diff --git a/.gitea/workflows/build-on-demand.yml b/.gitea/workflows/build-on-demand.yml
new file mode 100644
index 0000000..8f18e28
--- /dev/null
+++ b/.gitea/workflows/build-on-demand.yml
@@ -0,0 +1,142 @@
+name: Build image when workload image tag changes
+
+on:
+  push:
+    branches: [ deployment ]                 # adjust if needed
+    paths:
+      - "arcocd/deployment.yaml"
+      - "Dockerfile"                   # keep if you also want to rebuild when Dockerfile changes
+
+jobs:
+  build-if-image-changed:
+    runs-on: ubuntu-latest
+
+    env:
+      DEPLOY_FILE: "arcocd/deployment.yaml"
+      TARGET_REPO: "git.baumann.gr/adebaumann/vui"   # repo (no tag)
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Determine base commit
+        id: base
+        shell: bash
+        run: |
+          set -euo pipefail
+          if git rev-parse --verify -q HEAD~1 >/dev/null; then
+            echo "base=$(git rev-parse HEAD~1)" >> "$GITHUB_OUTPUT"
+          else
+            echo "base=$(git hash-object -t tree /dev/null)" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Install yq for robust YAML parsing
+      - name: Install yq
+        shell: bash
+        run: |
+          set -euo pipefail
+          YQ_VER=v4.44.3
+          curl -sL "https://github.com/mikefarah/yq/releases/download/${YQ_VER}/yq_linux_amd64" -o /usr/local/bin/yq
+          chmod +x /usr/local/bin/yq
+          yq --version
+
+      - name: Read workload image from deployment (old vs new)
+        id: img
+        shell: bash
+        run: |
+          set -euo pipefail
+          file="$DEPLOY_FILE"
+          repo="$TARGET_REPO"
+
+          # Function: from a deployment yaml, read .spec.template.spec.containers[].image
+          # and select the one whose image starts with "$repo:"
+          extract() {
+            yq -r '
+              .spec.template.spec.containers // []                       # only real containers, not initContainers
+              | map(.image) | .[]?                                        # images as strings
+              | select(startswith(env(repo) + ":"))                       # match exact repo + ":"
+            ' "$1" 2>/dev/null | tail -n 1
+          }
+
+          # Old image from previous commit (if file existed)
+          if git cat-file -e "${{ steps.base.outputs.base }}":"$file" 2>/dev/null; then
+            git show "${{ steps.base.outputs.base }}:$file" > /tmp/old.yaml
+            old_image="$(extract /tmp/old.yaml || true)"
+          else
+            old_image=""
+          fi
+
+          # New image from workspace
+          if [ -f "$file" ]; then
+            new_image="$(extract "$file" || true)"
+          else
+            new_image=""
+          fi
+
+          echo "Old workload image: $old_image"
+          echo "New workload image: $new_image"
+
+          # Helpers to split repo and tag (handles registry with port)
+          parse_tag() {
+            local ref="$1"
+            local after_slash="${ref##*/}"
+            if [[ "$after_slash" == *:* ]]; then echo "${after_slash##*:}"; else echo ""; fi
+          }
+          parse_repo() {
+            local ref="$1"
+            local tag="$(parse_tag "$ref")"
+            if [ -n "$tag" ]; then echo "${ref%:$tag}"; else echo "$ref"; fi
+          }
+
+          old_tag="$(parse_tag "$old_image")"
+          new_tag="$(parse_tag "$new_image")"
+          new_repo="$(parse_repo "$new_image")"
+
+          if [ -z "$new_image" ]; then
+            echo "ERROR: Could not find a containers[].image starting with ${repo}: in $file"
+            exit 1
+          fi
+
+          registry="$(echo "$new_repo" | awk -F/ '{print $1}')"
+
+          {
+            echo "changed=$([ "$old_tag" != "$new_tag" ] && echo true || echo false)"
+            echo "new_image=$new_image"
+            echo "new_repo=$new_repo"
+            echo "new_tag=$new_tag"
+            echo "registry=$registry"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Skip if tag unchanged
+        if: steps.img.outputs.changed != 'true'
+        run: echo "Workload image tag unchanged in ${{ env.DEPLOY_FILE }}; skipping build."
+
+      - name: Set up Buildx
+        if: steps.img.outputs.changed == 'true'
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to registry
+        if: steps.img.outputs.changed == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ steps.img.outputs.registry }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push (exact tag from deployment)
+        if: steps.img.outputs.changed == 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ steps.img.outputs.new_image }}
+            ${{ steps.img.outputs.new_repo }}:latest
+          labels: |
+            org.opencontainers.image.source=${{ gitea.repository }}
+            org.opencontainers.image.revision=${{ gitea.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+