diff --git a/mise.toml b/mise.toml
index 5659aacb6c..8cff3993f7 100644
--- a/mise.toml
+++ b/mise.toml
@@ -54,8 +54,8 @@ lockfile = true
 
 [tasks.plugins]
 run = [
-  "pnpm --filter @immich/plugin-sdk --filter @immich/plugin-core install --frozen-lockfile",
-  "pnpm --filter @immich/plugin-sdk --filter @immich/plugin-core build",
+  "pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter @immich/plugin-core install --frozen-lockfile",
+  "pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter @immich/plugin-core build",
 ]
 
 [tasks.open-api-typescript]
@@ -108,7 +108,7 @@ depends = "//:plugins"
 dir = "docker"
 interactive = true
 env = { COMPOSE_BAKE = true }
-run = "docker compose -f ./docker-compose.prod.yml up --remove-orphans"
+run = "docker compose -f ./docker-compose.prod.yml up --build --remove-orphans"
 depends_post = "//:prod-down"
 
 [tasks.prod-scale]
diff --git a/packages/plugin-sdk/package.json b/packages/plugin-sdk/package.json
index f505a6cc0e..1121e42f59 100644
--- a/packages/plugin-sdk/package.json
+++ b/packages/plugin-sdk/package.json
@@ -27,6 +27,7 @@
   "packageManager": "pnpm@10.33.4",
   "devDependencies": {
     "@extism/js-pdk": "^1.1.1",
+    "@immich/sdk": "workspace:*",
     "@types/node": "^24.12.4",
     "esbuild": "^0.28.0",
     "tsc-alias": "^1.8.16",
diff --git a/packages/plugin-sdk/src/host-functions.ts b/packages/plugin-sdk/src/host-functions.ts
index d0f8a3ef17..ab76218551 100644
--- a/packages/plugin-sdk/src/host-functions.ts
+++ b/packages/plugin-sdk/src/host-functions.ts
@@ -1,3 +1,6 @@
+import { type BulkIdResponseDto, type BulkIdsDto } from '@immich/sdk';
+
+// keep in sync with plugin-core/src/index.d.ts';
 declare module 'extism:host' {
   interface user {
     albumAddAssets(ptr: PTR): I64;
@@ -45,7 +48,11 @@ type AlbumsToAssets = {
 
 export const hostFunctions = (authToken: string) => ({
   albumAddAssets: (albumId: string, assetIds: string[]) =>
-    call('albumAddAssets', authToken, [albumId, { ids: assetIds }]),
+    call<[string, BulkIdsDto], BulkIdResponseDto[]>(
+      'albumAddAssets',
+      authToken,
+      [albumId, { ids: assetIds }],
+    ),
   addAssetsToAlbums: ({ assetIds, albumIds }: AlbumsToAssets) =>
     call('addAssetsToAlbums', authToken, [{ albumIds, assetIds }]),
 });
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 64cf0d3d85..4eef7170f6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -332,6 +332,9 @@ importers:
       '@extism/js-pdk':
         specifier: ^1.1.1
         version: 1.1.1
+      '@immich/sdk':
+        specifier: workspace:*
+        version: link:../sdk
       '@types/node':
         specifier: ^24.12.4
         version: 24.12.4
diff --git a/server/Dockerfile b/server/Dockerfile
index 6078a97504..3d074ba17f 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -13,14 +13,15 @@ FROM builder AS server
 
 WORKDIR /usr/src/app
 COPY ./server ./server/
+COPY ./packages/sdk ./packages/sdk/
 COPY ./packages/plugin-sdk ./packages/plugin-sdk/
 RUN --mount=type=cache,id=pnpm-server,target=/buildcache/pnpm-store \
   --mount=type=bind,source=package.json,target=package.json \
   --mount=type=bind,source=.pnpmfile.cjs,target=.pnpmfile.cjs \
   --mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
   --mount=type=bind,source=pnpm-workspace.yaml,target=pnpm-workspace.yaml \
-  SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter immich --filter @immich/plugin-sdk --frozen-lockfile build && \
-  SHARP_FORCE_GLOBAL_LIBVIPS=true pnpm --filter immich --frozen-lockfile --prod --no-optional deploy /output/server-pruned
+  SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich --frozen-lockfile build && \
+  SHARP_FORCE_GLOBAL_LIBVIPS=true  pnpm --filter immich --frozen-lockfile --prod --no-optional deploy /output/server-pruned
 
 FROM builder AS web
 
@@ -66,6 +67,7 @@ ENV MISE_DISABLE_TOOLS=flutter
 RUN --mount=type=cache,id=mise-tools-${TARGETPLATFORM},target=/buildcache/mise \
   mise install
 
+COPY ./packages/sdk ./packages/sdk/
 COPY ./packages/plugin-core ./packages/plugin-core/
 COPY ./packages/plugin-sdk ./packages/plugin-sdk/
 
diff --git a/server/mise.toml b/server/mise.toml
index f7e4f92a26..1462af0c52 100644
--- a/server/mise.toml
+++ b/server/mise.toml
@@ -68,6 +68,7 @@ run = [
 [tasks.ci-medium]
 run = [
   { task = ":install" },
+  { task = "//:plugins" },
   { task = "//packages/plugin-core:build" },
   { task = ":test-medium --run" },
 ]
diff --git a/server/src/services/workflow-execution.service.ts b/server/src/services/workflow-execution.service.ts
index 0f600e117b..0ada9e7e8f 100644
--- a/server/src/services/workflow-execution.service.ts
+++ b/server/src/services/workflow-execution.service.ts
@@ -359,7 +359,6 @@ export class WorkflowExecutionService extends BaseService {
               },
               session: {
                 id: DummyValue.UUID,
-                // TODO move this to auth.elevated or similar
                 hasElevatedPermission: true,
               },
             } as AuthDto,