diff --git a/.github/workflows/template.yml b/.github/workflows/template.yml
index 75a4f33..4713d6c 100644
--- a/.github/workflows/template.yml
+++ b/.github/workflows/template.yml
@@ -7,17 +7,20 @@ on:
       - '.github/workflows/template.yml'
     branches:
       - main
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  buildAndPublish:
+  # The DockerHub image is cluster-independent, so it is only rebuilt on pushes.
+  buildAndPushImage:
+    if: ${{ github.event_name == 'push' }}
     defaults:
       run:
         working-directory: ./template
 
-    name: Build and Push Images
+    name: Build and Push Image to DockerHub
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
@@ -58,7 +61,61 @@ jobs:
             --push \
             --tag ${{ secrets.DOCKERHUB_USERNAME }}/desktop:latest -f - files
 
+  # The template is built on every production cluster. Clusters are separate
+  # tenancies with separate template registries, so each needs its own build.
+  buildTemplate:
+    name: Build E2B template (${{ matrix.cluster }})
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - cluster: foxtrot
+            domain: e2b.dev
+          - cluster: juliett
+            domain: e2b-juliett.dev
+          - cluster: tango
+            domain: e2b-tango.dev
+    # Builds on the same cluster serialize; different clusters run concurrently.
+    concurrency:
+      group: Template-${{ github.ref }}-${{ matrix.cluster }}
+      cancel-in-progress: false
+    defaults:
+      run:
+        working-directory: ./template
+    env:
+      E2B_DOMAIN: ${{ matrix.domain }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+
+      - name: Parse .tool-versions
+        uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
+        id: tool-versions
+        with:
+          filename: '.tool-versions'
+          uppercase: 'true'
+          prefix: 'tool_version_'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '${{ env.TOOL_VERSION_UV }}'
+          python-version: '${{ env.TOOL_VERSION_PYTHON }}'
+          working-directory: ./template
+
+      - name: Install dependencies
+        run: uv sync --locked
+
       - name: Build E2B template
-        run: uv run python build_prod.py
         env:
-          E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
+          CLUSTER: ${{ matrix.cluster }}
+          # Static secret references: a dynamic secrets[...] index would hand this
+          # job every organization and repository secret instead of one cluster key.
+          E2B_API_KEY: ${{ (matrix.cluster == 'foxtrot' && secrets.E2B_API_KEY) || (matrix.cluster == 'juliett' && secrets.E2B_JULIETT_API_KEY) || (matrix.cluster == 'tango' && secrets.E2B_TANGO_API_KEY) || '' }}
+        run: |
+          if [ -z "$E2B_API_KEY" ]; then
+            echo "::error::Missing API key secret for cluster: $CLUSTER" >&2
+            exit 1
+          fi
+          uv run python build_prod.py