diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abe08f1d..d84462f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,7 +62,13 @@ jobs:
       - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
         with:
           toolchain: stable
+      # Save only on pushes (dev, main). A PR can read its own caches, its
+      # base branch's and the default branch's, never another PR's, so a cache
+      # saved on a PR serves only a later push to that same PR, while taking as
+      # much of the repository's 10 GB cache quota as dev's and evicting it.
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          save-if: ${{ github.event_name == 'push' }}
       - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
         with:
           tool: cargo-nextest
@@ -158,6 +164,9 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          # See the `rust` job.
+          save-if: ${{ github.event_name == 'push' }}
       - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
         with:
           tool: cargo-nextest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a77bce08..7d03ed04 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,8 +104,13 @@ jobs:
             org.opencontainers.image.version=${{ github.ref_name }}
             org.opencontainers.image.revision=${{ github.sha }}
             org.opencontainers.image.licenses=BUSL-1.1
-          cache-from: type=gha,scope=${{ matrix.component }}-${{ steps.meta.outputs.platform_pair }}
-          cache-to: type=gha,scope=${{ matrix.component }}-${{ steps.meta.outputs.platform_pair }},mode=max
+          # Read the caches CI saves on main, never write. A tag run can read
+          # its own caches and the default branch's (main) only, and the tag
+          # points at a commit whose main push CI has just built from the same
+          # Dockerfile, so these scopes are CI's (`server-<platform>`, and `web`
+          # for both platforms). A cache written here would be filed under the
+          # tag, where no later run can read it.
+          cache-from: type=gha,scope=${{ matrix.component == 'web' && 'web' || format('server-{0}', matrix.platform) }}
 
       - name: Export digest
         run: |