diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 299fc9efe7..46277cbb6f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -317,6 +317,9 @@ jobs:
     if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true'
     permissions:
       contents: read
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      SCCACHE_GHA_RW_MODE: ${{ (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.number == 5224)) && 'READ_WRITE' || 'READ_ONLY' }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
@@ -341,6 +344,13 @@ jobs:
             .
             desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
+      # Cache rustc outputs for unchanged workspace crates. Trusted pushes write;
+      # the bounded PR 5224 trial writes only to its isolated merge-ref scope.
+      - name: Set up sccache
+        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 # zizmor: ignore[cache-poisoning] Bounded trial: only PR 5224 writes to its isolated merge-ref scope; trusted pushes retain production writes.
+        with:
+          version: v0.16.0
       - name: Install cargo-nextest
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
         uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
@@ -348,6 +358,8 @@ jobs:
           tool: cargo-nextest@0.9.136
       - name: Build relay artifacts
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
+        env:
+          RUSTC_WRAPPER: sccache
         run: |
           cargo build --profile ci -p buzz-relay -p git-credential-nostr
           cargo nextest archive \
@@ -359,7 +371,9 @@ jobs:
             --test e2e_event_reminder \
             --archive-file target/ci/backend-integration-tests.tar.zst
       - name: Save relay artifacts cache
-        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
+        # PR-scoped exact-source entries cannot warm main or other PRs and churn
+        # the shared cache pool. sccache provides read-only PR reuse instead.
+        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' && github.event_name == 'push'
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
diff --git a/Cargo.toml b/Cargo.toml
index cc1dd0f9df..98d68fb521 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -148,8 +148,8 @@ buzz-relay-mesh = { path = "crates/buzz-relay-mesh" }
 # release optimization (warm from main's cache; they carry the runtime hot
 # path: tokio/sqlx/axum). Workspace crates build at opt-level 1 — enough for
 # stable e2e timing (PR #307 flakiness was opt-0 + debug-assertions) at
-# roughly half the codegen cost. `incremental` is irrelevant in CI:
-# rust-cache exports CARGO_INCREMENTAL=0 and never caches member artifacts.
+# roughly half the codegen cost. Incremental stays disabled: rust-cache exports
+# CARGO_INCREMENTAL=0, and the CI compiler cache requires non-incremental units.
 [profile.ci]
 inherits = "release"
 lto = false