diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 5b0f6c8f5..70b09547b 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -26,15 +26,14 @@ jobs:
           cache: false # avoid cache thrashing
         id: go
 
-      - uses: actions/cache@v6
+      # shared cache, written by the Build job on master only
+      - uses: actions/cache/restore@v6
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-clean-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-clean-
-            ${{ runner.os }}-go-
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
 
       - name: Install tools
         run: make install
@@ -66,15 +65,15 @@ jobs:
           cache: false
         id: go
 
-      - uses: actions/cache@v6
+      # single writer of the shared cache all other jobs restore from
+      - uses: actions/cache/restore@v6
+        id: go-cache
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-build-
-            ${{ runner.os }}-go-
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
 
       - uses: voidzero-dev/setup-vp@v1
         with:
@@ -86,6 +85,17 @@ jobs:
       - name: Build
         run: make build
 
+      # PR caches are only visible to their own PR, so writing them wastes the
+      # repo cache budget and evicts the master entry every job falls back to
+      - name: Save Go cache
+        if: github.ref == 'refs/heads/master' && steps.go-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+
   test:
     name: Test
     runs-on: depot-ubuntu-24.04-arm
@@ -104,15 +114,14 @@ jobs:
           cache: false
         id: go
 
-      - uses: actions/cache@v6
+      # shared cache, written by the Build job on master only
+      - uses: actions/cache/restore@v6
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-test-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-test-
-            ${{ runner.os }}-go-
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
 
       - name: Test
         run: mkdir dist && touch dist/empty && make test
@@ -135,15 +144,14 @@ jobs:
           cache: false # avoid cache thrashing
         id: go
 
-      - uses: actions/cache@v6
+      # shared cache, written by the Build job on master only
+      - uses: actions/cache/restore@v6
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-lint-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-lint-
-            ${{ runner.os }}-go-
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
 
       - run: mkdir dist && touch dist/empty
 
@@ -224,15 +232,14 @@ jobs:
           cache: false
         id: go
 
-      - uses: actions/cache@v6
+      # shared cache, written by the Build job on master only
+      - uses: actions/cache/restore@v6
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-integration-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-integration-
-            ${{ runner.os }}-go-
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
 
       - uses: voidzero-dev/setup-vp@v1
         with:
@@ -250,7 +257,7 @@ jobs:
         run: echo "PLAYWRIGHT_VERSION=$(node -e "console.log(require('./package-lock.json').packages['node_modules/@playwright/test'].version)")" >> $GITHUB_ENV
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v6
+        uses: actions/cache/restore@v6
         id: playwright-cache
         with:
           path: ~/.cache/ms-playwright
@@ -261,6 +268,13 @@ jobs:
         run: vpx playwright install --with-deps chromium
         timeout-minutes: 5
 
+      - name: Save Playwright browsers
+        if: github.ref == 'refs/heads/master' && steps.playwright-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
+
       - name: Run tests
         run: vpx playwright test
         timeout-minutes: 20