diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index b2d754465..3371cb5a3 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -206,7 +206,7 @@ jobs:
           cache-from: |
             type=registry,ref=${{ steps.login.outputs.registry }}/cache/${{ matrix.name.artifact }}:main
           cache-to: |
-            type=registry,ref=${{ steps.login.outputs.registry }}/cache/${{ matrix.name.artifact }}:main
+            type=registry,ref=${{ steps.login.outputs.registry }}/cache/${{ matrix.name.artifact }}:main,mode=max
           target: release
           outputs: type=image,name=${{ steps.login.outputs.registry }}/firezone/${{ matrix.name.artifact}},push-by-digest=true,name-canonical=true,push=true
       - name: Export digest
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 719223d6a..98730c78c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           # This will write the cache on main even if integration tests fail,
           # but it'll just be corrected on the next successful build.
           cache-to: |
-            type=registry,ref=${{steps.login.outputs.registry}}/cache/${{ matrix.image_name}}:${{ env.CACHE_TAG }}
+            type=registry,ref=${{steps.login.outputs.registry}}/cache/${{ matrix.image_name}}:${{ env.CACHE_TAG }},mode=max
           file: ${{ matrix.context }}/Dockerfile
           push: true
           target: ${{ matrix.target }}