diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml
index dcef31b..a63ebe0 100644
--- a/.github/workflows/production.yml
+++ b/.github/workflows/production.yml
@@ -18,15 +18,31 @@ jobs:
     name: Deploy app
     needs: ci
     runs-on: ubuntu-latest
-    concurrency: deploy-group # optional: ensure only one action runs at a time
+    concurrency: deploy-group
 
     environment:
       name: production
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
       - uses: superfly/flyctl-actions/setup-flyctl@master
 
+      - name: Authenticate with Fly registry
+        run: flyctl auth docker
+
+      - name: Build and push Docker image (GHA cache)
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: .
+          tags: registry.fly.io/${{ github.repository }}:sha-${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Set Fly secrets
         run: |
           flyctl secrets --access-token "$FLY_API_TOKEN" set \
@@ -44,4 +60,4 @@ jobs:
           RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
 
-      - run: flyctl deploy --remote-only
+      - run: flyctl deploy --image ${{ env.IMAGE_TAG }}
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index ac87dbf..219ae9a 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -12,43 +12,51 @@ env:
 
 jobs:
   ci:
+    if: github.event.action != 'closed'
     uses: ./.github/workflows/ci.yml
     secrets: inherit
 
-  review_app:
+  build_and_deploy:
+    if: github.event.action != 'closed'
     runs-on: ubuntu-latest
     needs: ci
+
     outputs:
       url: ${{ steps.deploy.outputs.url }}
     # Only run one deployment at a time per PR.
     concurrency:
       group: pr-${{ github.event.number }}
 
-    # Deploying apps with this "review" environment allows the URL for the app to be displayed in the PR UI.
-    # Feel free to change the name of this environment.
     environment:
       name: review
-      # The script in the `deploy` sets the URL output for each review app.
       url: ${{ steps.deploy.outputs.url }}
 
     steps:
       - name: Get code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
+
       - name: Install flyctl CLI
         uses: superfly/flyctl-actions/setup-flyctl@master
+
       - name: Authenticate with Fly.io registry
         run: flyctl auth docker
+
       - name: Create Fly App before pushing docker image to registry
         run: |
           flyctl apps create ${{ env.APP_NAME }} --org ${{ env.FLY_ORG }} || true
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
           push: true
-          tags: registry.fly.io/${{ env.APP_NAME }}:1.19
+          tags: registry.fly.io/${{ env.APP_NAME }}:sha-${{ github.sha }}
           context: .
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Deploy PR app to Fly.io
         id: deploy
         uses: superfly/fly-pr-review-apps@1.5.0
@@ -64,3 +72,17 @@ jobs:
             DATABASE_URL=${{ secrets.DATABASE_URL }}
             SECRET_KEY_BASE=${{ secrets.SECRET_KEY_BASE }}
             PHX_HOST=${{ env.APP_NAME }}.fly.dev
+
+  review_app_cleanup:
+    if: github.event.action == 'closed'
+    runs-on: ubuntu-latest
+
+    concurrency:
+      group: pr-${{ github.event.number }}
+
+    steps:
+      - name: Destroy PR app
+        uses: superfly/fly-pr-review-apps@1.5.0
+        with:
+          name: ${{ env.APP_NAME }}
+          config: fly.review.toml