diff --git a/.builds/test.yml b/.builds/test.yml
index 746c4cae9df58d85b484e81acb156573328843fd..42792f9ff4b041e8c09ff7996109640d82377187 100644
--- a/.builds/test.yml
+++ b/.builds/test.yml
@@ -6,13 +6,16 @@ #
 # Order: install_cacher → cacher_init → install_go → cache_gomod →
 #        test → docker_start → cache_garage_image → test_e2e.
 #
-# Dogfoods the published cacher binary (from pages.sr.ht) to cache:
+# Dogfoods the published cacher binary (from pages.sr.ht), installed by
+# the published install.sh, to cache:
 #   * The Go tarball, via `cacher download --url` fallback.
-#   * ~/go/pkg/mod, keyed on sha256(go.sum) — biggest win, the docker
-#     SDK transitives pulled in by testcontainers are heavy.
-#   * The Garage docker image, via `cacher docker download --pull` —
-#     single call that does cache HIT → docker load, or cache MISS →
-#     docker pull + seed.
+#   * ~/go/pkg/mod, keyed on sha256(go.sum), via `cacher dir download
+#     --exec` — biggest win, the docker SDK transitives pulled in by
+#     testcontainers are heavy.
+#   * The Garage docker image, via `cacher docker download --pull`.
+# Each of those is one invocation that does cache HIT → restore, or
+# cache MISS → fetch/build + seed. No if/fi in this file on purpose:
+# the manifest is the demo.
 image: ubuntu/noble
 packages:
   - curl
@@ -41,11 +44,11 @@       - refs/heads/master
       - "refs/tags/*"
 tasks:
   - install_cacher: |
-      mkdir -p ~/.local/bin
-      curl -sSL "https://${PAGES_DOMAIN}${PAGES_SUBPATH}/cacher-linux-amd64" \
-        -o ~/.local/bin/cacher
-      chmod +x ~/.local/bin/cacher
-      cacher version
+      # install.sh picks the asset for this platform, verifies it against
+      # checksums.txt and prints `cacher version` on the way out. ~/.local/bin
+      # is already on PATH via `environment:` above, so this task can go
+      # straight on to using the binary.
+      curl -sSL "https://${PAGES_DOMAIN}${PAGES_SUBPATH}/install.sh" | sh
   - cacher_init: |
       cacher init \
         --endpoint    https://s3.bigb.es \
@@ -66,18 +69,11 @@   - cache_gomod: |
       # Cache ~/go/pkg/mod keyed by sha256(go.sum). A go.sum change
       # invalidates automatically; otherwise both `go test` and the e2e
       # variant (testcontainers + docker SDK transitives) hit the cache
-      # and skip proxy.golang.org entirely.
-      GOSUM_HASH=$(sha256sum ci-cacher/go.sum | cut -c1-16)
-      KEY="gomod/${GOSUM_HASH}.tar.gz"
-      if cacher download "$KEY" /tmp/gomod.tar.gz; then
-        mkdir -p ~/go
-        tar -xzf /tmp/gomod.tar.gz -C ~/go
-      else
-        cd ci-cacher && go mod download && cd ..
-        tar -czf /tmp/gomod.tar.gz -C ~/go pkg/mod
-        cacher upload "$KEY" /tmp/gomod.tar.gz
-      fi
-      rm -f /tmp/gomod.tar.gz
+      # and skip proxy.golang.org entirely. --exec runs only on a miss,
+      # and the tree it leaves behind is what gets uploaded.
+      cacher dir download "gomod/{hash}.tar.zst" ~/go/pkg/mod \
+        --hash-from ci-cacher/go.sum \
+        --exec 'cd ci-cacher && go mod download'
   - test: |
       cd ci-cacher
       go test ./...