@@ -1,6 +1,7 @@
 # Prebuilt image for the turbo-compile gnu legs in phar.yml, published to
 # ghcr.io/phpstan/turbo-build by turbo-build-image.yml (tags gnu-php8.3,
-# gnu-php8.4, gnu-php8.5; each a linux/amd64 + linux/arm64 manifest).
+# gnu-php8.4, gnu-php8.5, gnu-php8.6; each a linux/amd64 + linux/arm64
+# manifest).
 #
 # Baking the PHP toolchain in keeps apt and the ondrej/php PPA out of the
 # compile jobs entirely: ports.ubuntu.com (the only Ubuntu arm64 mirror,
@@ -15,10 +16,23 @@ FROM ubuntu:22.04
 ARG PHP_MINOR
 ENV DEBIAN_FRONTEND=noninteractive
 
+# PHP 8.6 is a prerelease, and ondrej/php trails its tags by weeks: on
+# 2026-09-25 it still served 8.6.0beta3, whose module API (20250926) the
+# 8.6.0RC2 that the php:8.6-rc images ship had already replaced
+# (20260924) — an extension built against one refuses to load into the
+# other. The 8.6 image therefore builds the official release tarball on
+# the same base. Drop these and the source branch below once ondrej/php
+# ships 8.6.0.
+ARG PHP86_VERSION=8.6.0RC2
+ARG PHP86_URL=https://downloads.php.net/~mbeccati/php-8.6.0RC2.tar.xz
+ARG PHP86_SHA256=ef3fba21c311e9bbace0e2102702446d322c275b8a10e6b33b28f2561299671c
+
 # The source label links the GHCR package to this repository.
 LABEL org.opencontainers.image.source="https://github.com/phpstan/phpstan-src"
 LABEL org.opencontainers.image.description="PHP and build toolchain for compiling the phpstan_turbo extension (glibc floor 2.34)"
 
+COPY build-php.sh /tmp/build-php.sh
+
 # apt mirrors 404 mid-sync (the fetched index can reference a superseded
 # .deb already pruned from the pool); only a fresh index fixes that, so
 # update+install retries as a unit
@@ -34,8 +48,13 @@ RUN test -n "$PHP_MINOR"; \
 		return 1; \
 	}; \
 	apt_install software-properties-common gnupg ca-certificates curl git make g++ patch unzip zstd \
-	&& add-apt-repository -y ppa:ondrej/php \
-	&& apt_install "php$PHP_MINOR-cli" "php$PHP_MINOR-dev" "php$PHP_MINOR-curl" "php$PHP_MINOR-mbstring" "php$PHP_MINOR-xml" \
-	&& rm -rf /var/lib/apt/lists/* \
-	&& ln -sf "/usr/bin/php$PHP_MINOR" /usr/local/bin/php \
-	&& ln -sf "/usr/bin/php-config$PHP_MINOR" /usr/local/bin/php-config
+	&& if [ "$PHP_MINOR" = "8.6" ]; then \
+		apt_install pkg-config xz-utils libxml2-dev libonig-dev libcurl4-openssl-dev libssl-dev zlib1g-dev \
+		&& PHP_VERSION="$PHP86_VERSION" PHP_URL="$PHP86_URL" PHP_SHA256="$PHP86_SHA256" sh /tmp/build-php.sh; \
+	else \
+		add-apt-repository -y ppa:ondrej/php \
+		&& apt_install "php$PHP_MINOR-cli" "php$PHP_MINOR-dev" "php$PHP_MINOR-curl" "php$PHP_MINOR-mbstring" "php$PHP_MINOR-xml" \
+		&& ln -sf "/usr/bin/php$PHP_MINOR" /usr/local/bin/php \
+		&& ln -sf "/usr/bin/php-config$PHP_MINOR" /usr/local/bin/php-config; \
+	fi \
+	&& rm -rf /var/lib/apt/lists/* /tmp/build-php.sh
@@ -0,0 +1,44 @@
+#!/bin/sh
+# Builds and installs PHP $PHP_VERSION into /usr/local from the official
+# release tarball at $PHP_URL, verified against $PHP_SHA256. Used by the
+# Dockerfile for the PHP minors ondrej/php does not ship yet.
+#
+# The extensions match what the turbo-compile legs use from the PPA
+# images: tokenizer for the parser tests, pcntl + posix for the fork
+# tests, opcache (always built in since 8.5) for the trusted-types test,
+# and curl, mbstring, openssl, xml and zlib for Composer.
+set -eu
+
+cd /tmp
+curl -fsSLo php.tar.xz "$PHP_URL"
+echo "$PHP_SHA256  php.tar.xz" | sha256sum -c -
+mkdir php-src
+tar -xJf php.tar.xz -C php-src --strip-components=1
+rm php.tar.xz
+
+cd php-src
+./configure \
+	--prefix=/usr/local \
+	--disable-cgi \
+	--disable-phpdbg \
+	--without-sqlite3 \
+	--without-pdo-sqlite \
+	--enable-mbstring \
+	--enable-pcntl \
+	--with-curl \
+	--with-openssl \
+	--with-zlib
+make -j"$(nproc)"
+make install
+
+# The distro CLI packages the other images use ship a production php.ini
+# with no memory limit; match it.
+INI_DIR="$(php -r 'echo PHP_CONFIG_FILE_PATH;')"
+mkdir -p "$INI_DIR"
+sed 's/^memory_limit = .*/memory_limit = -1/' php.ini-production > "$INI_DIR/php.ini"
+
+cd /tmp
+rm -rf php-src
+
+php -r 'if (PHP_VERSION !== getenv("PHP_VERSION")) { fwrite(STDERR, "built PHP " . PHP_VERSION . ", expected " . getenv("PHP_VERSION") . "\n"); exit(1); }'
+php -m
@@ -35,7 +35,7 @@ env:
   COMPOSER_VERSION: "2.9.2"
   COMPOSER_PHAR_SHA256: "471f2d857abf0ec18af7b055e61472214d91adb24f9bdbbb864c1c64faad7dd6"
   # setup-php installs an 8.6 nightly, which has no matching Windows devel pack.
-  PHP86_WINDOWS_VERSION: "8.6.0beta3"
+  PHP86_WINDOWS_VERSION: "8.6.0RC2"
 
 jobs:
   compiler-tests:
@@ -397,9 +397,9 @@ jobs:
     # of ORIGIN_RUN_ID repeated in both). The tests of every binary, reused
     # or compiled, run in the turbo-differential jobs, so the commit job,
     # which needs the binaries, does not wait for them.
-    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('{0}-{1}-php{2}', matrix.target.artifact, matrix.target.name, matrix.php-version)] && 'ubuntu-latest' || (matrix.php-version == '8.6' && matrix.target.family == 'gnu' && (matrix.target.name == 'linux-gnu-arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') || matrix.target.runs-on) }}
+    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('{0}-{1}-php{2}', matrix.target.artifact, matrix.target.name, matrix.php-version)] && 'ubuntu-latest' || matrix.target.runs-on }}
     # Container legs pin the built binaries' userland floor independently of
-    # the runner image. The 8.3–8.5 gnu legs run in a prebuilt ubuntu:22.04-based
+    # the runner image. The gnu legs run in a prebuilt ubuntu:22.04-based
     # image (.github/turbo-build/Dockerfile, published to GHCR by
     # turbo-build-image.yml) with the PHP toolchain baked in: the glibc
     # symbol floor stays at 2.34 (RHEL 9, Ubuntu 22.04+, Debian 12+) and the
@@ -418,10 +418,9 @@ jobs:
     # not worth two binaries per PHP minor. Their binaries are deleted from
     # phpstan/phpstan by the commit job (TURBO_RETIRED_BINARIES). Windows
     # keeps its ZTS leg: XAMPP, WampServer and Scoop default to TS PHP.
-    # PHP 8.6 has no ondrej/php packages or prebuilt GNU image yet. Use
-    # setup-php on Jammy runners, preserving the shipped binary's glibc floor.
-    # Alpine's php86 packages are currently only in edge/testing.
-    container: ${{ !(fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('{0}-{1}-php{2}', matrix.target.artifact, matrix.target.name, matrix.php-version)]) && (matrix.target.family == 'gnu' && matrix.php-version != '8.6' && format('ghcr.io/phpstan/turbo-build:gnu-php{0}', matrix.php-version) || matrix.target.family == 'musl' && matrix.php-version == '8.6' && 'alpine:edge' || matrix.target.container) || '' }}
+    # The gnu-php8.6 image builds the official 8.6 prerelease tarball (see the
+    # Dockerfile). Alpine's php86 packages are currently only in edge/testing.
+    container: ${{ !(fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('{0}-{1}-php{2}', matrix.target.artifact, matrix.target.name, matrix.php-version)]) && (matrix.target.family == 'gnu' && format('ghcr.io/phpstan/turbo-build:gnu-php{0}', matrix.php-version) || matrix.target.family == 'musl' && matrix.php-version == '8.6' && 'alpine:edge' || matrix.target.container) || '' }}
     needs: turbo-origins
     timeout-minutes: 30
 
@@ -485,7 +484,7 @@ jobs:
       # The Alpine leg installs PHP and tooling before checkout:
       # actions/checkout needs git inside the container, and the build needs
       # php/php-config symlinks pointing at the matrix PHP version. The GNU
-      # container legs have the toolchain baked in; 8.6 uses setup-php below.
+      # container legs have the toolchain baked in.
       - name: "Install PHP and build tools (Alpine container)"
         if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'musl'
         run: |
@@ -526,13 +525,6 @@ jobs:
           coverage: "none"
           php-version: "${{ matrix.php-version }}"
 
-      - name: "Install PHP (GNU runners)"
-        if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'gnu' && matrix.php-version == '8.6'
-        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2.37.2
-        with:
-          coverage: "none"
-          php-version: "${{ matrix.php-version }}"
-
       # The training run of `make pgo` (bin/pgo-train.sh) runs bin/phpstan on
       # the checkout, so the dependencies must be in place before the build.
       - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
@@ -544,15 +536,11 @@ jobs:
         if: env.ORIGIN_RUN_ID == '' && matrix.target.family != 'macos'
         # checksum-pinned composer, run under the matrix PHP so platform
         # requirements are validated against the interpreter the build
-        # trains on. COMPOSER_HOME is isolated: on the runner (PHP 8.6) legs,
-        # setup-php seeds ~/.composer/auth.json with the workflow's GitHub
-        # token, which this pinned composer rejects at startup ("github oauth
-        # token contains invalid characters") — everything here comes from
-        # packagist dists, no auth needed.
+        # trains on
         run: |
           curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
           echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
-          COMPOSER_HOME="$(mktemp -d)" php composer.phar install --no-interaction --no-progress
+          php composer.phar install --no-interaction --no-progress
           rm composer.phar
 
       - name: "Compile phpstan_turbo with strict warnings (profile-guided)"
@@ -1142,11 +1130,15 @@ jobs:
     # reused, under the runtime setup-php installs on the platform the
     # binary is built for. Kept out of the compile jobs so the commit job,
     # which only needs the binaries, does not wait for them (see there).
-    # The musl binaries are tested in turbo-differential-musl.
+    # The musl binaries are tested in turbo-differential-musl. The linux-gnu
+    # 8.6 legs run in the image the binary is compiled in instead: setup-php's
+    # Linux 8.6 is a nightly snapshot that can predate the release the binary
+    # targets, and a module API mismatch refuses to load it at all.
     needs:
       - turbo-compile
       - turbo-compile-windows
     runs-on: ${{ matrix.runs-on }}
+    container: ${{ matrix.container || '' }}
     timeout-minutes: 30
 
     defaults:
@@ -1180,9 +1172,16 @@ jobs:
           # see turbo-run for why windows-latest loads the DLL
           - target: "windows-x86_64"
             runs-on: "windows-latest"
+          - target: "linux-gnu-x86_64"
+            php-version: "8.6"
+            container: "ghcr.io/phpstan/turbo-build:gnu-php8.6"
+          - target: "linux-gnu-arm64"
+            php-version: "8.6"
+            container: "ghcr.io/phpstan/turbo-build:gnu-php8.6"
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
+        if: ${{ !matrix.container }}
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
@@ -1193,6 +1192,7 @@ jobs:
           persist-credentials: false
 
       - name: "Install PHP"
+        if: ${{ !matrix.container }}
         uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2.37.2
         env:
           phpts: "${{ matrix.ts == 'zts' && 'ts' || 'nts' }}"
@@ -1207,9 +1207,18 @@ jobs:
         run: bash .github/scripts/install-php86-windows.sh
 
       - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
+        if: ${{ !matrix.container }}
         with:
           ignore-cache: true
 
+      - name: "Install Composer dependencies (pinned composer)"
+        if: ${{ matrix.container }}
+        run: |
+          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
+          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          php composer.phar install --no-interaction --no-progress
+          rm composer.phar
+
       - name: "Download extension artifact"
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -1407,6 +1416,13 @@ jobs:
         exclude:
           - operating-system: "ubuntu-latest"
             ts: "zts"
+          # setup-php's Linux 8.6 is a nightly snapshot that can predate the
+          # release the binary is compiled against (on 2026-09-25 it still
+          # had the module API 8.6.0RC2 replaced), and a module API mismatch
+          # refuses to load the extension at all. turbo-docker-run runs the
+          # same checks with this binary in the official 8.6 prerelease image.
+          - operating-system: "ubuntu-latest"
+            php-version: "8.6"
         # macOS runs the shipped ad-hoc-signed arm64 binary; there is no
         # macOS zts build, and 8.3/8.4 coverage comes from the other legs.
         include:
 
@@ -3,7 +3,7 @@
 name: "Build Turbo compile images"
 
 # Builds .github/turbo-build/Dockerfile natively on x86_64 and arm64
-# runners and publishes ghcr.io/phpstan/turbo-build:gnu-php{8.3,8.4,8.5}
+# runners and publishes ghcr.io/phpstan/turbo-build:gnu-php{8.3,8.4,8.5,8.6}
 # as multi-arch manifests. The turbo-compile gnu legs in phar.yml run in
 # these images, so their only network dependency is a GHCR pull — no apt,
 # no ports.ubuntu.com, no PPA at compile time.
@@ -45,7 +45,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-version: ["8.3", "8.4", "8.5"]
+        php-version: ["8.3", "8.4", "8.5", "8.6"]
         platform:
           - arch: "amd64"
             runs-on: "ubuntu-latest"
@@ -97,7 +97,7 @@ jobs:
 
     strategy:
       matrix:
-        php-version: ["8.3", "8.4", "8.5"]
+        php-version: ["8.3", "8.4", "8.5", "8.6"]
 
     env:
       TAG: "ghcr.io/phpstan/turbo-build:gnu-php${{ matrix.php-version }}"