diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 9c530e8..ac56efa 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -55,12 +55,23 @@ jobs:
                         mkdir -p /etc/buildkit
                         printf '[registry."%s"]\n  http = true\n  insecure = true\n' "$REG" > /etc/buildkit/buildkitd.toml
 
+                        # Only pass --import-cache when the tag already exists in the
+                        # registry. On first run the tag is absent and some registries
+                        # time out rather than returning 404, which makes buildctl exit
+                        # non-zero even though the build and push succeeded.
+                        cache_flag() {
+                          local image="$1" tag="$2"
+                          if wget -qO- "http://$REG/v2/$image/tags/list" 2>/dev/null | grep -q "\"$tag\""; then
+                            echo "--import-cache type=registry,ref=$REG/$image:$tag"
+                          fi
+                        }
+
                         # Build server image
                         buildctl-daemonless.sh build \
                           --frontend=dockerfile.v0 \
                           --local context=/workspace/repo/server \
                           --local dockerfile=/workspace/repo/server \
-                          --import-cache type=registry,ref=$REG/coqdecks-cache:server \
+                          $(cache_flag coqdecks-cache server) \
                           --export-cache type=registry,ref=$REG/coqdecks-cache:server,mode=max \
                           --output type=image,name=$REG/coqdecks-server:latest,push=true,registry.insecure=true
 
@@ -69,7 +80,7 @@ jobs:
                           --frontend=dockerfile.v0 \
                           --local context=/workspace/repo/client \
                           --local dockerfile=/workspace/repo/client \
-                          --import-cache type=registry,ref=$REG/coqdecks-cache:client \
+                          $(cache_flag coqdecks-cache client) \
                           --export-cache type=registry,ref=$REG/coqdecks-cache:client,mode=max \
                           --output type=image,name=$REG/coqdecks-client:latest,push=true,registry.insecure=true
                     volumeMounts: