diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml
index 9d77409..eac394b 100644
--- a/.woodpecker/pre-commit.yaml
+++ b/.woodpecker/pre-commit.yaml
@@ -3,19 +3,29 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - uvx pre-commit run --all-files
     environment:
       # golib lives on Gitea; skip the public proxy/sum db.
       GOPRIVATE: git.unkin.net
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapi
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 512Mi
+            memory: 1Gi
             cpu: 1
           limits:
-            memory: 2Gi
+            memory: 3Gi
             cpu: 2
diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
index 489aff1..488bb64 100644
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@@ -5,21 +5,31 @@ when:
 # repo. The server image is built separately by docker.yaml.
 steps:
   - name: build
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - make build-cli VERSION=${CI_COMMIT_TAG}
     environment:
       # golib lives on Gitea; skip the public proxy/sum db.
       GOPRIVATE: git.unkin.net
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapi
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 512Mi
+            memory: 1Gi
             cpu: 1
           limits:
-            memory: 2Gi
+            memory: 3Gi
             cpu: 2
 
   - name: package
diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml
index 52945bd..58d2a49 100644
--- a/.woodpecker/test.yaml
+++ b/.woodpecker/test.yaml
@@ -3,25 +3,35 @@ when:
 
 steps:
   - name: lint
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - make lint
     environment:
       # golib lives on Gitea; skip the public proxy/sum db.
       GOPRIVATE: git.unkin.net
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapi
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 512Mi
+            memory: 1Gi
             cpu: 1
           limits:
-            memory: 2Gi
+            memory: 3Gi
             cpu: 2
 
   - name: test
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       # Container-backed DB tests self-skip when Docker is unavailable in CI;
       # they run in the docker-e2e path / locally.
@@ -29,13 +39,23 @@ steps:
     environment:
       # golib lives on Gitea; skip the public proxy/sum db.
       GOPRIVATE: git.unkin.net
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapi
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 512Mi
+            memory: 1Gi
             cpu: 1
           limits:
-            memory: 2Gi
+            memory: 4Gi
             cpu: 2