diff --git a/.github/actions/rust-setup/action.yaml b/.github/actions/rust-setup/action.yaml
index ab18cbd55..4b7f0edec 100644
--- a/.github/actions/rust-setup/action.yaml
+++ b/.github/actions/rust-setup/action.yaml
@@ -11,9 +11,6 @@ inputs:
   install-deps:
     description: 'Install system dependencies (protoc, cmake, etc.)'
     default: 'true'
-  sccache:
-    description: 'Enable sccache'
-    default: 'true'
   mold:
     description: 'Use mold linker'
     default: 'true'
@@ -45,7 +42,8 @@ runs:
 
     - name: Rust cache
       uses: Swatinem/rust-cache@v2
-
-    - name: Run sccache
-      if: inputs.sccache == 'true'
-      uses: mozilla-actions/sccache-action@v0.0.9
+      with:
+        # Only write the cache from main so PR/dependabot branches restore
+        # main's warm dependency cache instead of evicting it. This is the fix
+        # for the 10GB GHA cache thrashing that caused cold compiles every run.
+        save-if: ${{ github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/audit-rust.yaml b/.github/workflows/audit-rust.yaml
index 6dce9897e..0f82c5809 100644
--- a/.github/workflows/audit-rust.yaml
+++ b/.github/workflows/audit-rust.yaml
@@ -21,10 +21,6 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: true
 
-env:
-  SCCACHE_GHA_ENABLED: "true"
-  RUSTC_WRAPPER: "sccache"
-
 jobs:
   audit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci-rust.yaml b/.github/workflows/ci-rust.yaml
index 5ea77ee02..caa78c7f2 100644
--- a/.github/workflows/ci-rust.yaml
+++ b/.github/workflows/ci-rust.yaml
@@ -31,8 +31,10 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  SCCACHE_GHA_ENABLED: "true"
-  RUSTC_WRAPPER: "sccache"
+  # Trim debug info in CI only (local dev profiles are untouched): smaller
+  # target dir, faster codegen/linking, and a lighter cache to store/restore.
+  CARGO_PROFILE_DEV_DEBUG: line-tables-only
+  CARGO_PROFILE_TEST_DEBUG: line-tables-only
 
 jobs:
   check:
@@ -102,7 +104,6 @@ jobs:
         with:
           components: rustfmt
           install-deps: 'false'
-          sccache: 'false'
           mold: 'false'
       - name: Rustfmt Check
         uses: actions-rust-lang/rustfmt@v1
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index 36b0ea51d..d70e7fcf3 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -87,9 +87,12 @@ jobs:
             PROFILE=release
             CI=${{ env.CI }}
           push: true
-          # layer caching
-          cache-from: type=gha
-          cache-to: type=gha,mode=max,ignore-error=true
+          # Layer caching via the registry (no 10GB GHA-cache cap), so the
+          # cargo-chef `cook` layer stays warm instead of being evicted and
+          # forcing a ~12min dependency rebuild. Only main writes the cache;
+          # other branches restore it read-only and can't evict it.
+          cache-from: type=registry,ref=ghcr.io/meteroid-oss/${{ matrix.image_type.name }}:buildcache
+          cache-to: ${{ github.ref == 'refs/heads/main' && format('type=registry,ref=ghcr.io/meteroid-oss/{0}:buildcache,mode=max,image-manifest=true,ignore-error=true', matrix.image_type.name) || '' }}
           # https://github.com/docker/build-push-action/issues/900
           provenance: false
           outputs: type=image,name=ghcr.io/meteroid-oss/${{ matrix.image_type.name }},push-by-digest=true,name-canonical=true,push=true,store=true
diff --git a/.github/workflows/openapi-rust.yaml b/.github/workflows/openapi-rust.yaml
index 6a5bcb52c..46eb253b0 100644
--- a/.github/workflows/openapi-rust.yaml
+++ b/.github/workflows/openapi-rust.yaml
@@ -23,8 +23,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  SCCACHE_GHA_ENABLED: "true"
-  RUSTC_WRAPPER: "sccache"
+  # Trim debug info in CI only: faster codegen/linking, lighter cache.
+  CARGO_PROFILE_DEV_DEBUG: line-tables-only
 
 jobs:
   openapi:
diff --git a/modules/metering/Dockerfile b/modules/metering/Dockerfile
index f9e5e13c1..17203ddc1 100644
--- a/modules/metering/Dockerfile
+++ b/modules/metering/Dockerfile
@@ -31,8 +31,13 @@ RUN wget https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/mold-
     tar xvfz mold*.tar.gz && \
     mv mold*-linux/bin/* /usr/local/bin && \
     mv mold*-linux/libexec/* /usr/libexec && \
+    ln -sf /usr/local/bin/mold /usr/local/bin/ld.mold && \
     rm -rf mold*
 
+# Link with mold. The .cargo/config.toml mold config is .dockerignored so it
+# never reaches the build; wire it here or these builds link with slow default ld.
+ENV RUSTFLAGS="-Clink-arg=-fuse-ld=mold"
+
 # Install protoc
 RUN wget https://github.com/protocolbuffers/protobuf/releases/download/v${PROTO_VERSION}/protoc-${PROTO_VERSION}-linux-${PROTO_ARCH}.zip && \
     unzip protoc*.zip && \
diff --git a/modules/meteroid/api.Dockerfile b/modules/meteroid/api.Dockerfile
index b91573089..0b09e3905 100644
--- a/modules/meteroid/api.Dockerfile
+++ b/modules/meteroid/api.Dockerfile
@@ -31,8 +31,13 @@ RUN wget https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/mold-
     tar xvfz mold*.tar.gz && \
     mv mold*-linux/bin/* /usr/local/bin && \
     mv mold*-linux/libexec/* /usr/libexec && \
+    ln -sf /usr/local/bin/mold /usr/local/bin/ld.mold && \
     rm -rf mold*
 
+# Link with mold. The .cargo/config.toml mold config is .dockerignored so it
+# never reaches the build; wire it here or these builds link with slow default ld.
+ENV RUSTFLAGS="-Clink-arg=-fuse-ld=mold"
+
 # Install protoc
 RUN wget https://github.com/protocolbuffers/protobuf/releases/download/v${PROTO_VERSION}/protoc-${PROTO_VERSION}-linux-${PROTO_ARCH}.zip && \
     unzip protoc*.zip && \
diff --git a/modules/meteroid/scheduler.Dockerfile b/modules/meteroid/scheduler.Dockerfile
index 252768e77..5ee1ceb07 100644
--- a/modules/meteroid/scheduler.Dockerfile
+++ b/modules/meteroid/scheduler.Dockerfile
@@ -23,6 +23,7 @@ RUN apt-get update && \
     tar xvfz mold*.tar.gz && \
     mv mold*-linux/bin/* /usr/local/bin && \
     mv mold*-linux/libexec/* /usr/libexec && \
+    ln -sf /usr/local/bin/mold /usr/local/bin/ld.mold && \
     rm -rf mold*; \
     # Install protoc
     wget https://github.com/protocolbuffers/protobuf/releases/download/v${PROTO_VERSION}/protoc-${PROTO_VERSION}-linux-${PROTO_ARCH}.zip && \
@@ -33,6 +34,10 @@ RUN apt-get update && \
     apt-get clean; \
     rm -rf /var/lib/apt/lists/*
 
+# Link with mold. The .cargo/config.toml mold config is .dockerignored so it
+# never reaches the build; wire it here or these builds link with slow default ld.
+ENV RUSTFLAGS="-Clink-arg=-fuse-ld=mold"
+
 COPY --from=planner /opt/src/recipe.json recipe.json
 
 ARG PROFILE