diff --git a/.github/workflows/on_call_build_site.yaml b/.github/workflows/on_call_build_site.yaml
index 4e9cf3b8..4cd011a9 100644
--- a/.github/workflows/on_call_build_site.yaml
+++ b/.github/workflows/on_call_build_site.yaml
@@ -1,6 +1,11 @@
 ---
 on:
   workflow_call:
+    inputs:
+      push_tag:
+        description: 'Tag to push the base image with (optional)'
+        required: false
+        type: string
 
 jobs:
   build_site:
@@ -24,6 +29,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
+      - name: Build base image
+        run: |
+          docker build --target base -t ghcr.io/orionrobots/orionrobots-site.base:${{ inputs.push_tag || 'temp' }} .
+
       - name: Build the site with docker compose
         run: |
           docker compose -f docker-compose.yml -f docker-compose.ci.yml run --build build
@@ -45,3 +54,8 @@ jobs:
           name: httpd.conf
           path: .github/scripts/staging/httpd.conf
           if-no-files-found: error
+
+      - name: Push base image
+        if: inputs.push_tag
+        run: |
+          docker push ghcr.io/orionrobots/orionrobots-site.base:${{ inputs.push_tag }}
diff --git a/.github/workflows/on_pr_test.yaml b/.github/workflows/on_pr_test.yaml
index 3cb2192a..d548fe70 100644
--- a/.github/workflows/on_pr_test.yaml
+++ b/.github/workflows/on_pr_test.yaml
@@ -31,8 +31,32 @@ on:
       - 'docker-compose.yml'
 
 jobs:
+  detect_base_image_changes:
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.changes.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for base image related changes
+        # tj-actions/changed-files v44.5.7
+        uses: tj-actions/changed-files@c65cd883420fd2eb864698a825fc4162dd94482c
+        id: changes
+        with:
+          files: |
+            Dockerfile
+            package.json
+            package-lock.json
+            .github/workflows/on_call_build_site.yaml
+            .github/workflows/on_pr_test.yaml
+
   build_site:
+    needs: detect_base_image_changes
     uses: ./.github/workflows/on_call_build_site.yaml
+    with:
+      push_tag: >-
+        ${{ needs.detect_base_image_changes.outputs.changed == 'true'
+            && github.event.number || '' }}
 
   staging_test:
     uses: ./.github/workflows/on_call_staging_test.yaml
diff --git a/.github/workflows/on_push_to_master_test_and_deploy.yaml b/.github/workflows/on_push_to_master_test_and_deploy.yaml
index 4e405554..85976737 100644
--- a/.github/workflows/on_push_to_master_test_and_deploy.yaml
+++ b/.github/workflows/on_push_to_master_test_and_deploy.yaml
@@ -36,6 +36,8 @@ concurrency:
 jobs:
   build_site:
     uses: ./.github/workflows/on_call_build_site.yaml
+    with:
+      push_tag: "latest"
 
   staging_test:
     uses: ./.github/workflows/on_call_staging_test.yaml
@@ -85,12 +87,13 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - name: Check for workflow changes
+        # tj-actions/changed-files v44.5.7
+        uses: tj-actions/changed-files@c65cd883420fd2eb864698a825fc4162dd94482c
         id: filter
         with:
-          filters: |
-            workflows:
-              - '.github/workflows/**'
+          files: |
+            .github/workflows/**
 
       # see https://github.com/mcdeck/netlify-cms-oauth-provider-php
       - name: Checkout the netlify-cms-oauth-provider-php
@@ -100,13 +103,13 @@ jobs:
           path: netlify-cms-oauth-provider-php
 
       - name: Perform the netlify composer install
-        if: steps.filter.outputs.workflows == 'true'
+        if: steps.filter.outputs.any_changed == 'true'
         run: |
           cd netlify-cms-oauth-provider-php
           composer install
 
       - name: Copy over the netlify-cms-oauth-provider-php files
-        if: steps.filter.outputs.workflows == 'true'
+        if: steps.filter.outputs.any_changed == 'true'
         uses: burnett01/rsync-deployments@3cccb6851148e6198ed9ed89eb0d1c17b5e58cc7 # v7.0.2
         with:
           switches: -a
@@ -117,7 +120,7 @@ jobs:
           remote_key: ${{ secrets.ORIONROBOTS_DEPLOY_KEY }}
 
       - name: Create the oauth environment file
-        if: steps.filter.outputs.workflows == 'true'
+        if: steps.filter.outputs.any_changed == 'true'
         run: |
           (
             echo "OAUTH_CLIENT_ID=${{ secrets.ORIONROBOTS_OAUTH_CLIENT_ID }}"
@@ -128,7 +131,7 @@ jobs:
           ) > netlify-cms-oauth-provider-php/.env.local
 
       - name: Copy over the oauth environment file
-        if: steps.filter.outputs.workflows == 'true'
+        if: steps.filter.outputs.any_changed == 'true'
         uses: burnett01/rsync-deployments@3cccb6851148e6198ed9ed89eb0d1c17b5e58cc7 # v7.0.2
         with:
           switches: -a