diff --git a/.tangled/workflows/test.yml b/.tangled/workflows/test.yml
index 98a0f060..254be9f9 100644
--- a/.tangled/workflows/test.yml
+++ b/.tangled/workflows/test.yml
@@ -20,6 +20,37 @@ environment:
   # host turns those syncs into multi-second stalls. Their scratch lives in RAM.
   TMPDIR: "/dev/shm"
   ALBEDO_TEST_TMP: "/dev/shm/albedo-tests"
+  # Go's caches live outside the checkout so treefmt and gleam never walk them.
+  GOCACHE: "/workspace/.cache/go-build"
+  GOMODCACHE: "/workspace/.cache/go-mod"
+  # A restored GOCACHE would replay passing `go test` results; CI runs them all.
+  GOFLAGS: "-count=1"
+
+# Spindle restores these before the clone and saves them after the steps. Go,
+# Cargo, npm and Nix check every input themselves, so they could start from an
+# older entry (`fallback: true`) once the spindle has core 8dcfd51; before it a
+# fallback can restore another key's archive. Gleam recompiles a module whose content changed (the checkout gives every
+# source a fresh mtime, so it always compares hashes), but it trusts compiled
+# dependencies and BEAM files across an Erlang upgrade, so build/ is reused only
+# for the exact manifest and toolchain.
+cache:
+  - key: gleam-build
+    hash: [manifest.toml, gleam.toml, flake.lock]
+    paths: [build]
+  - key: go
+    hash: [cli/go.sum, cli/tools/apigen/go.sum, flake.lock]
+    when: always
+    paths: [/workspace/.cache/go-build, /workspace/.cache/go-mod]
+  - key: cargo
+    hash: [native/render/Cargo.lock, flake.lock]
+    when: always
+    paths: [native/render/target, /workspace/.cargo/registry]
+  - key: npm
+    hash: [web/package-lock.json]
+    paths: [/workspace/.npm]
+  - key: nix-fetch
+    hash: [flake.lock]
+    paths: [/workspace/.cache/nix]
 
 steps:
   - name: complete test gate