diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 77f174a..955869a 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -89,14 +89,17 @@ jobs:
           if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event.inputs.force }}" = "true" ]; then          
             echo "changed=true" >> "$GITHUB_OUTPUT"
             echo "non-scheduled or forced run - building"
+            echo "non-scheduled or forced run - building (hash ${{ steps.hash.outputs.hash }})" >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
           if docker buildx imagetools inspect "$IMAGE:src-${{ steps.hash.outputs.hash }}" >/dev/null 2>&1; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "no change since last build - skipping"
+            echo "no change since last build - skipping (hash ${{ steps.hash.outputs.hash }})" >> "$GITHUB_STEP_SUMMARY"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
             echo "upstream or Dockerfile changed - building"
+            echo "upstream or Dockerfile changed - building (hash ${{ steps.hash.outputs.hash }})" >> "$GITHUB_STEP_SUMMARY"
           fi
 
       - name: Compute date tag
@@ -126,8 +129,8 @@ jobs:
         with:
           context: .
           push: true
-          pull: true                      # re-resolve bases; without this the cron is a no-op
-          provenance: false               # no attestation manifest -> half the package versions
+          pull: true                      # belt and braces; runner containers are fresh so bases are pulled anyway
+          provenance: false
           cache-from: type=registry,ref=${{ env.IMAGE }}:stable
           cache-to: type=inline
           build-args: |