diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index 0f9c98a..bcab93b 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -1,25 +1,43 @@
 # Run the simulation-server regression tests (tests/Makefile) against a freshly
-# built sim_server, inside the pandablocks-dev-container. make is the runner.
+# built sim_server, on a plain ubuntu-latest runner. The Python sim/test harness
+# only needs numpy, which uv provisions from pyproject.toml + uv.lock — so this no
+# longer needs the pandablocks-dev-container image. make stays the runner.
+#
+# Things the container used to provide, handled here instead:
+#   - `python` with numpy: the harness scripts are `#!/usr/bin/env python`, so we run
+#     make under `uv run --locked`, which puts the venv's `python`/`python3` (with
+#     numpy) on PATH for the harness subprocesses (and asserts uv.lock is in sync).
+#   - valgrind: the test_configs leak checks run sim_server under valgrind (simserver
+#     without -n), so install it. (test_exchange uses `simserver -n`, no valgrind.)
+#   - a writable /build: CONFIG.example pins BUILD_DIR=/build/build-server (the
+#     cross-build convention), so override BUILD_DIR to a workspace path here.
+#
+# netcat-openbsd (preinstalled on the runner) covers the remaining `nc` pokes, bounded
+# with -w1; the server-readiness probe in run_with_server uses bash /dev/tcp so it does
+# not depend on the nc implementation (the container's BusyBox nc had different EOF
+# behaviour and was masking this).
 on:
   workflow_call:
 
 jobs:
   test:
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/pandablocks/pandablocks-dev-container:latest
-      volumes:
-        - ${{ github.workspace }}/build:/build
-
+    timeout-minutes: 15
     steps:
-      - name: Checkout Source
+      - name: Checkout
         uses: actions/checkout@v5
-        with:
-          path: PandABlocks-server
 
-      - name: Run the server regression tests
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      # Mirrors the valgrind line in the repo Dockerfile (same package + flags) so
+      # `make tests` behaves the same in the local dev container as it does here.
+      - name: Install valgrind (test_configs runs sim_server under valgrind)
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends valgrind
+
+      - name: Build sim_server and run the regression tests
         run: |
-          cd PandABlocks-server
+          set -euo pipefail
           ln -s CONFIG.example CONFIG
-          make sim_server
-          make -C tests
+          # `make tests` depends on sim_server and then runs `make -C tests`.
+          uv run --locked make BUILD_DIR="$PWD/build" tests
diff --git a/Dockerfile b/Dockerfile
index 991306b..20a3ba0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,6 +5,11 @@ FROM ghcr.io/diamondlightsource/ubuntu-devcontainer:resolute AS developer
 # Add any system dependencies for the developer/build environment here.
 # Candidates: an ARMv7-A cross-compiler toolchain for on-PandA builds; the
 # native toolchain below is enough for the simulation server and docs.
+#   npm:      drives npx mystmd for the docs build
+#   valgrind: the test_configs regression tests run sim_server under valgrind
+#             (mirrors the apt install in .github/workflows/_test.yml so `make
+#             tests` works the same locally in this container as it does in CI)
 RUN apt-get update -y && apt-get install -y --no-install-recommends \
     npm \
+    valgrind \
     && apt-get dist-clean
diff --git a/simserver.in b/simserver.in
index cf931ac..99523c1 100644
--- a/simserver.in
+++ b/simserver.in
@@ -64,9 +64,11 @@ shift $((OPTIND-1))
 
 
 # Force any previously running instance of the simulation server to go away --
-# this can happen if sim_server failed on startup for any reason.
-nc localhost 9999 </dev/null
-nc localhost $EXT_PORT </dev/null
+# this can happen if sim_server failed on startup for any reason. -w1 bounds the
+# poke: netcat-openbsd does not close on stdin EOF without -N, so without a timeout
+# it would hang here whenever a previous instance is actually still listening.
+nc -w1 localhost 9999 </dev/null
+nc -w1 localhost $EXT_PORT </dev/null
 
 # Run the simulation server as a daemon.  It will ensure its socket is up and
 # running before taking itself into the background.
diff --git a/tests/Makefile b/tests/Makefile
index 3284d92..d3125ea 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -42,7 +42,7 @@ TESTS += test_configs
 # Test interface to extension server
 
 test_extension:
-	-nc localhost 9999 </dev/null
+	-nc -w1 localhost 9999 </dev/null
 	$(TOP)/python/extension_server -d -qn $(TOP)/python/test_extension
 	./test_extension.py extension_script
 
diff --git a/tests/run_with_server b/tests/run_with_server
index 8020db9..1176a98 100755
--- a/tests/run_with_server
+++ b/tests/run_with_server
@@ -15,9 +15,13 @@ TOP="$HERE/.."
 SIM_PID=$!
 trap 'kill -s SIGINT $SIM_PID; wait $SIM_PID' EXIT
 
-# Wait for the server to start
+# Wait for the server to start.  Probe the config port with bash's /dev/tcp rather
+# than `nc`: nc's stdin-EOF behaviour differs between implementations (BusyBox nc
+# exits on EOF, netcat-openbsd keeps the connection open without -N and would hang
+# here), so a readiness loop around `nc` hangs on a stock ubuntu runner.  /dev/tcp
+# needs no external tool and just tests that the port is accepting connections.
 sleep 0.2
-while ! echo '*IDN?' | nc localhost 8888; do
+while ! (exec 3<>/dev/tcp/localhost/8888) 2>/dev/null; do
     echo connecting...
     sleep 0.2
 done