diff --git a/.github/workflows/keycloakify-build.yml b/.github/workflows/keycloakify-build.yml
index 95aa56de1..a8f4f7cde 100644
--- a/.github/workflows/keycloakify-build.yml
+++ b/.github/workflows/keycloakify-build.yml
@@ -2,14 +2,11 @@ name: keycloakify-build
 
 on:
   push:
+  workflow_dispatch:
 
 env:
   DOCKER_IMAGE_NAME: ghcr.io/loculus-project/keycloakify
 
-defaults:
-  run:
-    working-directory: ./keykloak/keycloakify
-
 concurrency:
   group: ci-${{ github.ref }}-keycloak
   cancel-in-progress: true
@@ -24,24 +21,36 @@ jobs:
       checks: read
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Docker metadata
+      - name: Generate files hash
+        id: files-hash
+        run: |
+          DIR_HASH=$(echo -n ${{ hashFiles('./keycloak/keycloakify/**','.github/workflows/keycloakify-build.yml') }})
+          echo "DIR_HASH=$DIR_HASH" >> $GITHUB_ENV
+      - name: Setup Docker metadata
         id: dockerMetadata
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.DOCKER_IMAGE_NAME }}
           tags: |
-            type=ref,event=branch
+            type=raw,value=${{ env.DIR_HASH }}
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=ref,event=branch
             type=sha,prefix=commit-
+      - name: Check if image exists
+        id: check-image
+        run: |
+          EXISTS=$(docker manifest inspect ${{ env.DOCKER_IMAGE_NAME }}:${{ env.DIR_HASH }} > /dev/null 2>&1 && echo "true" || echo "false")
+          echo "CACHE_HIT=$EXISTS" >> $GITHUB_ENV
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: Build and push image
+        if: env.CACHE_HIT == 'false'
         uses: docker/build-push-action@v5
         with:
           context: ./keycloak/keycloakify
@@ -49,3 +58,10 @@ jobs:
           tags: ${{ steps.dockerMetadata.outputs.tags }}
           cache-from: type=gha,scope=keycloakify=${{ github.ref }}
           cache-to: type=gha,mode=max,scope=keycloakify=${{ github.ref }}
+      - name: Tag and push image if cache hit
+        if: env.CACHE_HIT == 'true'
+        run: |
+          TAGS=(${{ steps.dockerMetadata.outputs.tags }})
+          for TAG in "${TAGS[@]}"; do
+            docker buildx imagetools create --tag $TAG ${{ env.DOCKER_IMAGE_NAME }}:${{ env.DIR_HASH }}
+          done