diff --git a/.build.yml b/.build.yml
index 35fd8e3488d47211e4706e0041c1063b47ceed18..7cf2e592f1a12fc0e172a5f01d386ffb12e98b58 100644
--- a/.build.yml
+++ b/.build.yml
@@ -1,6 +1,7 @@
 image: alpine/edge
 packages:
   - abuild
+  - curl
   - go
   - git
   - rclone
@@ -8,6 +9,10 @@ secrets:
   # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing
   # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket.
   - apk-ci-s3
+  # S3 credentials for the cacher CI cache (Garage `docker-cache` bucket),
+  # same pair the bencher and ci-cacher builds use.
+  - 7dde4219-0783-4581-a67d-c94749de3600   # ~/.s3-cache-key-id
+  - 0e5b3530-6f19-4f30-9b73-9339dd382e46   # ~/.s3-cache-key-secret
 sources:
   - https://git.srht.bigb.es/~bigbes/sr-ht-compare
 environment:
@@ -37,12 +42,45 @@       ver="0.0.$(git rev-list --count HEAD)"
       sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
       echo "export PKGVER=$ver" >> ~/.buildenv
       echo "building $ver"
+  - cacher: |
+      # S3-backed CI cache helper (go.bigb.es/cacher), dogfooded from its own
+      # published release — the same bootstrap the bencher/ci-cacher builds use.
+      mkdir -p ~/.local/bin
+      curl -sSL "https://bigbes.pages.srht.bigb.es/ci-cacher/cacher-linux-amd64" \
+        -o ~/.local/bin/cacher
+      chmod +x ~/.local/bin/cacher
+      echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.buildenv
+      export PATH="$HOME/.local/bin:$PATH"
+      cacher init \
+        --endpoint    https://s3.bigb.es \
+        --region      garage \
+        --bucket      docker-cache \
+        --prefix      sr-ht-compare/deps \
+        --key-file    ~/.s3-cache-key-id \
+        --secret-file ~/.s3-cache-key-secret
+  - cache_restore: |
+      # Restore the Go module and build caches, both keyed by go.sum: the
+      # dependency tree dominates compile time, and it only changes when go.sum
+      # does. A miss is just a cold build, never an error.
+      KEY_MOD=$(cacher key "gomod/{hash}.tar.zst" --hash-from "$REPO/go.sum")
+      KEY_GOC=$(cacher key "gocache/{hash}.tar.zst" --hash-from "$REPO/go.sum")
+      echo "export KEY_MOD=$KEY_MOD KEY_GOC=$KEY_GOC" >> ~/.buildenv
+      # abuild redirects the Go caches into its throwaway $tmpdir (and an
+      # upstream typo slaves GOMODCACHE to GOCACHE), so env exports here can't
+      # stick — the APKBUILD's build() re-pins both to these home locations.
+      cacher dir download "$KEY_MOD" ~/go/pkg/mod || true
+      cacher dir download "$KEY_GOC" ~/.cache/go-build || true
   - build: |
       cd "$REPO"
       # -d: makedepends are already installed via `packages:` above, so skip
       # abuild's own dependency resolution (which would want to sudo apk add).
       REPODEST=$HOME/packages abuild -d
       find "$HOME/packages" -name '*.apk'
+  - cache_save: |
+      # Seed the caches only when this go.sum has no entry yet — on a hit the
+      # tarballs are already up there and re-uploading identical bytes is waste.
+      cacher exists "$KEY_MOD" || cacher dir upload "$KEY_MOD" ~/go/pkg/mod
+      cacher exists "$KEY_GOC" || cacher dir upload "$KEY_GOC" ~/.cache/go-build
   - publish: |
       set +x   # never echo the S3 credentials into the build log
       . ~/.apk-ci.env
diff --git a/APKBUILD b/APKBUILD
index 80de5cd87bffb6de40b25cea1a931211d8a650f2..3dd0daaf4ef6d99a93f9c6d92ea33ca5550170a3 100644
--- a/APKBUILD
+++ b/APKBUILD
@@ -26,6 +26,12 @@ builddir="$startdir"
 
 build() {
 	cd "$builddir"
+	# abuild redirects GOCACHE into $tmpdir (wiped after packaging), and an
+	# upstream typo makes GOMODCACHE follow GOCACHE's value rather than its
+	# own. Re-pin both to the stable home locations here — after abuild's own
+	# exports — so CI's cache_restore/cache_save tasks see them survive.
+	export GOCACHE="$HOME/.cache/go-build"
+	export GOMODCACHE="$HOME/go/pkg/mod"
 	# web/static (bundle.js + hashed CSS) is committed and go:embed-ed, so
 	# there is no `make css` / `make bundle` step here — see README.
 	CGO_ENABLED=0 make build GOFLAGS="-trimpath"