diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index eff29c08f..e3d79cbab 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -30,14 +30,24 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version-file: '.node-version'
+          cache: npm
+
+      # Cache node_modules keyed on the lockfile + Node version: an unchanged
+      # lockfile skips `npm ci` (extraction + postinstall folds patch) and just
+      # restores the tree. Save runs only on a miss AND only if install
+      # succeeded (`success()`), so a failed `npm ci` can't poison the cache.
+      # The act_runner cache server is reached over the dedicated `act-cache-net`
+      # docker network (runner cache.host 172.30.0.2) — jobs previously landed on
+      # isolated per-job networks and ETIMEDOUT on it (~5 min wasted per build).
+      - name: Restore node_modules
+        id: node-modules
+        uses: actions/cache/restore@v4
+        with:
+          path: node_modules
+          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json', '.node-version') }}
 
-      # No npm / node_modules cache: the act_runner's internal cache server is
-      # unreachable from job containers (`getCacheEntry failed: connect ETIMEDOUT
-      # 172.17.0.2`), so every cache restore hangs ~5 min and then fails — pure
-      # cost, zero benefit. `cache: npm` was removed from Setup Node above for the
-      # same reason. Re-enable both (setup-node `cache: npm` + an actions/cache
-      # node_modules step) once the runner's cache server is reachable from jobs.
       - name: Install dependencies
+        if: steps.node-modules.outputs.cache-hit != 'true'
         # Harden against transient registry network failures (ECONNRESET etc.):
         # raise npm's built-in fetch retries/timeouts and retry `npm ci` up to
         # 3 times with backoff before failing the build.
@@ -57,6 +67,13 @@ jobs:
             sleep $((attempt * 15))
           done
 
+      - name: Save node_modules
+        if: steps.node-modules.outputs.cache-hit != 'true' && success()
+        uses: actions/cache/save@v4
+        with:
+          path: node_modules
+          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json', '.node-version') }}
+
       # ── Quality gates run BEFORE the slow build so a format/lint/type/test
       # error fails in seconds instead of after the ~minutes-long build. All are
       # hard gates — any failure fails the job and blocks the deploy. The tree is