diff --git a/.gitea/workflows/tests.yml b/.gitea/workflows/tests.yml
index 4c3b488..e0267b6 100644
--- a/.gitea/workflows/tests.yml
+++ b/.gitea/workflows/tests.yml
@@ -26,8 +26,20 @@ jobs:
           extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
           coverage: none
 
+      - name: Cache Composer packages
+        uses: actions/cache@v4.1.2
+        with:
+          path: ~/.cache/composer
+          key: composer-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-
+
       - name: Install PHP dependencies
-        run: composer install --no-interaction --prefer-dist --no-progress
+        # Dist downloads come from GitHub, which rate-limits anonymous callers —
+        # on a shared IP that is a coin flip. Falling back to source clones keeps
+        # CI self-sufficient instead of depending on someone else's quota.
+        run: |
+          composer install --no-interaction --prefer-dist --no-progress \
+            || composer install --no-interaction --prefer-source --no-progress
 
       - name: Prepare environment
         run: |
@@ -47,6 +59,13 @@ jobs:
         with:
           node-version: '22'
 
+      - name: Cache npm packages
+        uses: actions/cache@v4.1.2
+        with:
+          path: ~/.npm
+          key: npm-${{ hashFiles('package-lock.json') }}
+          restore-keys: npm-
+
       - name: Install JS dependencies
         run: npm ci --no-fund --no-audit