diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index fe49e80..9459d64 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -3,6 +3,7 @@ name: Build and Push Docker
 on:
   push:
     branches: ['main'] # Only run when code hits Main
+    paths-ignore: ['**.md']
 
 env:
   REGISTRY: ghcr.io
@@ -41,4 +42,6 @@ jobs:
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
\ No newline at end of file
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
\ No newline at end of file
diff --git a/.github/workflows/ghcr-cleanup.yml b/.github/workflows/ghcr-cleanup.yml
new file mode 100644
index 0000000..ae0e7ca
--- /dev/null
+++ b/.github/workflows/ghcr-cleanup.yml
@@ -0,0 +1,19 @@
+name: GHCR cleanup
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run: { description: "Preview only", type: boolean, default: true }
+permissions: { packages: write }
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          owner: Exploitacious
+          packages: ivantsov.tech
+          delete-untagged: true
+          keep-n-tagged: 10
+          exclude-tags: latest
+          dry-run: ${{ inputs.dry_run }}
+          token: ${{ secrets.GITHUB_TOKEN }}