diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1238674..cac8ac0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -42,15 +42,16 @@ jobs:
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
-      - name: Build ${{ matrix.variant }} image
-        run: |
-          ./build.sh "${{ matrix.variant }}" "${{ env.IMAGE_NAME }}" "${{ env.IMAGE_REGISTRY }}"
-
       - name: Login to GHCR
-        if: github.event_name != 'pull_request'
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" | buildah login ghcr.io -u ${{ github.actor }} --password-stdin
 
+      - name: Build ${{ matrix.variant }} image
+        run: |
+          CACHE_PUSH="false"
+          if [ "${{ github.event_name }}" != "pull_request" ]; then CACHE_PUSH="true"; fi
+          ./build.sh "${{ matrix.variant }}" "${{ env.IMAGE_NAME }}" "${{ env.IMAGE_REGISTRY }}" $CACHE_PUSH
+
       - name: Push ${{ matrix.variant }} image
         if: github.event_name != 'pull_request'
         run: |
diff --git a/build.sh b/build.sh
index 0db99f6..dab95ec 100755
--- a/build.sh
+++ b/build.sh
@@ -6,11 +6,13 @@ set -ouex pipefail
 VARIANT=${1:?VARIANT required (base|desktop|laptop)}
 IMAGE_NAME=${2:?IMAGE_NAME required}
 IMAGE_REGISTRY=${3:?IMAGE_REGISTRY required}
+CACHE_PUSH=${4:?CACHE_PUSH required (true|false)}
 
 FULL_IMAGE="${IMAGE_REGISTRY}/${IMAGE_NAME}"
+CACHE_REPO="${FULL_IMAGE}-cache-${VARIANT}"
 TIMESTAMP=$(date -u +%Y%m%d)
 
-echo "buildah version: $(buildah --version)"
+echo "$(buildah --version)"
 
 # Pin a chunkah release for reproducible builds; bump deliberately.
 # Check https://github.com/coreos/chunkah/releases for newer tags.
@@ -21,16 +23,15 @@ UNCHUNKED_TAG="localhost/${IMAGE_NAME}-${VARIANT}-unchunked:latest"
 
 echo "Building ${VARIANT} variant of ${FULL_IMAGE}"
 
-# 1. Build exactly as before, but into a throwaway local tag. This has
-#    normal Dockerfile-shaped layers (one per RUN/COPY).
-buildah build -f "Containerfile.${VARIANT}" -t "${UNCHUNKED_TAG}" .
+BUILD_ARGS=(--layers --cache-from "${CACHE_REPO}")
+if [[ "${CACHE_PUSH}" == "true" ]]; then
+  BUILD_ARGS+=(--cache-to "${CACHE_REPO}")
+fi
+
+buildah build "${BUILD_ARGS[@]}" -f "Containerfile.${VARIANT}" -t "${UNCHUNKED_TAG}" .
 
-# 2. Capture the image's config/labels (incl. containers.bootc=1 and
-#    versioning info) before chunkah rebuilds it - the splitter flow
-#    below doesn't carry these over on its own.
 CHUNKAH_CONFIG_STR=$(buildah inspect --type image "${UNCHUNKED_TAG}")
 
-# 3. Rechunk into content-based layers.
 #    --skip-unused-stages=false   required by chunkah's splitter flow
 #    --prune /sysroot/            strips the embedded OSTree repo,
 #                                  turning this into a "plain" image
@@ -55,7 +56,3 @@ buildah tag "${FULL_IMAGE}:${VARIANT}" "${FULL_IMAGE}:${VARIANT}-${TIMESTAMP}"
 
 # Clean up the intermediate unchunked image.
 buildah rmi "${UNCHUNKED_TAG}" || true
-
-echo "Successfully built ${VARIANT} variant with tags:"
-echo "  - ${FULL_IMAGE}:${VARIANT}"
-echo "  - ${FULL_IMAGE}:${VARIANT}-${TIMESTAMP}"