diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 322dfdc..142042b 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -3,7 +3,18 @@ when:
 
 steps:
   - name: build
-    image: golang:1.25
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9"
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapic
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     commands:
       - make build
     backend_options:
@@ -20,7 +31,18 @@ steps:
   # The release itself only runs on a tag, so validate the packaging config and
   # build the artifacts (binary + RPM) here without publishing anything.
   - name: package
-    image: golang:1.26
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9"
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapic
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     commands:
       - git fetch --tags --force
       - go install github.com/goreleaser/goreleaser/v2@v2.17.1
diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml
index d57b508..3866f65 100644
--- a/.woodpecker/pre-commit.yaml
+++ b/.woodpecker/pre-commit.yaml
@@ -3,7 +3,18 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9"
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapic
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     commands:
       - uvx pre-commit run --all-files
     backend_options:
diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
index e3565aa..996dba0 100644
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@@ -4,7 +4,18 @@ when:
 
 steps:
   - name: test
-    image: golang:1.25
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9"
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapic
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     commands:
       - go test -race ./...
     backend_options:
@@ -23,10 +34,20 @@ steps:
   # with the binary, RPM and per-artifact sha256 files attached. The binary
   # asset name is unchanged — the puppet compilers pull it at pod start.
   - name: goreleaser
-    image: golang:1.26
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9"
     environment:
       GITEA_TOKEN:
         from_secret: RELEASER_TOKEN
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapic
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     commands:
       # goreleaser reads the tag history for the changelog; Woodpecker's clone
       # can be shallow.
diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml
index 5e179a7..6ce904c 100644
--- a/.woodpecker/test.yaml
+++ b/.woodpecker/test.yaml
@@ -18,7 +18,18 @@ steps:
             cpu: 2
 
   - name: test
-    image: golang:1.25
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9"
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-encapic
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     commands:
       - go test -v -race ./...
     backend_options: