diff --git a/.gitea/workflows/cicd.yml b/.gitea/workflows/cicd.yml
index c2b2d5e..bb1a4af 100644
--- a/.gitea/workflows/cicd.yml
+++ b/.gitea/workflows/cicd.yml
@@ -379,15 +379,22 @@ jobs:
           # Login to registry
           echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
 
-          # Verify base image availability with fallback strategy
-          BASE_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:latest"
-          echo "Checking base image availability: ${BASE_IMAGE}"
+          # Prefer the immutable hash-tagged base image so unchanged base Dockerfiles
+          # reuse the cached registry image instead of rebuilding locally.
+          BASE_HASH=$(sha256sum Dockerfile.cicd-base | cut -d' ' -f1 | head -c16)
+          BASE_IMAGE_HASH="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
+          BASE_IMAGE_LATEST="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:latest"
+          BASE_IMAGE="${BASE_IMAGE_HASH}"
 
-          # Try to pull from registry (may not be available if push failed)
-          if timeout 30 docker pull "${BASE_IMAGE}" 2>/dev/null; then
-            echo "✓ Base image pulled from registry"
+          echo "Checking immutable base image: ${BASE_IMAGE_HASH}"
+
+          if timeout 30 docker pull "${BASE_IMAGE_HASH}" 2>/dev/null; then
+            echo "✓ Base image pulled from immutable hash tag"
+          elif timeout 30 docker pull "${BASE_IMAGE_LATEST}" 2>/dev/null; then
+            BASE_IMAGE="${BASE_IMAGE_LATEST}"
+            echo "✓ Base image pulled from latest tag"
           else
-            echo "ℹ Base image not in registry (registry push may have failed)"
+            echo "ℹ Base image not available in registry by hash or latest"
             echo "Building base image locally as fallback..."
 
             # Check if base Dockerfile exists and build it locally
diff --git a/Dockerfile.cicd b/Dockerfile.cicd
index 75393eb..10a7755 100644
--- a/Dockerfile.cicd
+++ b/Dockerfile.cicd
@@ -131,10 +131,25 @@ RUN --mount=type=secret,id=ssh_private_key \
     echo "    UserKnownHostsFile /dev/null" >> ~/.ssh/config && \
     chmod 600 ~/.ssh/config && \
     ssh-keyscan -p 2222 kankali.darkhelm.lan >> ~/.ssh/known_hosts 2>/dev/null && \
-    # Keep the secret-mounted step minimal to avoid BuildKit session timeouts.
-    GIT_SSH_COMMAND="ssh -F ~/.ssh/config" \
-    git clone --depth 1 --branch main \
-    ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git /tmp/fullrepo && \
+    clone_ok=false && \
+    for i in 1 2 3; do \
+        echo "Clone attempt ${i}/3 from Gitea..." && \
+        if GIT_SSH_COMMAND="ssh -F ~/.ssh/config" \
+            git clone --depth 1 --branch main \
+            ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git /tmp/fullrepo; then \
+            clone_ok=true && \
+            break; \
+        fi && \
+        if [ "${i}" -lt 3 ]; then \
+            echo "⚠ Clone attempt ${i} failed, retrying in 5 seconds..." && \
+            rm -rf /tmp/fullrepo && \
+            sleep 5; \
+        fi; \
+    done && \
+    if [ "${clone_ok}" != "true" ]; then \
+        echo "❌ Failed to clone repository from Gitea after 3 attempts" && \
+        exit 1; \
+    fi && \
     if [ -n "$GITHUB_SHA" ]; then \
         cd /tmp/fullrepo && git checkout "$GITHUB_SHA" 2>/dev/null || echo "Using main branch HEAD"; \
     fi && \