diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 718c2075..29564265 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -62,5 +62,5 @@ jobs:
     with:
       ref: ${{ inputs.ref || github.ref }}
       debug: false
-      target: "lint test"
+      target: "cache"
       all_platform: true
diff --git a/Makefile b/Makefile
index 34c3fd47..752ea12a 100644
--- a/Makefile
+++ b/Makefile
@@ -56,6 +56,10 @@ tidy:
 	go mod tidy
 	cd lib && go mod tidy
 
+cache:
+	go build ./...
+	cd lib && go build ./...
+
 test: gocovmerge
 	rm -f .cover.*
 	go test -coverprofile=.cover.pkg ./...
diff --git a/pkg/proxy/proxy.go b/pkg/proxy/proxy.go
index bbb42570..d9183326 100644
--- a/pkg/proxy/proxy.go
+++ b/pkg/proxy/proxy.go
@@ -190,6 +190,12 @@ func (s *SQLServer) onConn(ctx context.Context, conn net.Conn) {
 	clientConn.Run(ctx)
 }
 
+func (s *SQLServer) IsClosing() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.mu.inShutdown
+}
+
 // Graceful shutdown doesn't close the listener but rejects new connections.
 // Whether this affects NLB is to be tested.
 func (s *SQLServer) gracefulShutdown() {
@@ -213,9 +219,9 @@ func (s *SQLServer) gracefulShutdown() {
 		case <-timer.C:
 			return
 		case <-time.After(100 * time.Millisecond):
-			s.mu.Lock()
+			s.mu.RLock()
 			allClosed := len(s.mu.clients) == 0
-			s.mu.Unlock()
+			s.mu.RUnlock()
 			if allClosed {
 				return
 			}
@@ -236,13 +242,13 @@ func (s *SQLServer) Close() error {
 		errs = append(errs, s.listener.Close())
 	}
 
-	s.mu.Lock()
+	s.mu.RLock()
 	for _, conn := range s.mu.clients {
 		if err := conn.Close(); err != nil {
 			errs = append(errs, err)
 		}
 	}
-	s.mu.Unlock()
+	s.mu.RUnlock()
 
 	s.wg.Wait()
 	return errors.Collect(ErrCloseServer, errs...)
diff --git a/pkg/server/api/debug.go b/pkg/server/api/debug.go
index 46eefb4e..16af1c36 100644
--- a/pkg/server/api/debug.go
+++ b/pkg/server/api/debug.go
@@ -23,7 +23,11 @@ import (
 )
 
 func (h *HTTPServer) DebugHealth(c *gin.Context) {
-	c.JSON(http.StatusOK, config.HealthInfo{
+	status := http.StatusOK
+	if h.proxy.IsClosing() {
+		status = http.StatusBadGateway
+	}
+	c.JSON(status, config.HealthInfo{
 		ConfigChecksum: h.mgr.cfg.GetConfigChecksum(),
 	})
 }
diff --git a/pkg/server/api/http.go b/pkg/server/api/http.go
index 6c057083..5faca24e 100644
--- a/pkg/server/api/http.go
+++ b/pkg/server/api/http.go
@@ -28,6 +28,7 @@ import (
 	mgrcrt "github.com/pingcap/TiProxy/pkg/manager/cert"
 	mgrcfg "github.com/pingcap/TiProxy/pkg/manager/config"
 	mgrns "github.com/pingcap/TiProxy/pkg/manager/namespace"
+	"github.com/pingcap/TiProxy/pkg/proxy"
 	"go.uber.org/atomic"
 	"go.uber.org/ratelimit"
 	"go.uber.org/zap"
@@ -57,10 +58,12 @@ type HTTPServer struct {
 	limit    ratelimit.Limiter
 	ready    *atomic.Bool
 	lg       *zap.Logger
+	proxy    *proxy.SQLServer
 	mgr      managers
 }
 
 func NewHTTPServer(cfg config.API, lg *zap.Logger,
+	proxy *proxy.SQLServer,
 	nsmgr *mgrns.NamespaceManager, cfgmgr *mgrcfg.ConfigManager,
 	crtmgr *mgrcrt.CertManager, handler HTTPHandler,
 	ready *atomic.Bool) (*HTTPServer, error) {
@@ -68,6 +71,7 @@ func NewHTTPServer(cfg config.API, lg *zap.Logger,
 		limit: ratelimit.New(DefAPILimit),
 		ready: ready,
 		lg:    lg,
+		proxy: proxy,
 		mgr:   managers{cfgmgr, nsmgr, crtmgr},
 	}
 
diff --git a/pkg/server/server.go b/pkg/server/server.go
index 112c8f26..46cfcf71 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -87,11 +87,6 @@ func NewServer(ctx context.Context, sctx *sctx.Context) (srv *Server, err error)
 		return
 	}
 
-	// setup http
-	if srv.HTTPServer, err = api.NewHTTPServer(cfg.API, lg.Named("api"), srv.NamespaceManager, srv.ConfigManager, srv.CertManager, handler, ready); err != nil {
-		return
-	}
-
 	// general cluster HTTP client
 	{
 		srv.Http = &http.Client{
@@ -154,6 +149,11 @@ func NewServer(ctx context.Context, sctx *sctx.Context) (srv *Server, err error)
 		srv.Proxy.Run(ctx, srv.ConfigManager.WatchConfig())
 	}
 
+	// setup http
+	if srv.HTTPServer, err = api.NewHTTPServer(cfg.API, lg.Named("api"), srv.Proxy, srv.NamespaceManager, srv.ConfigManager, srv.CertManager, handler, ready); err != nil {
+		return
+	}
+
 	ready.Toggle()
 	return
 }