diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 40c92e0..2f504a4 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -10,14 +10,14 @@ jobs:
   ci:
     runs-on: docker
     container:
-      image: forge.lvl0.xyz/lvl0/dishplanner-ci:php8.3-2
+      image: forge.lvl0.xyz/lvl0/dishplanner-ci:php8.3-3
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
       - name: Cache Composer dependencies
         uses: https://data.forgejo.org/actions/cache@v4
         with:
-          path: ~/.cache/composer
+          path: ~/.composer/cache
           key: composer-${{ hashFiles('composer.lock') }}
           restore-keys: composer-
 
@@ -25,7 +25,7 @@ jobs:
         run: |
           for attempt in 1 2 3 4 5; do
             echo "composer install attempt $attempt/5"
-            composer install --no-interaction --prefer-dist && exit 0
+            composer install --no-interaction --prefer-source && exit 0
             echo "composer install failed (attempt $attempt/5), retrying in 30s..."
             sleep 30
           done
diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index f120e93..c644391 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -18,7 +18,7 @@ jobs:
         include:
           - name: dishplanner-ci
             file: docker/build/Dockerfile.ci
-            version: php8.3-2
+            version: php8.3-3
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
diff --git a/docker/build/Dockerfile.ci b/docker/build/Dockerfile.ci
index 8fd3972..548205d 100644
--- a/docker/build/Dockerfile.ci
+++ b/docker/build/Dockerfile.ci
@@ -29,3 +29,12 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+# phpstan/phpstan is dist-only (no VCS source), so pre-warm its Composer cache
+# here to avoid codeload.github.com rate limits during CI's composer install.
+# Keep the version in sync with composer.lock. Build this image on a network
+# that isn't codeload-rate-limited (e.g. locally) until #50 is resolved.
+RUN mkdir -p /tmp/warm && cd /tmp/warm \
+    && printf '{"require":{"phpstan/phpstan":"2.2.8"}}' > composer.json \
+    && composer install --no-interaction --no-progress \
+    && rm -rf /tmp/warm