diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 1f9ed67e..e606850e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -62,14 +62,14 @@ jobs:
           sudo rm -rf /usr/local/share/boost
           docker system prune -af
 
-      - name: build once and push to both registries by digest
-        id: build
+      - name: build and push to ghcr.io by digest
+        id: build-ghcr
         uses: docker/build-push-action@v7
         with:
           context: .
           platforms: ${{ matrix.platform }}
           cache-from: type=gha,scope=${{ matrix.platform }}
-          cache-to: type=gha,scope=${{ matrix.platform }},mode=max,ignore-error=true
+          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
           build-args: |
             SKIP_BACKEND_TEST=true
             SKIP_FRONTEND_TEST=true
@@ -77,18 +77,31 @@ jobs:
             GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
             GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
             GITHUB_REF=refs/heads/${{ github.event.workflow_run.head_branch }}
-          outputs: |
-            type=image,name=ghcr.io/umputun/remark42,push-by-digest=true,name-canonical=true,push=true
-            type=image,name=umputun/remark42,push-by-digest=true,name-canonical=true,push=true
+          outputs: type=image,name=ghcr.io/umputun/remark42,push-by-digest=true,name-canonical=true,push=true
 
-      - name: export digest
+      - name: build and push to DockerHub by digest
+        id: build-dockerhub
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          build-args: |
+            SKIP_BACKEND_TEST=true
+            SKIP_FRONTEND_TEST=true
+            CI=github
+            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
+            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
+            GITHUB_REF=refs/heads/${{ github.event.workflow_run.head_branch }}
+          outputs: type=image,name=umputun/remark42,push-by-digest=true,name-canonical=true,push=true
+
+      - name: export digests
         run: |
-          # both registries receive the same content-addressed image, so the
-          # single build digest applies to each
           mkdir -p /tmp/digests/ghcr /tmp/digests/dockerhub
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/ghcr/${digest#sha256:}"
-          touch "/tmp/digests/dockerhub/${digest#sha256:}"
+          digest_ghcr="${{ steps.build-ghcr.outputs.digest }}"
+          digest_dockerhub="${{ steps.build-dockerhub.outputs.digest }}"
+          touch "/tmp/digests/ghcr/${digest_ghcr#sha256:}"
+          touch "/tmp/digests/dockerhub/${digest_dockerhub#sha256:}"
 
       - name: upload ghcr digest
         uses: actions/upload-artifact@v7