]; then
+    # A tree move only forces an extension rebuild when a C++/CUDA source actually changed.
+    # A Python-only patch (the common case) reuses the existing extensions: ninja would
+    # otherwise recompile everything because git am refreshes every file timestamp.
+    if git -C "$SRC" diff --name-only "$tree_at_build" "$TREE_HEAD" -- 'csrc/' '*.cu' '*.cuh' '*.cpp' '*.cc' 'CMakeLists.txt' 'setup.py' 'pyproject.toml' 2>/dev/null | grep -q .; then
+      echo "note: the tree moved $tree_at_build -> $TREE_HEAD and C++/CUDA sources changed; rebuilding the extensions"
+      reuse=0
+    else
+      echo "note: the tree moved $tree_at_build -> $TREE_HEAD but no C++/CUDA sources changed; reusing the extensions"
+    fi
+  fi
   if [ "$(sha256sum "$SRC/vllm/_C_stable_libtorch.abi3.so" 2>/dev/null | cut -d' ' -f1)" != "$c_sha" ] || [ "$(sha256sum "$SRC/vllm/_moe_C_stable_libtorch.abi3.so" 2>/dev/null | cut -d' ' -f1)" != "$moe_sha" ]; then
     echo "note: the extensions are not the ones recorded in $MARK; the compile below rebuilds them"
     reuse=0
diff --git a/docker-compose.yml b/docker-compose.yml
index 7384704..beda551 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,7 +19,12 @@ services:
               count: all
               capabilities: [gpu]
     command: ["${MODEL_MOUNT_PATH:-/models/Qwen3.8-Flash-Next}"]
+    ipc: host
     shm_size: 16g
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - seccomp=unconfined
     ulimits:
       memlock: -1
       stack: 67108864
diff --git a/start.sh b/start.sh
index 9ef29b0..ddbf0d9 100755
--- a/start.sh
+++ b/start.sh
@@ -312,8 +312,7 @@ exec ${topo_launch_prefix:+$topo_launch_prefix} "$VENV/bin/vllm" serve "$CKPT" \
   --override-generation-config '{"temperature": 1.0, "top_p": 0.95, "top_k": 20, "min_p": 0.0, "presence_penalty": 0.0, "repetition_penalty": 1.0}' \
   --default-chat-template-kwargs '{"enable_thinking": true, "reasoning_effort": "xhigh"}' \
   --shutdown-timeout 10 \
-  --block-size 2048 --use-replayssm \
+  --block-size 4096 --use-replayssm \
   --prefix-match-unit 64 \
-  --safetensors-load-strategy prefetch \
   --disable-uvicorn-access-log \
   "$@"