diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md
index 588c4e4..0a18357 100644
--- a/.gemini/styleguide.md
+++ b/.gemini/styleguide.md
@@ -22,7 +22,7 @@
 ## CI
 - Workflows MUST include weekly cron trigger for base image security updates
 - Build caching is MANDATORY: `cache-from: type=gha` / `cache-to: type=gha,mode=max`
-- Never use `no-cache: true` in CI workflows
+- Set `no-cache` only on non-commit builds (`schedule`, `repository_dispatch`, `workflow_dispatch`); never on `push` or `pull_request` builds
 - Dual-push (Quay + GHCR) uses two separate jobs, not steps
 
 ## Versioning
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 53d9d06..730c75a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -51,6 +51,8 @@ jobs:
             RHSM_ORG_ID=/tmp/RHSM_ORG_ID
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          # Non-commit rebuilds exist to pick up errata; a cached dnf layer ships none.
+          no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}
 
       - name: Save image as tarball
         run: docker save ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest -o /tmp/image.tar