diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d5cd5d5c9..869aec0ac 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -33,6 +33,25 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  devcontainer:
+    # https://github.com/orgs/community/discussions/25722
+    if:
+      (github.repository == 'enola-dev/enola') &&
+      (github.event.pull_request.draft == false)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: DevContainer
+        # TODO if: ${{ github.event_name == 'push' }}
+        uses: devcontainers/ci@v0.3
+        with:
+          # TODO imageName: ghcr.io/example/example-devcontainer
+          # TODO cacheFrom: ghcr.io/example/example-devcontainer
+          # TODO push: always
+          push: never
+          runCmd: echo DevContainer OK!
+          # TODO runCmd: ./tools/test-ci/test.bash
+
   build:
     # https://github.com/orgs/community/discussions/25722
     if:
@@ -150,6 +169,7 @@ jobs:
         if: ${{ github.event_name == 'push' }}
         run: ./tools/docs/build.bash
 
+      # TODO Move *BEFORE* ./tools/test-ci/test.bash, so that "dirty" changes cause build to abort
       - name: pre-commit run --all-files
         run: .venv/bin/pre-commit run --all-files
 
diff --git a/tools/asdf/install.bash b/tools/asdf/install.bash
index 36f2efea0..20e93ec3d 100755
--- a/tools/asdf/install.bash
+++ b/tools/asdf/install.bash
@@ -24,7 +24,9 @@ set -euo pipefail
 # let's wipe everything, and (re)install only the one we want below
 # (via ASDF, for consistency), to avoid confusion:
 # TODO Remove this when .devcontainer/devcontainer.json switched to a lighter base image
-rm -rf /usr/local/sdkman/candidates/java/
+if [[ -n "${REMOTE_CONTAINERS:-}" ]]; then
+  sudo rm -rf /usr/local/sdkman/candidates/java/
+fi
 
 if ! [ -x "$(command -v asdf)" ]; then
   if ! [ -d "$HOME/.asdf/" ]; then
diff --git a/tools/devcontainer/install.bash b/tools/devcontainer/install.bash
index 699bbeff5..9e1231ef0 100755
--- a/tools/devcontainer/install.bash
+++ b/tools/devcontainer/install.bash
@@ -15,7 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-set -euo pipefail
+set -euox pipefail
 
 # This script prepares the Dev Container used for GitHub CodeSpaces.
 # Because this is invoked as an onCreateCommand in the .devcontainer/devcontainer.json,