Docker 25, and the build cache backend I finally read about

Cache mounts are local to the builder, which on a hosted CI runner means they do nothing at all.

- uses: docker/build-push-action@v5
  with:
    cache-from: type=registry,ref=ghcr.io/org/app:buildcache
    cache-to: type=registry,ref=ghcr.io/org/app:buildcache,mode=max

# mode=max exports the intermediate layers as well as
# the final ones — larger, and the difference between a
# cache that helps and one that only helps if nothing
# changed.

A registry cache backend moves the layer cache off the runner and makes it shared, which is the only version of this that works on ephemeral machines. Cold builds went from six minutes to two and a half; the cache image is nine hundred megabytes and has to be garbage collected, which is a job somebody has to remember and which we set to run monthly.