diff --git a/.tangled/workflows/deploy-gcp-dev.yml b/.tangled/workflows/deploy-gcp-dev.yml
index 7f5f423af..72a805a2c 100644
--- a/.tangled/workflows/deploy-gcp-dev.yml
+++ b/.tangled/workflows/deploy-gcp-dev.yml
@@ -37,6 +37,9 @@ environment:
   BOBBIN_CACHE: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled/bobbin-cache:buildcache
   SVFE_CACHE: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled/svfe-cache:buildcache
   TF_VERSION: "=1.5.7"
+  # buildx passes this to the builds, and rewrite-timestamp clamps the files in the
+  # layers to it too, so rebuilding the same source gives the same digest
+  SOURCE_DATE_EPOCH: "0"
   VITE_OAUTH_CLIENT_ID: https://next.tangled.org/oauth-client-metadata.json
   VITE_OAUTH_REDIRECT_URI: https://next.tangled.org/oauth/callback
 
@@ -69,7 +72,7 @@ steps:
         --provenance=false \
         --cache-from "type=registry,ref=$BOBBIN_CACHE" \
         --cache-to "type=registry,ref=$BOBBIN_CACHE,mode=max" \
-        --push .
+        --output type=registry,rewrite-timestamp=true .
       echo "bobbin-next:$tag"
 
   - name: build and push svfe
@@ -92,7 +95,7 @@ steps:
         --provenance=false \
         --cache-from "type=registry,ref=$SVFE_CACHE" \
         --cache-to "type=registry,ref=$SVFE_CACHE,mode=max" \
-        --push web/
+        --output type=registry,rewrite-timestamp=true web/
       echo "svfe-next:$tag"
 
   # reuse the last deployed blueprint here.