diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 8ad744f..7ef231d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -69,6 +69,8 @@ jobs:
           pull: true
           cache-to: type=gha,mode=max,scope=amd64
           target: test
+          build-args: |
+            GITHUB_BUILD=true
 
   build:
     needs: test
diff --git a/Dockerfile b/Dockerfile
index 9b02061..500af3a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,12 +3,9 @@
 # cannot install firefox deps for (no libgtk-3 -> camoufox fails to launch).
 FROM ubuntu:24.04 AS base
 
-ARG GITHUB_BUILD=false \
-    VERSION
+ARG GITHUB_BUILD=false
 
 ENV GITHUB_BUILD=${GITHUB_BUILD}\
-    VERSION=${VERSION}\
-    DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     # prevents python creating .pyc files
     PYTHONDONTWRITEBYTECODE=1 \
@@ -57,6 +54,11 @@ RUN \
     uv run pytest --retries 3
 
 FROM app
+# VERSION is a runtime-only env var (read by src.consts via Pydantic settings).
+# Declared here, not in base, so base/app layer cache keys don't depend on the
+# per-commit SHA — that would bust the cache every run.
+ARG VERSION
+ENV VERSION=${VERSION}
 USER 1000
 EXPOSE $PORT
 HEALTHCHECK --interval=15m --timeout=30s --start-period=5s --retries=3 CMD curl "http://127.0.0.1:${PORT}/health"