diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 7e44e722..ca0bb160 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -68,21 +68,30 @@ jobs:
           echo "services=$SERVICES" >> "$GITHUB_OUTPUT"
           echo "Building services: $SERVICES"
 
-  build-and-push:
-    runs-on: ubuntu-latest
+  # One job per service × platform. arm64 runs on a native arm runner instead of
+  # QEMU emulation on x86 (7× slower). Each job pushes its single-arch image by
+  # digest; `merge` below stitches the digests into one multi-arch manifest.
+  build:
+    runs-on: ${{ matrix.runner }}
     needs: [prepare]
     if: needs.prepare.outputs.services != '[]'
     timeout-minutes: 30
     permissions:
       contents: read
-      id-token: write
       packages: write
 
     strategy:
       fail-fast: false
       matrix:
         service: ${{ fromJson(needs.prepare.outputs.services) }}
+        platform: [linux/amd64, linux/arm64]
         include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-24.04-arm
           - service: server
             context: .
             dockerfile: apps/server/Dockerfile
@@ -110,7 +119,9 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Lowercase owner
-        run: echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV
+        run: |
+          echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV
+          echo "IMAGE=${{ env.REGISTRY }}/${GITHUB_REPOSITORY_OWNER,,}/${{ env.IMAGE_NAME }}-${{ matrix.service }}" >> $GITHUB_ENV
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -126,31 +137,113 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.OWNER_LC }}/${{ env.IMAGE_NAME }}-${{ matrix.service }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=sha,prefix=
-            type=raw,value=latest,enable={{is_default_branch}}
+          images: ${{ env.IMAGE }}
 
-      - name: Build and push Docker image
+      # Layer cache lives in the registry (one ref per service × arch) rather than
+      # the 10 GB GitHub Actions cache, which the multi-GB builder layers of the
+      # Next.js apps kept evicting. Blobs already in the registry are not re-uploaded.
+      - name: Build and push Docker image (by digest)
         id: build
         uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ matrix.arch }}
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ matrix.arch }},mode=max,image-manifest=true,oci-mediatypes=true
           provenance: false
 
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.service }}-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  # Combine the per-arch digests into a multi-arch manifest list carrying the
+  # real tags, then generate the SBOM from that manifest.
+  # Runs even if some `build` legs failed so one broken service does not block
+  # publishing the others; a service missing a digest fails its own merge below.
+  merge:
+    runs-on: ubuntu-latest
+    needs: [prepare, build]
+    if: ${{ !cancelled() && needs.prepare.outputs.services != '[]' }}
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        service: ${{ fromJson(needs.prepare.outputs.services) }}
+
+    steps:
+      - name: Lowercase owner
+        run: |
+          echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV
+          echo "IMAGE=${{ env.REGISTRY }}/${GITHUB_REPOSITORY_OWNER,,}/${{ env.IMAGE_NAME }}-${{ matrix.service }}" >> $GITHUB_ENV
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-${{ matrix.service }}-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Create manifest list and push
+        id: manifest
+        working-directory: /tmp/digests
+        run: |
+          # Never publish a partial (single-arch) manifest under the real tags.
+          count=$(ls | wc -l)
+          if [ "$count" -ne 2 ]; then
+            echo "::error::expected 2 digests (amd64 + arm64) for ${{ matrix.service }}, found $count"
+            ls -la
+            exit 1
+          fi
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+          digest=$(docker buildx imagetools inspect "${{ env.IMAGE }}:${{ steps.meta.outputs.version }}" --format '{{json .Manifest.Digest}}' | tr -d '"')
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+          docker buildx imagetools inspect "${{ env.IMAGE }}@${digest}"
+
       - name: Generate SBOM
         uses: anchore/sbom-action@v0
         with:
-          image: ${{ env.REGISTRY }}/${{ env.OWNER_LC }}/${{ env.IMAGE_NAME }}-${{ matrix.service }}@${{ steps.build.outputs.digest }}
+          image: ${{ env.IMAGE }}@${{ steps.manifest.outputs.digest }}
           format: spdx-json
           output-file: sbom-${{ matrix.service }}.spdx.json
 
diff --git a/apps/dashboard/Dockerfile b/apps/dashboard/Dockerfile
index d6a3b8ee..ce4faba7 100644
--- a/apps/dashboard/Dockerfile
+++ b/apps/dashboard/Dockerfile
@@ -2,41 +2,85 @@
 # This file is generated by Dofigen v2.8.0
 # See https://github.com/lenra-io/dofigen
 
+# manifests
+FROM node@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS manifests
+LABEL \
+    org.opencontainers.image.base.digest="sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6" \
+    org.opencontainers.image.base.name="docker.io/node:24-slim"
+WORKDIR /app
+COPY \
+    --link \
+    "." "/app/"
+RUN <<EOF
+mkdir -p /out
+cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+EOF
+
+# install
+FROM node@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS install
+LABEL \
+    org.opencontainers.image.base.digest="sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6" \
+    org.opencontainers.image.base.name="docker.io/node:24-slim"
+ENV \
+    PATH="$PNPM_HOME:$PATH" \
+    PNPM_HOME="/pnpm"
+WORKDIR /app
+COPY \
+    --from=manifests \
+    --link \
+    "/out/" "/app/"
+RUN <<EOF
+corepack enable pnpm
+pnpm install --frozen-lockfile --filter=@openstatus/dashboard...
+EOF
+
 # builder
 FROM node@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS builder
 LABEL \
     org.opencontainers.image.base.digest="sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6" \
     org.opencontainers.image.base.name="docker.io/node:24-slim"
 ENV \
+    NEXT_PUBLIC_URL="http://localhost:3002" \
+    PROJECT_ID_VERCEL="test" \
+    AUTH_SECRET="build-time-placeholder-min-32-chars-long" \
     NEXT_PUBLIC_OPENPANEL_CLIENT_ID="test" \
     DATABASE_URL="http://libsql:8080" \
-    PROJECT_ID_VERCEL="test" \
     PNPM_HOME="/pnpm" \
-    STRIPE_SECRET_KEY="test" \
-    UPSTASH_REDIS_REST_TOKEN="test" \
-    OPENPANEL_CLIENT_SECRET="test" \
     PATH="$PNPM_HOME:$PATH" \
-    TEAM_ID_VERCEL="test" \
+    UNKEY_API_ID="test" \
+    OPENPANEL_CLIENT_SECRET="test" \
+    SELF_HOST="true" \
     UPSTASH_REDIS_REST_URL="https://test.upstash.io" \
+    RESEND_API_KEY="test" \
+    DATABASE_AUTH_TOKEN="test" \
     VERCEL_AUTH_BEARER_TOKEN="test" \
+    STRIPE_SECRET_KEY="test" \
     TINY_BIRD_API_KEY="test" \
+    NODE_ENV="production" \
     CRON_SECRET="test" \
-    AUTH_SECRET="build-time-placeholder-min-32-chars-long" \
-    NEXT_PUBLIC_URL="http://localhost:3002" \
-    UNKEY_TOKEN="test" \
-    UNKEY_API_ID="test" \
+    TEAM_ID_VERCEL="test" \
     NEXT_PUBLIC_SELF_HOST="true" \
-    RESEND_API_KEY="test" \
-    SELF_HOST="true" \
-    NODE_ENV="production" \
-    DATABASE_AUTH_TOKEN="test"
+    UPSTASH_REDIS_REST_TOKEN="test" \
+    UNKEY_TOKEN="test"
 WORKDIR /app
 COPY \
     --link \
     "." "/app/"
+COPY \
+    --from=install \
+    --link \
+    "/app/node_modules" "/app/node_modules"
+COPY \
+    --from=install \
+    --link \
+    "/app/apps/dashboard/node_modules" "/app/apps/dashboard/node_modules"
+COPY \
+    --from=install \
+    --link \
+    "/app/packages" "/app/packages"
 RUN <<EOF
-corepack enable
-pnpm install --frozen-lockfile
+corepack enable pnpm
 pnpm turbo run build --filter=@openstatus/dashboard
 EOF
 
diff --git a/apps/dashboard/dofigen.lock b/apps/dashboard/dofigen.lock
index e5c7d2c5..a724551b 100644
--- a/apps/dashboard/dofigen.lock
+++ b/apps/dashboard/dofigen.lock
@@ -1,5 +1,24 @@
 effective: |
   builders:
+    install:
+      fromImage:
+        path: node
+        digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+      label:
+        org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+        org.opencontainers.image.base.name: docker.io/node:24-slim
+      workdir: /app
+      env:
+        PATH: $PNPM_HOME:$PATH
+        PNPM_HOME: /pnpm
+      copy:
+      - fromBuilder: manifests
+        paths:
+        - /out/
+        target: /app/
+      run:
+      - corepack enable pnpm
+      - pnpm install --frozen-lockfile --filter=@openstatus/dashboard...
     builder:
       fromImage:
         path: node
@@ -9,43 +28,70 @@ effective: |
         org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
       workdir: /app
       env:
+        NEXT_PUBLIC_URL: http://localhost:3002
+        PROJECT_ID_VERCEL: test
+        AUTH_SECRET: build-time-placeholder-min-32-chars-long
         NEXT_PUBLIC_OPENPANEL_CLIENT_ID: test
         DATABASE_URL: http://libsql:8080
-        PROJECT_ID_VERCEL: test
         PNPM_HOME: /pnpm
-        STRIPE_SECRET_KEY: test
-        UPSTASH_REDIS_REST_TOKEN: test
-        OPENPANEL_CLIENT_SECRET: test
         PATH: $PNPM_HOME:$PATH
-        TEAM_ID_VERCEL: test
+        UNKEY_API_ID: test
+        OPENPANEL_CLIENT_SECRET: test
+        SELF_HOST: 'true'
         UPSTASH_REDIS_REST_URL: https://test.upstash.io
+        RESEND_API_KEY: test
+        DATABASE_AUTH_TOKEN: test
         VERCEL_AUTH_BEARER_TOKEN: test
+        STRIPE_SECRET_KEY: test
         TINY_BIRD_API_KEY: test
+        NODE_ENV: production
         CRON_SECRET: test
-        AUTH_SECRET: build-time-placeholder-min-32-chars-long
-        NEXT_PUBLIC_URL: http://localhost:3002
-        UNKEY_TOKEN: test
-        UNKEY_API_ID: test
+        TEAM_ID_VERCEL: test
         NEXT_PUBLIC_SELF_HOST: 'true'
-        RESEND_API_KEY: test
-        SELF_HOST: 'true'
-        NODE_ENV: production
-        DATABASE_AUTH_TOKEN: test
+        UPSTASH_REDIS_REST_TOKEN: test
+        UNKEY_TOKEN: test
       copy:
       - paths:
         - .
         target: /app/
+      - fromBuilder: install
+        paths:
+        - /app/node_modules
+        target: /app/node_modules
+      - fromBuilder: install
+        paths:
+        - /app/apps/dashboard/node_modules
+        target: /app/apps/dashboard/node_modules
+      - fromBuilder: install
+        paths:
+        - /app/packages
+        target: /app/packages
       run:
-      - corepack enable
-      - pnpm install --frozen-lockfile
+      - corepack enable pnpm
       - pnpm turbo run build --filter=@openstatus/dashboard
+    manifests:
+      fromImage:
+        path: node
+        digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+      label:
+        org.opencontainers.image.base.name: docker.io/node:24-slim
+        org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+      workdir: /app
+      copy:
+      - paths:
+        - .
+        target: /app/
+      run:
+      - mkdir -p /out
+      - cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+      - find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
   fromImage:
     path: node
     digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
   label:
     org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
-    io.dofigen.version: 2.8.0
     org.opencontainers.image.base.name: docker.io/node:24-slim
+    io.dofigen.version: 2.8.0
   user:
     user: '1000'
     group: '1000'
@@ -92,15 +138,53 @@ images:
           digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
 resources:
   dofigen.yml:
-    hash: 490d7f522af488e1a8fe6fc01a8f34652a21b17970dac5d7772e7351faab22f2
+    hash: faa334a75307a18788b8e2818ac6b7fd9f43ad79700e0c0b30162771f67f334b
     content: |
       builders:
-        # Stage 1: Next.js build with Node.js
+        # Stage 1: collect every workspace manifest (package.json) into a tree that only
+        # changes when a manifest changes. The install stage copies from here, so its
+        # layer cache key depends on manifests + lockfile alone, not on source edits.
+        manifests:
+          fromImage: node:24-slim
+          workdir: /app
+          copy:
+            - . /app/
+          run:
+            - mkdir -p /out
+            - cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+            - find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+
+        # Stage 2: install the dashboard dependency subgraph (dev deps included — next build needs them).
+        # Cached across builds as long as no package.json / pnpm-lock.yaml changed.
+        install:
+          fromImage: node:24-slim
+          workdir: /app
+          env:
+            PNPM_HOME: /pnpm
+            PATH: $PNPM_HOME:$PATH
+          copy:
+            - fromBuilder: manifests
+              source: /out/
+              target: /app/
+          run:
+            - corepack enable pnpm
+            - pnpm install --frozen-lockfile --filter=@openstatus/dashboard...
+
+        # Stage 3: Next.js build with Node.js
         builder:
           fromImage: node:24-slim
           workdir: /app
           copy:
             - . /app/
+            - fromBuilder: install
+              source: /app/node_modules
+              target: /app/node_modules
+            - fromBuilder: install
+              source: /app/apps/dashboard/node_modules
+              target: /app/apps/dashboard/node_modules
+            - fromBuilder: install
+              source: /app/packages
+              target: /app/packages
           env:
             NODE_ENV: production
             PNPM_HOME: /pnpm
@@ -126,8 +210,7 @@ resources:
             SELF_HOST: "true"
             NEXT_PUBLIC_SELF_HOST: "true"
           run:
-            - corepack enable
-            - pnpm install --frozen-lockfile
+            - corepack enable pnpm
             - pnpm turbo run build --filter=@openstatus/dashboard
 
       # Runtime stage
diff --git a/apps/dashboard/dofigen.yml b/apps/dashboard/dofigen.yml
index e2c1bad4..90108e84 100644
--- a/apps/dashboard/dofigen.yml
+++ b/apps/dashboard/dofigen.yml
@@ -1,10 +1,48 @@
 builders:
-  # Stage 1: Next.js build with Node.js
+  # Stage 1: collect every workspace manifest (package.json) into a tree that only
+  # changes when a manifest changes. The install stage copies from here, so its
+  # layer cache key depends on manifests + lockfile alone, not on source edits.
+  manifests:
+    fromImage: node:24-slim
+    workdir: /app
+    copy:
+      - . /app/
+    run:
+      - mkdir -p /out
+      - cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+      - find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+
+  # Stage 2: install the dashboard dependency subgraph (dev deps included — next build needs them).
+  # Cached across builds as long as no package.json / pnpm-lock.yaml changed.
+  install:
+    fromImage: node:24-slim
+    workdir: /app
+    env:
+      PNPM_HOME: /pnpm
+      PATH: $PNPM_HOME:$PATH
+    copy:
+      - fromBuilder: manifests
+        source: /out/
+        target: /app/
+    run:
+      - corepack enable pnpm
+      - pnpm install --frozen-lockfile --filter=@openstatus/dashboard...
+
+  # Stage 3: Next.js build with Node.js
   builder:
     fromImage: node:24-slim
     workdir: /app
     copy:
       - . /app/
+      - fromBuilder: install
+        source: /app/node_modules
+        target: /app/node_modules
+      - fromBuilder: install
+        source: /app/apps/dashboard/node_modules
+        target: /app/apps/dashboard/node_modules
+      - fromBuilder: install
+        source: /app/packages
+        target: /app/packages
     env:
       NODE_ENV: production
       PNPM_HOME: /pnpm
@@ -30,8 +68,7 @@ builders:
       SELF_HOST: "true"
       NEXT_PUBLIC_SELF_HOST: "true"
     run:
-      - corepack enable
-      - pnpm install --frozen-lockfile
+      - corepack enable pnpm
       - pnpm turbo run build --filter=@openstatus/dashboard
 
 # Runtime stage
diff --git a/apps/status-page/Dockerfile b/apps/status-page/Dockerfile
index b709da9d..ec9dfefc 100644
--- a/apps/status-page/Dockerfile
+++ b/apps/status-page/Dockerfile
@@ -2,39 +2,83 @@
 # This file is generated by Dofigen v2.8.0
 # See https://github.com/lenra-io/dofigen
 
+# manifests
+FROM node@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS manifests
+LABEL \
+    org.opencontainers.image.base.digest="sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6" \
+    org.opencontainers.image.base.name="docker.io/node:24-slim"
+WORKDIR /app
+COPY \
+    --link \
+    "." "/app/"
+RUN <<EOF
+mkdir -p /out
+cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+EOF
+
+# install
+FROM node@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS install
+LABEL \
+    org.opencontainers.image.base.digest="sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6" \
+    org.opencontainers.image.base.name="docker.io/node:24-slim"
+ENV \
+    PNPM_HOME="/pnpm" \
+    PATH="$PNPM_HOME:$PATH"
+WORKDIR /app
+COPY \
+    --from=manifests \
+    --link \
+    "/out/" "/app/"
+RUN <<EOF
+corepack enable pnpm
+pnpm install --frozen-lockfile --filter=@openstatus/status-page...
+EOF
+
 # builder
 FROM node@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS builder
 LABEL \
     org.opencontainers.image.base.digest="sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6" \
     org.opencontainers.image.base.name="docker.io/node:24-slim"
 ENV \
-    TEAM_ID_VERCEL="test" \
+    UNKEY_TOKEN="test" \
+    SELF_HOST="true" \
     NEXT_PUBLIC_URL="http://localhost:3002" \
-    PNPM_HOME="/pnpm" \
+    UNKEY_API_ID="test" \
+    CRON_SECRET="test" \
+    PATH="$PNPM_HOME:$PATH" \
     NEXT_PUBLIC_OPENPANEL_CLIENT_ID="test" \
-    TINY_BIRD_API_KEY="test" \
     STRIPE_SECRET_KEY="test" \
-    DATABASE_AUTH_TOKEN="test" \
-    UPSTASH_REDIS_REST_URL="https://test.upstash.io" \
-    UNKEY_TOKEN="test" \
+    TEAM_ID_VERCEL="test" \
+    PNPM_HOME="/pnpm" \
     OPENPANEL_CLIENT_SECRET="test" \
-    UNKEY_API_ID="test" \
+    VERCEL_AUTH_BEARER_TOKEN="test" \
+    UPSTASH_REDIS_REST_URL="https://test.upstash.io" \
     RESEND_API_KEY="test" \
-    NODE_ENV="production" \
-    PROJECT_ID_VERCEL="test" \
     UPSTASH_REDIS_REST_TOKEN="test" \
+    DATABASE_AUTH_TOKEN="test" \
+    TINY_BIRD_API_KEY="test" \
     DATABASE_URL="http://libsql:8080" \
-    VERCEL_AUTH_BEARER_TOKEN="test" \
-    CRON_SECRET="test" \
-    PATH="$PNPM_HOME:$PATH" \
-    SELF_HOST="true"
+    PROJECT_ID_VERCEL="test" \
+    NODE_ENV="production"
 WORKDIR /app
 COPY \
     --link \
     "." "/app/"
+COPY \
+    --from=install \
+    --link \
+    "/app/node_modules" "/app/node_modules"
+COPY \
+    --from=install \
+    --link \
+    "/app/apps/status-page/node_modules" "/app/apps/status-page/node_modules"
+COPY \
+    --from=install \
+    --link \
+    "/app/packages" "/app/packages"
 RUN <<EOF
-corepack enable
-pnpm install --frozen-lockfile
+corepack enable pnpm
 pnpm turbo run build --filter=@openstatus/status-page
 EOF
 
diff --git a/apps/status-page/dofigen.lock b/apps/status-page/dofigen.lock
index 3b32d909..be0acb80 100644
--- a/apps/status-page/dofigen.lock
+++ b/apps/status-page/dofigen.lock
@@ -1,48 +1,94 @@
 effective: |
   builders:
-    builder:
+    install:
       fromImage:
         path: node
         digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
       label:
+        org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
         org.opencontainers.image.base.name: docker.io/node:24-slim
+      workdir: /app
+      env:
+        PNPM_HOME: /pnpm
+        PATH: $PNPM_HOME:$PATH
+      copy:
+      - fromBuilder: manifests
+        paths:
+        - /out/
+        target: /app/
+      run:
+      - corepack enable pnpm
+      - pnpm install --frozen-lockfile --filter=@openstatus/status-page...
+    manifests:
+      fromImage:
+        path: node
+        digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+      label:
         org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+        org.opencontainers.image.base.name: docker.io/node:24-slim
+      workdir: /app
+      copy:
+      - paths:
+        - .
+        target: /app/
+      run:
+      - mkdir -p /out
+      - cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+      - find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+    builder:
+      fromImage:
+        path: node
+        digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+      label:
+        org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
+        org.opencontainers.image.base.name: docker.io/node:24-slim
       workdir: /app
       env:
-        TEAM_ID_VERCEL: test
+        UNKEY_TOKEN: test
+        SELF_HOST: 'true'
         NEXT_PUBLIC_URL: http://localhost:3002
-        PNPM_HOME: /pnpm
+        UNKEY_API_ID: test
+        CRON_SECRET: test
+        PATH: $PNPM_HOME:$PATH
         NEXT_PUBLIC_OPENPANEL_CLIENT_ID: test
-        TINY_BIRD_API_KEY: test
         STRIPE_SECRET_KEY: test
-        DATABASE_AUTH_TOKEN: test
-        UPSTASH_REDIS_REST_URL: https://test.upstash.io
-        UNKEY_TOKEN: test
+        TEAM_ID_VERCEL: test
+        PNPM_HOME: /pnpm
         OPENPANEL_CLIENT_SECRET: test
-        UNKEY_API_ID: test
+        VERCEL_AUTH_BEARER_TOKEN: test
+        UPSTASH_REDIS_REST_URL: https://test.upstash.io
         RESEND_API_KEY: test
-        NODE_ENV: production
-        PROJECT_ID_VERCEL: test
         UPSTASH_REDIS_REST_TOKEN: test
+        DATABASE_AUTH_TOKEN: test
+        TINY_BIRD_API_KEY: test
         DATABASE_URL: http://libsql:8080
-        VERCEL_AUTH_BEARER_TOKEN: test
-        CRON_SECRET: test
-        PATH: $PNPM_HOME:$PATH
-        SELF_HOST: 'true'
+        PROJECT_ID_VERCEL: test
+        NODE_ENV: production
       copy:
       - paths:
         - .
         target: /app/
+      - fromBuilder: install
+        paths:
+        - /app/node_modules
+        target: /app/node_modules
+      - fromBuilder: install
+        paths:
+        - /app/apps/status-page/node_modules
+        target: /app/apps/status-page/node_modules
+      - fromBuilder: install
+        paths:
+        - /app/packages
+        target: /app/packages
       run:
-      - corepack enable
-      - pnpm install --frozen-lockfile
+      - corepack enable pnpm
       - pnpm turbo run build --filter=@openstatus/status-page
   fromImage:
     path: node
     digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
   label:
-    org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
     org.opencontainers.image.base.name: docker.io/node:24-slim
+    org.opencontainers.image.base.digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
     io.dofigen.version: 2.8.0
   user:
     user: '1000'
@@ -90,15 +136,53 @@ images:
           digest: sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
 resources:
   dofigen.yml:
-    hash: 5701000c9b3f4bcf44726a6ebd3c5b6af381d97433aaf166d084a11435a372b7
+    hash: b437fe8dee3c2f2316613dddbd208efea26ed2981038fa3f94a92b5b11b7e63a
     content: |
       builders:
-        # Stage 1: Next.js build with Node.js
+        # Stage 1: collect every workspace manifest (package.json) into a tree that only
+        # changes when a manifest changes. The install stage copies from here, so its
+        # layer cache key depends on manifests + lockfile alone, not on source edits.
+        manifests:
+          fromImage: node:24-slim
+          workdir: /app
+          copy:
+            - . /app/
+          run:
+            - mkdir -p /out
+            - cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+            - find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+
+        # Stage 2: install the status-page dependency subgraph (dev deps included — next build needs them).
+        # Cached across builds as long as no package.json / pnpm-lock.yaml changed.
+        install:
+          fromImage: node:24-slim
+          workdir: /app
+          env:
+            PNPM_HOME: /pnpm
+            PATH: $PNPM_HOME:$PATH
+          copy:
+            - fromBuilder: manifests
+              source: /out/
+              target: /app/
+          run:
+            - corepack enable pnpm
+            - pnpm install --frozen-lockfile --filter=@openstatus/status-page...
+
+        # Stage 3: Next.js build with Node.js
         builder:
           fromImage: node:24-slim
           workdir: /app
           copy:
             - . /app/
+            - fromBuilder: install
+              source: /app/node_modules
+              target: /app/node_modules
+            - fromBuilder: install
+              source: /app/apps/status-page/node_modules
+              target: /app/apps/status-page/node_modules
+            - fromBuilder: install
+              source: /app/packages
+              target: /app/packages
           env:
             NODE_ENV: production
             PNPM_HOME: /pnpm
@@ -123,8 +207,7 @@ resources:
             SELF_HOST: "true"
 
           run:
-            - corepack enable
-            - pnpm install --frozen-lockfile
+            - corepack enable pnpm
             - pnpm turbo run build --filter=@openstatus/status-page
 
       # Runtime stage
diff --git a/apps/status-page/dofigen.yml b/apps/status-page/dofigen.yml
index 7e22651b..64df38b7 100644
--- a/apps/status-page/dofigen.yml
+++ b/apps/status-page/dofigen.yml
@@ -1,10 +1,48 @@
 builders:
-  # Stage 1: Next.js build with Node.js
+  # Stage 1: collect every workspace manifest (package.json) into a tree that only
+  # changes when a manifest changes. The install stage copies from here, so its
+  # layer cache key depends on manifests + lockfile alone, not on source edits.
+  manifests:
+    fromImage: node:24-slim
+    workdir: /app
+    copy:
+      - . /app/
+    run:
+      - mkdir -p /out
+      - cp pnpm-workspace.yaml pnpm-lock.yaml package.json /out/
+      - find apps packages -name package.json -not -path '*/node_modules/*' -exec cp --parents {} /out/ \;
+
+  # Stage 2: install the status-page dependency subgraph (dev deps included — next build needs them).
+  # Cached across builds as long as no package.json / pnpm-lock.yaml changed.
+  install:
+    fromImage: node:24-slim
+    workdir: /app
+    env:
+      PNPM_HOME: /pnpm
+      PATH: $PNPM_HOME:$PATH
+    copy:
+      - fromBuilder: manifests
+        source: /out/
+        target: /app/
+    run:
+      - corepack enable pnpm
+      - pnpm install --frozen-lockfile --filter=@openstatus/status-page...
+
+  # Stage 3: Next.js build with Node.js
   builder:
     fromImage: node:24-slim
     workdir: /app
     copy:
       - . /app/
+      - fromBuilder: install
+        source: /app/node_modules
+        target: /app/node_modules
+      - fromBuilder: install
+        source: /app/apps/status-page/node_modules
+        target: /app/apps/status-page/node_modules
+      - fromBuilder: install
+        source: /app/packages
+        target: /app/packages
     env:
       NODE_ENV: production
       PNPM_HOME: /pnpm
@@ -29,8 +67,7 @@ builders:
       SELF_HOST: "true"
 
     run:
-      - corepack enable
-      - pnpm install --frozen-lockfile
+      - corepack enable pnpm
       - pnpm turbo run build --filter=@openstatus/status-page
 
 # Runtime stage