diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index fdf1d42..0411146 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -8,7 +8,7 @@ on:
     branches: [main]
 
 env:
-  BINK_VERSION: v0.1.1
+  BINK_COMMIT: 2b1bbdca74fc36d319fb1ea6d0523d9a732fcb1f
 
 permissions: {}
 
@@ -33,6 +33,11 @@ jobs:
           go-version-file: go.mod
           cache: true # zizmor: ignore[cache-poisoning]
 
+      - name: Check generated files
+        run: |
+          make fmt manifests generate
+          git diff --exit-code || { echo "Run 'make fmt manifests generate' and commit the results"; exit 1; }
+
       - name: Unit tests
         run: make unit
 
@@ -42,8 +47,45 @@ jobs:
       - name: Lint
         run: make lint
 
+  build-bink:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout bink
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: alicefr/bink
+          ref: ${{ env.BINK_COMMIT }}
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true # zizmor: ignore[cache-poisoning]
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libgpgme-dev \
+            libbtrfs-dev \
+            libdevmapper-dev \
+            pkg-config
+
+      - name: Build bink
+        run: make build-bink
+
+      - name: Upload bink binary
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: bink
+          path: bink
+
   e2e:
     runs-on: ubuntu-latest
+    needs: build-bink
     timeout-minutes: 30
     permissions:
       contents: read
@@ -56,11 +98,14 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Download bink release
-        run: |
-          sudo curl -fsSL -o /usr/local/bin/bink \
-            https://github.com/alicefr/bink/releases/download/${{ env.BINK_VERSION }}/bink
-          sudo chmod +x /usr/local/bin/bink
+      - name: Download bink binary
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: bink
+          path: /usr/local/bin
+
+      - name: Make bink executable
+        run: chmod +x /usr/local/bin/bink
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
diff --git a/Makefile b/Makefile
index 1b0186e..cb42436 100644
--- a/Makefile
+++ b/Makefile
@@ -44,6 +44,14 @@ vet: ## Run go vet against code.
 unit: manifests generate setup-envtest ## Run unit tests (envtest). V=1 for verbose. RUN=<regex> to filter.
 	KUBEBUILDER_ASSETS="$(shell "$(ENVTEST)" use $(ENVTEST_K8S_VERSION) --bin-dir "$(LOCALBIN)" -p path)" go test $(if $(V),-v) $(if $(RUN),-run $(RUN)) $$(go list ./... | grep -v /test/e2e)
 
+.PHONY: lint
+lint: golangci-lint ## Run golangci-lint linter.
+	"$(GOLANGCI_LINT)" run
+
+.PHONY: lint-fix
+lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes.
+	"$(GOLANGCI_LINT)" run --fix
+
 .PHONY: e2e
 e2e: ## Run e2e tests (requires: make deploy-bink). V=1 for verbose. RUN=<regex> to filter.
 # NB: we `cd` here instead of passing a package path to `go test` so that `-v`
@@ -54,14 +62,6 @@ e2e: ## Run e2e tests (requires: make deploy-bink). V=1 for verbose. RUN=<regex>
 		$(if $(BINK_NODE_IMAGE),BINK_NODE_IMAGE=$(BINK_NODE_IMAGE)) \
 		go test -timeout 10m -count=1 $(if $(V),-v) $(if $(RUN),-run $(RUN)) .
 
-.PHONY: lint
-lint: golangci-lint ## Run golangci-lint linter.
-	"$(GOLANGCI_LINT)" run
-
-.PHONY: lint-fix
-lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes.
-	"$(GOLANGCI_LINT)" run --fix
-
 ##@ Build
 
 .PHONY: build
diff --git a/internal/bootc/status.go b/internal/bootc/status.go
index 7fe5f69..2438d39 100644
--- a/internal/bootc/status.go
+++ b/internal/bootc/status.go
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
+// TODO: move this to e.g. github.com/bootc-dev/bootc-go. We should be able to
+// dedupe with at least flightctl.
+
 package bootc
 
 import (
@@ -24,26 +27,26 @@ type StatusSpec struct {
 
 // StatusBody is the status section of bootc status output.
 type StatusBody struct {
-	Staged           *BootEntry       `json:"staged"`
-	Booted           *BootEntry       `json:"booted"`
-	Rollback         *BootEntry       `json:"rollback"`
-	OtherDeployments []BootEntry      `json:"otherDeployments,omitempty"`
-	RollbackQueued   bool             `json:"rollbackQueued"`
-	Type             *string          `json:"type"`
+	Staged           *BootEntry         `json:"staged"`
+	Booted           *BootEntry         `json:"booted"`
+	Rollback         *BootEntry         `json:"rollback"`
+	OtherDeployments []BootEntry        `json:"otherDeployments,omitempty"`
+	RollbackQueued   bool               `json:"rollbackQueued"`
+	Type             *string            `json:"type"`
 	UsrOverlay       *FilesystemOverlay `json:"usrOverlay"`
 }
 
 // BootEntry represents a single boot entry (booted, staged, or rollback).
 type BootEntry struct {
-	Image             *ImageStatus       `json:"image"`
-	CachedUpdate      *ImageStatus       `json:"cachedUpdate"`
-	Incompatible      bool               `json:"incompatible"`
-	Pinned            bool               `json:"pinned"`
-	SoftRebootCapable bool               `json:"softRebootCapable"`
-	DownloadOnly      bool               `json:"downloadOnly"`
-	Store             *string            `json:"store"`
-	Ostree            *OstreeInfo        `json:"ostree"`
-	Composefs         *ComposefsInfo     `json:"composefs"`
+	Image             *ImageStatus   `json:"image"`
+	CachedUpdate      *ImageStatus   `json:"cachedUpdate"`
+	Incompatible      bool           `json:"incompatible"`
+	Pinned            bool           `json:"pinned"`
+	SoftRebootCapable bool           `json:"softRebootCapable"`
+	DownloadOnly      bool           `json:"downloadOnly"`
+	Store             *string        `json:"store"`
+	Ostree            *OstreeInfo    `json:"ostree"`
+	Composefs         *ComposefsInfo `json:"composefs"`
 }
 
 // ImageStatus describes the image in a boot entry.
@@ -81,8 +84,8 @@ type ComposefsInfo struct {
 // ImageSignature describes the signature verification policy.
 type ImageSignature struct {
 	OstreeRemote    *string `json:"ostreeRemote,omitempty"`
-	ContainerPolicy *bool  `json:"containerPolicy,omitempty"`
-	Insecure        *bool  `json:"insecure,omitempty"`
+	ContainerPolicy *bool   `json:"containerPolicy,omitempty"`
+	Insecure        *bool   `json:"insecure,omitempty"`
 }
 
 // FilesystemOverlay describes a /usr overlay state.
diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go
index c5442a9..928d062 100644
--- a/test/e2e/e2eutil/env.go
+++ b/test/e2e/e2eutil/env.go
@@ -124,7 +124,7 @@ func (e *Env) AddNode(t *testing.T, opts ...NodeOption) string {
 	nodeName := e.generateNodeName(t)
 
 	// Provision the node with labels applied at join time.
-	args := []string{"node", "add", nodeName, "--cluster-name", e.clusterName, "--control-plane", "controller"}
+	args := []string{"node", "add", nodeName, "--cluster-name", e.clusterName}
 	args = append(args, "--label", LabelE2ETest+"="+e.testID)
 	for k, v := range cfg.labels {
 		args = append(args, "--label", k+"="+v)
diff --git a/test/util/builders.go b/test/util/builders.go
index 194bf58..8fce6a3 100644
--- a/test/util/builders.go
+++ b/test/util/builders.go
@@ -12,6 +12,9 @@ import (
 	bootcv1alpha1 "github.com/jlebon/bootc-operator/api/v1alpha1"
 )
 
+// Test fixture values. These are not helpers per se that are any use for e2e
+// tests, but it's a convenient global spot for now. Should probably be moved
+// to a separate envtest-specific package.
 const (
 	ImageRepo = "quay.io/example/myos"