diff --git a/.github/workflows/docker-build-publish-demo.yml b/.github/workflows/docker-build-publish-demo.yml
index 29c38334af..d4093d95b1 100644
--- a/.github/workflows/docker-build-publish-demo.yml
+++ b/.github/workflows/docker-build-publish-demo.yml
@@ -23,8 +23,15 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+
+      # Log in to GHCR BEFORE the build so buildx can PUSH the mode=max layer cache to the
+      # :buildcache tag (cache-to needs registry auth at build time).
+      - name: Login to GitHub Container Registry (build cache)
+        uses: docker/login-action@v4
         with:
-          driver: docker
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build
         uses: docker/build-push-action@v7
@@ -38,8 +45,14 @@ jobs:
             everco/gauzy-api-demo:latest
             registry.digitalocean.com/ever/gauzy-api-demo:latest
             ${{ secrets.CW_DOCKER_REGISTRY }}/ever-co/gauzy-api-demo:latest
-          cache-from: type=registry,ref=ghcr.io/ever-co/gauzy-api-demo:latest
-          cache-to: type=inline
+          # mode=max caches ALL stages (incl. the multi-minute yarn-install layers) to a dedicated
+          # :buildcache tag; every ephemeral runner restores it → no more fully-cold rebuilds.
+          # Needs the default docker-container buildx driver — the classic `docker` driver only
+          # supports inline (final-stage) cache, which is why the yarn-install stages were cold.
+          cache-from: |
+            type=registry,ref=ghcr.io/ever-co/gauzy-api-demo:buildcache
+            type=registry,ref=ghcr.io/ever-co/gauzy-api-demo:latest
+          cache-to: type=registry,ref=ghcr.io/ever-co/gauzy-api-demo:buildcache,mode=max
           build-args: |
             NODE_ENV=development
             DEMO=true
@@ -111,6 +124,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      # Log in to GHCR BEFORE the build so buildx can PUSH the mode=max layer cache to the
+      # :buildcache tag (cache-to needs registry auth at build time).
+      - name: Login to GitHub Container Registry (build cache)
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build
         uses: docker/build-push-action@v7
         with:
@@ -123,8 +145,14 @@ jobs:
             everco/gauzy-webapp-demo:latest
             registry.digitalocean.com/ever/gauzy-webapp-demo:latest
             ${{ secrets.CW_DOCKER_REGISTRY }}/ever-co/gauzy-webapp-demo:latest
-          cache-from: type=registry,ref=ghcr.io/ever-co/gauzy-webapp-demo:latest
-          cache-to: type=inline
+          # mode=max caches ALL stages (incl. the multi-minute yarn-install layers) to a dedicated
+          # :buildcache tag; every ephemeral runner restores it → no more fully-cold rebuilds.
+          # Needs the default docker-container buildx driver — the classic `docker` driver only
+          # supports inline (final-stage) cache, which is why the yarn-install stages were cold.
+          cache-from: |
+            type=registry,ref=ghcr.io/ever-co/gauzy-webapp-demo:buildcache
+            type=registry,ref=ghcr.io/ever-co/gauzy-webapp-demo:latest
+          cache-to: type=registry,ref=ghcr.io/ever-co/gauzy-webapp-demo:buildcache,mode=max
           build-args: |
             NODE_ENV=development
             DEMO=true
@@ -195,8 +223,15 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+
+      # Log in to GHCR BEFORE the build so buildx can PUSH the mode=max layer cache to the
+      # :buildcache tag (cache-to needs registry auth at build time).
+      - name: Login to GitHub Container Registry (build cache)
+        uses: docker/login-action@v4
         with:
-          driver: docker
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build
         uses: docker/build-push-action@v7
@@ -210,8 +245,14 @@ jobs:
             everco/gauzy-worker-demo:latest
             registry.digitalocean.com/ever/gauzy-worker-demo:latest
             ${{ secrets.CW_DOCKER_REGISTRY }}/ever-co/gauzy-worker-demo:latest
-          cache-from: type=registry,ref=ghcr.io/ever-co/gauzy-worker-demo:latest
-          cache-to: type=inline
+          # mode=max caches ALL stages (incl. the multi-minute yarn-install layers) to a dedicated
+          # :buildcache tag; every ephemeral runner restores it → no more fully-cold rebuilds.
+          # Needs the default docker-container buildx driver — the classic `docker` driver only
+          # supports inline (final-stage) cache, which is why the yarn-install stages were cold.
+          cache-from: |
+            type=registry,ref=ghcr.io/ever-co/gauzy-worker-demo:buildcache
+            type=registry,ref=ghcr.io/ever-co/gauzy-worker-demo:latest
+          cache-to: type=registry,ref=ghcr.io/ever-co/gauzy-worker-demo:buildcache,mode=max
           build-args: |
             NODE_ENV=development
             DEMO=true