diff --git a/apps/base/woodpecker/gocache_bucket.yaml b/apps/base/woodpecker/gocache_bucket.yaml
new file mode 100644
index 0000000..8541b60
--- /dev/null
+++ b/apps/base/woodpecker/gocache_bucket.yaml
@@ -0,0 +1,33 @@
+---
+# Shared Go build cache (GOCACHEPROG) for CI and developer laptops. Lives in the
+# woodpecker namespace because CI is the primary consumer and reads the Secret here.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: gocache
+  namespace: woodpecker
+spec:
+  displayName: "Go build cache owner"
+  uid: gocache
+  maxBuckets: 1
+  secretName: gocache-s3
+  retainOnDelete: false
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: gocache
+  namespace: woodpecker
+spec:
+  bucketName: gocache
+  ownerRef: gocache
+  versioning: false
+  # No placementTarget: default (replicated) placement, not the ec target the
+  # backup buckets use — a build cache is millions of small objects.
+  tags:
+    app: gocache
+    purpose: go-build-cache
+  retainOnDelete: false
+  # A cache bucket is never empty, and the operator refuses to delete a
+  # non-empty bucket without this, wedging the finalizer.
+  purgeOnDelete: true
diff --git a/apps/base/woodpecker/kustomization.yaml b/apps/base/woodpecker/kustomization.yaml
index 627a499..ae394e2 100644
--- a/apps/base/woodpecker/kustomization.yaml
+++ b/apps/base/woodpecker/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
   - cnpg_pooler.yaml
+  - gocache_bucket.yaml
   - serviceaccount_arrproxy_ci.yaml
   - serviceaccount_autobackup_operator_ci.yaml
   - serviceaccount_ghp.yaml