diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index dae767ae25..5a2c68fe39 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -48,14 +48,14 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends lld
-          sudo apt-get remove libnss3-dev libnspr4-dev pkg-config
+          sudo apt-get remove -y pkg-config
           echo "RUSTFLAGS=-C link-arg=-fuse-ld=lld" >> "$GITHUB_ENV"
-          # https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2204-Readme.md#homebrew-note
+          # Pull in a newer version of NSS than what Ubuntu 22.04 provides. Once newer
+          # GitHub runners are available, we can check if their NSS is sufficient.
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           brew update
           brew install nss pkg-config
           echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
-          pkg-config --debug --modversion nss
 
       - name: Install dependencies (MacOS)
         if: runner.os == 'MacOS'
@@ -74,13 +74,9 @@ jobs:
             echo "C:\\msys64\\mingw64\\bin"
           } >> "$GITHUB_PATH"
           /c/msys64/usr/bin/pacman -S --noconfirm mingw-w64-x86_64-nss mingw-w64-x86_64-pkg-config
-          {
-            echo "LIBPATH=$LIBPATH;C:/msys64/mingw64/lib"
-          } >> "$GITHUB_ENV"
           # See https://github.com/ilammy/msvc-dev-cmd#name-conflicts-with-shell-bash
           rm /usr/bin/link.exe
           rm C:\\msys64\\usr\\bin\\link.exe
-          C:\\msys64\\mingw64\\bin\\pkg-config --debug --modversion nss
 
       - name: Set up MSVC build environment (Windows)
         if: runner.os == 'Windows'
@@ -95,7 +91,7 @@ jobs:
       - name: Build
         run: |
           # shellcheck disable=SC2086
-          cargo +${{ matrix.rust-toolchain }} build -vv $BUILD_TYPE --all-targets --features ci
+          cargo +${{ matrix.rust-toolchain }} build -v $BUILD_TYPE --all-targets --features ci
 
       - name: Run tests and determine coverage
         run: |
diff --git a/qns/Dockerfile b/qns/Dockerfile
index 5c62472202..648bfe847c 100644
--- a/qns/Dockerfile
+++ b/qns/Dockerfile
@@ -1,7 +1,9 @@
 FROM martenseemann/quic-network-simulator-endpoint:latest AS buildimage
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl build-essential lld libnss3-dev \
+    curl build-essential libclang-dev pkg-config \
+    build-essential procps curl file git \
+    && apt-get remove -y pkg-config \
     && apt-get autoremove -y && apt-get clean -y \
     && rm -rf /var/lib/apt/lists/*
 
@@ -14,21 +16,27 @@ ENV RUSTUP_HOME=/usr/local/rustup \
 RUN curl https://sh.rustup.rs -sSf | \
     sh -s -- -y -q --no-modify-path --profile minimal --default-toolchain $RUST_VERSION
 
+# Pull in a newer version of NSS with Homebrew. Note this only works on Intel platforms.
+# Once martenseemann/quic-network-simulator-endpoint uses an Ubuntu flavor with a new-enough
+# NSS, we should remove this and install NSS from the package manager.
+RUN useradd --create-home --shell /bin/bash --user-group linuxbrew \
+    && echo 'linuxbrew ALL=(ALL) NOPASSWD:ALL' >>/etc/sudoers
+USER linuxbrew
+RUN /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+RUN brew install nss pkg-config
+
 ADD . /neqo
 
 RUN set -eux; \
     cd /neqo; \
-    RUSTFLAGS="-g -C link-arg=-fuse-ld=lld" cargo build --release \
-    --bin neqo-client --bin neqo-server
+    cargo build --release --bin neqo-client --bin neqo-server
 
 # Copy only binaries to the final image to keep it small.
 
 FROM martenseemann/quic-network-simulator-endpoint:latest
 
-ENV LD_LIBRARY_PATH=/neqo/lib
+# TODO: install NSS
 COPY --from=buildimage /neqo/target/release/neqo-client /neqo/target/release/neqo-server /neqo/bin/
-COPY --from=buildimage /dist/Release/lib/*.so /neqo/lib/
-COPY --from=buildimage /dist/Release/bin/certutil /dist/Release/bin/pk12util /neqo/bin/
 
 COPY qns/interop.sh /neqo/
 RUN chmod +x /neqo/interop.sh