diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7cde38e..b9bb590 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -13,8 +13,29 @@ on:
     branches: [main]
 
 jobs:
+  # Warm the runner's shared action cache once, alone, before the parallel
+  # pnpm jobs start. With the runner at capacity > 1, several jobs otherwise
+  # fetch the same actions (checkout, setup-node, pnpm/action-setup) into the
+  # shared offline cache simultaneously and read it half-written — a flaky
+  # "Cannot find module .../dist/…" in "Set up Node.js"/"Set up pnpm". Running
+  # these actions once here populates the cache completely; the dependent jobs
+  # then only read it. Cheap (~30 s) and keeps full parallelism afterwards.
+  prepare:
+    name: Warm action cache
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
   checks:
     name: Lint, typecheck, test
+    needs: prepare
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -65,6 +86,7 @@ jobs:
   # already-built-and-seeded stack, instead of spinning up a second one.
   auth-e2e:
     name: Auth e2e pack
+    needs: prepare
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -355,6 +377,7 @@ jobs:
   # job (no sidecars there).
   fidelity:
     name: Import/export fidelity gate
+    needs: prepare
     runs-on: ubuntu-latest
     # A guard so a hung sidecar can never keep the job (and its containers)
     # alive on the shared runner host; the suite itself finishes in ~1 min.
@@ -435,6 +458,7 @@ jobs:
 
   images:
     name: Build container images
+    needs: prepare
     # PR-only: on main the CD workflow builds and pushes the same images —
     # building twice would waste the runner (ADR 0014: build once, promote).
     if: github.event_name == 'pull_request'