diff --git a/.dockerignore b/.dockerignore
index 844a38d0b..a42a29787 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -43,6 +43,7 @@ venv.bak/
 .agent-work/
 .runtime/
 .tmp/
+.cache/
 node_modules/
 public/
 .moviepilot.env
diff --git a/.github/workflows/build-v3.yml b/.github/workflows/build-v3.yml
index 86bdf75a0..273c82b4c 100644
--- a/.github/workflows/build-v3.yml
+++ b/.github/workflows/build-v3.yml
@@ -161,6 +161,7 @@ jobs:
         with:
           image-ref: moviepilot-v3-candidate:linux-amd64
           version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
           scanners: vuln
           vuln-type: os,library
           severity: HIGH,CRITICAL
@@ -191,6 +192,7 @@ jobs:
         with:
           image-ref: moviepilot-v3-candidate:linux-arm64
           version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
           scanners: vuln
           vuln-type: os,library
           severity: HIGH,CRITICAL
diff --git a/tests/test_docker_payload_contract.py b/tests/test_docker_payload_contract.py
index cda4b525d..c0c7b1285 100644
--- a/tests/test_docker_payload_contract.py
+++ b/tests/test_docker_payload_contract.py
@@ -25,6 +25,7 @@ def test_build_context_excludes_runtime_state_and_keeps_release_inputs() -> None
         ".agent-work/",
         ".runtime/",
         ".tmp/",
+        ".cache/",
         "node_modules/",
         "public/",
         ".moviepilot.env",
diff --git a/tests/test_release_supply_chain.py b/tests/test_release_supply_chain.py
index 542794591..e4c4e2e23 100644
--- a/tests/test_release_supply_chain.py
+++ b/tests/test_release_supply_chain.py
@@ -76,6 +76,7 @@ def test_release_scans_both_architectures_before_registry_login_and_publish() ->
         "Scan arm64 candidate vulnerabilities",
     ):
         scan = indexed[name]
+        assert scan["with"]["cache-dir"] == "${{ runner.temp }}/trivy"
         assert scan["uses"] == (
             "aquasecurity/trivy-action@"
             "a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8"