diff --git a/.github/workflows/docker-base-image.yml b/.github/workflows/docker-base-image.yml
index f6082fa6ff76..29b61760643e 100644
--- a/.github/workflows/docker-base-image.yml
+++ b/.github/workflows/docker-base-image.yml
@@ -4,12 +4,13 @@ on:
   workflow_dispatch:
   schedule:
     - cron: "0 5 * * MON"
-  push:
-    branches:
-      - release
-      - master
-    paths:
-      - "deploy/docker/base.dockerfile"
+  workflow_call:
+    inputs:
+      tag:
+        description: "Docker tag override (e.g. release, nightly). Defaults to branch-based detection."
+        required: false
+        type: string
+        default: ""
 
 jobs:
   build-docker:
@@ -25,6 +26,24 @@ jobs:
     steps:
       - name: Checkout the head commit of the branch
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check if base.dockerfile changed
+        id: check
+        if: github.event_name == 'workflow_call'
+        run: |
+          if [[ -n "${{ github.event.before }}" ]]; then
+            range="${{ github.event.before }}..${{ github.sha }}"
+          else
+            range="HEAD~1..HEAD"
+          fi
+
+          if git diff --name-only "$range" | grep -qx "deploy/docker/base.dockerfile"; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
@@ -35,9 +54,13 @@ jobs:
       - name: Get tag
         id: tag
         run: |
-          tag="${GITHUB_REF_NAME//\//-}"
-          if [[ "$tag" == master ]]; then
-            tag=nightly
+          if [[ -n "${{ inputs.tag }}" ]]; then
+            tag="${{ inputs.tag }}"
+          else
+            tag="${GITHUB_REF_NAME//\//-}"
+            if [[ "$tag" == master ]]; then
+              tag=nightly
+            fi
           fi
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
 
@@ -45,6 +68,7 @@ jobs:
         uses: depot/setup-action@v1
 
       - name: Build and push base image
+        if: steps.check.outputs.changed != 'false'
         uses: depot/build-push-action@v1
         with:
           project: ${{ secrets.DEPOT_PROJECT_ID }}
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
index a538ae59cb7d..90d1ca2d33d5 100644
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -205,8 +205,14 @@ jobs:
           path: app/client/packages/rts/rts-dist.tar
           overwrite: true
 
+  build-base-image:
+    uses: ./.github/workflows/docker-base-image.yml
+    secrets: inherit
+    with:
+      tag: nightly
+
   package:
-    needs: [prelude, client-build, server-build, rts-build]
+    needs: [prelude, client-build, server-build, rts-build, build-base-image]
 
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/test-build-docker-image.yml b/.github/workflows/test-build-docker-image.yml
index 47fba4035418..8ccb2f0d154f 100644
--- a/.github/workflows/test-build-docker-image.yml
+++ b/.github/workflows/test-build-docker-image.yml
@@ -29,6 +29,7 @@ on:
       - "app/server/**"
       - "app/client/packages/rts/**"
       - "!app/client/cypress/manual_TestSuite/**"
+      - "deploy/docker/base.dockerfile"
 
 jobs:
   setup:
@@ -87,8 +88,12 @@ jobs:
     with:
       pr: 0
 
+  build-base-image:
+    uses: ./.github/workflows/docker-base-image.yml
+    secrets: inherit
+
   build-docker-image:
-    needs: [client-build, server-build, rts-build]
+    needs: [client-build, server-build, rts-build, build-base-image]
     # Only run if the build step is successful
     if: success()
     name: build-docker-image