diff --git a/APKBUILD b/APKBUILD
index 3dd0daaf4ef6d99a93f9c6d92ea33ca5550170a3..e877002ab3b605ccbe78d666b5e42345f2c545f2 100644
--- a/APKBUILD
+++ b/APKBUILD
@@ -34,7 +34,10 @@ 	export GOCACHE="$HOME/.cache/go-build"
 	export GOMODCACHE="$HOME/go/pkg/mod"
 	# web/static (bundle.js + hashed CSS) is committed and go:embed-ed, so
 	# there is no `make css` / `make bundle` step here — see README.
-	CGO_ENABLED=0 make build GOFLAGS="-trimpath"
+	# -modcacherw matters beyond convenience: without it the module cache is
+	# extracted read-only, and the CI cache tarball made from it can't be
+	# unpacked on the next build (mkdir into 0555 dirs fails).
+	CGO_ENABLED=0 make build GOFLAGS="-trimpath -modcacherw"
 }
 
 package() {