diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 954131d01..fb08359af 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -88,3 +88,13 @@ repos:
           - "prettier@3.1.0"
           - "@prettier/plugin-xml@3.3.1"
         files: \.(xml)$
+
+  - repo: local
+    hooks:
+      - id: no-coverage-mixins
+        name: Keep coverage mixins out of the workspace colcon defaults
+        description: Coverage stays off in the template. Opt in through COLCON_DEFAULTS_FILE.
+        # Matches coverage- anywhere outside a comment, including quoted and flow-style entries.
+        entry: '^[^#]*coverage-'
+        language: pygrep
+        files: ^colcon-defaults\.yaml$
diff --git a/Dockerfile b/Dockerfile
index 56c01daa6..fe84f603a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -80,7 +80,8 @@ RUN colcon mixin add default \
     colcon metadata add default \
     https://raw.githubusercontent.com/colcon/colcon-metadata-repository/master/index.yaml && \
     colcon metadata update
-COPY colcon-defaults.yaml /home/${USERNAME}/.colcon/defaults.yaml
+# --chown lets colcon read the defaults even when the entrypoint has not re-chowned $HOME yet.
+COPY --chown=${USER_UID}:${USER_GID} colcon-defaults.yaml /home/${USERNAME}/.colcon/defaults.yaml
 
 # hadolint ignore=DL3002
 USER root
diff --git a/colcon-defaults.yaml b/colcon-defaults.yaml
index 9aedbf87e..d8c5802fe 100644
--- a/colcon-defaults.yaml
+++ b/colcon-defaults.yaml
@@ -11,8 +11,7 @@ build:
     # Debug info and build testing for dev workflows
     - rel-with-deb-info
     - build-testing-on
-    - coverage-gcc
-    - coverage-pytest
+    # Coverage is off because the image lacks pytest-cov and gcov slows builds. Opt in through COLCON_DEFAULTS_FILE.
 test:
   event-handlers:
     - console_direct+