diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml
index 76c5ee7..d512184 100644
--- a/.github/workflows/keycloak.yml
+++ b/.github/workflows/keycloak.yml
@@ -1,4 +1,4 @@
-name: Docker Image
+name: CI/CD
 
 # Controls when the action will run. 
 on:
@@ -15,17 +15,21 @@ on:
     paths-ignore:
       - '**/*.md'
 
+  # Validate pull requests without publishing
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**/*.md'
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
 
-  image_keycloak:
-
-    env:
-      PLATFORM: linux/amd64,linux/arm64
-
+  build:
+    name: CI/CD
     runs-on: ubuntu-latest
 
     steps:
@@ -42,58 +46,79 @@ jobs:
         env:
           TAG: ${{ github.event.release.tag_name }}
 
-      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: set up JDK 17
-        uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1
+      - name: Set up JDK 21 and gradle cache
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
-          java-version: 17
+          distribution: 'temurin'
+          java-version: '21'
+          cache: 'gradle'
 
-      - name: grant execute permission for gradlew
-        run: chmod +x gradlew
-
-      - name: build with Gradle
+      - name: Build with Gradle
         run: ./gradlew installDist
 
-      - name: set up QEMU
-        uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1
-        with:
-          platforms: all
-
-      - name: install buildx
-        id: buildx
-        uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1
+      - name: Install QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
-          version: latest
-          install: true
+          platforms: linux/amd64,linux/aarch64
 
-      - name: available platforms
-        run: echo ${{ steps.buildx.outputs.platforms }}
+      - name: Install Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Login to DockerHub
-        uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1
+      - name: Build and load Keycloak image for Grype scan
+        timeout-minutes: 20
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          username: ${{ secrets._TEMP_DOCKERHUB_USER }}
-          password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }}
-
-      - name: build and push images
-        run: |
-          docker build --build-arg GIT_COMMIT=${{ github.sha }} --push --platform $PLATFORM $TAG .
+          context: .
+          platforms: linux/amd64 # "ubuntu-latest" runs on x86 GitHub runners
+          load: true # Load image locally for Grype Scan
+          push: false
+          tags: ${{ steps.set-tags.outputs.keycloakDockerImage }}
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
 
-      - name: Scan keycloak docker image
-        uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3
+      - name: Scan Keycloak Docker image
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
         id: keycloak-anchore-scan
         with:
           image: ${{ steps.set-tags.outputs.keycloakDockerImage }}
-          fail-build: false
+          fail-build: true
           severity-cutoff: critical
 
       - name: Upload Anchore scan SARIF report
         if: ${{ !cancelled() }}
-        uses: github/codeql-action/upload-sarif@e488e3c8239c26bf8e6704904a8cb59be658d450 # v3
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           sarif_file: ${{ steps.keycloak-anchore-scan.outputs.sarif }}
 
       - name: Inspect Anchore scan SARIF report
         if: ${{ !cancelled() }}
         run: cat ${{ steps.keycloak-anchore-scan.outputs.sarif }}
+
+      - name: Login to DockerHub
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        with:
+          username: ${{ secrets._TEMP_DOCKERHUB_USER }}
+          password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }}
+
+      - name: Build multi-platform Keycloak image
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 20
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64,linux/aarch64
+          load: false
+          push: true
+          tags: ${{ steps.set-tags.outputs.keycloakDockerImage }}
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false