diff --git a/.github/workflows/docker_cache-cleaner.yml b/.github/workflows/docker_cache-cleaner.yml
new file mode 100644
index 00000000..cfeddee6
--- /dev/null
+++ b/.github/workflows/docker_cache-cleaner.yml
@@ -0,0 +1,25 @@
+name: ci-package-cleaner
+
+on:
+
+  workflow_dispatch: # manual option
+
+  schedule:
+    - cron: '15 22 * * 1' # every Monday 10.15pm UTC (~11.15am Tuesday NZT)
+
+jobs:
+
+  package-cleaner:
+    name: package-cleaner
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      packages: write
+    steps:
+
+      - uses: actions/delete-package-versions@v4
+        with: 
+          package-name: pi.alert
+          package-type: container
+          min-versions-to-keep: 0
+          delete-only-untagged-versions: true
\ No newline at end of file
diff --git a/.github/workflows/docker_dev.yml b/.github/workflows/docker_dev.yml
index 0da367d5..ef528343 100755
--- a/.github/workflows/docker_dev.yml
+++ b/.github/workflows/docker_dev.yml
@@ -14,6 +14,10 @@ on:
 jobs: 
   docker_dev:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
     if: contains(github.event.head_commit.message, 'PUSHPROD') != 'True'
     steps:
       - name: Checkout
@@ -62,3 +66,5 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=ghcr.io/jokob-sk/pi.alert:buildcache
+          cache-to: type=registry,ref=ghcr.io/jokob-sk/pi.alert:buildcache,mode=max
diff --git a/.github/workflows/docker_prod.yml b/.github/workflows/docker_prod.yml
index dcd9c9a3..1efba74d 100755
--- a/.github/workflows/docker_prod.yml
+++ b/.github/workflows/docker_prod.yml
@@ -17,6 +17,10 @@ on:
 jobs:
   docker:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -47,12 +51,6 @@ jobs:
             type=ref,event=pr
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
 
-
-
-
-
-
-          
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
@@ -68,3 +66,5 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=ghcr.io/jokob-sk/pi.alert:buildcache
+          cache-to: type=registry,ref=ghcr.io/jokob-sk/pi.alert:buildcache,mode=max
diff --git a/docker-compose.yml b/docker-compose.yml
index 709dbe90..38206115 100755
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,9 +2,13 @@ version: "3"
 services:
   pialert:
     privileged: true
-    build: .
+    build:
+      dockerfile: Dockerfile
+      context: .
+      cache_from:
+        - type=registry,ref=ghcr.io/jokob-sk/pi.alert:buildcache
     container_name: pialert
-    network_mode: "host"
+    network_mode: host
     restart: unless-stopped
     volumes:
       - ${APP_DATA_LOCATION}/pialert_dev/config:/home/pi/pialert/config