diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 2f504a4..6046793 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -10,30 +10,18 @@ jobs:
   ci:
     runs-on: docker
     container:
-      image: forge.lvl0.xyz/lvl0/dishplanner-ci:php8.3-3
+      image: forge.lvl0.xyz/lvl0/dishplanner-ci:php8.3-4
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Cache Composer dependencies
-        uses: https://data.forgejo.org/actions/cache@v4
-        with:
-          path: ~/.composer/cache
-          key: composer-${{ hashFiles('composer.lock') }}
-          restore-keys: composer-
-
-      - name: Install dependencies
-        run: |
-          for attempt in 1 2 3 4 5; do
-            echo "composer install attempt $attempt/5"
-            composer install --no-interaction --prefer-source && exit 0
-            echo "composer install failed (attempt $attempt/5), retrying in 30s..."
-            sleep 30
-          done
-          exit 1
-
       - name: Prepare environment
         run: cp .env.testing .env
 
+      - name: Restore dependencies
+        run: |
+          cp -a /opt/deps/vendor ./vendor
+          composer install --no-interaction --no-progress --prefer-source
+
       - name: Lint
         run: vendor/bin/pint --test
 
diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index c644391..0ebc9e5 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -5,6 +5,8 @@ on:
     branches: [main]
     paths:
       - 'docker/build/**'
+      - 'composer.json'
+      - 'composer.lock'
       - '.forgejo/workflows/images.yml'
   workflow_dispatch:
 
@@ -18,7 +20,7 @@ jobs:
         include:
           - name: dishplanner-ci
             file: docker/build/Dockerfile.ci
-            version: php8.3-3
+            version: php8.3-4
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
diff --git a/docker/build/Dockerfile.ci b/docker/build/Dockerfile.ci
index 548205d..f3270c8 100644
--- a/docker/build/Dockerfile.ci
+++ b/docker/build/Dockerfile.ci
@@ -30,11 +30,15 @@ RUN apt-get update \
 
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
-# phpstan/phpstan is dist-only (no VCS source), so pre-warm its Composer cache
-# here to avoid codeload.github.com rate limits during CI's composer install.
-# Keep the version in sync with composer.lock. Build this image on a network
-# that isn't codeload-rate-limited (e.g. locally) until #50 is resolved.
-RUN mkdir -p /tmp/warm && cd /tmp/warm \
-    && printf '{"require":{"phpstan/phpstan":"2.2.8"}}' > composer.json \
-    && composer install --no-interaction --no-progress \
-    && rm -rf /tmp/warm
+# Bake the project's PHP dependencies (dev included) into the image so CI
+# restores them with a local copy instead of paying a per-run composer install
+# over the network. Build this image on a network that isn't
+# codeload-rate-limited (e.g. locally) — the Forgejo runner hits codeload 429
+# under --prefer-dist.
+#
+# --no-scripts skips `php artisan package:discover` (the app isn't present
+# here). CI runs `composer install` after restoring vendor, which regenerates
+# bootstrap/cache and tops up any lockfile drift between main and release/*.
+WORKDIR /opt/deps
+COPY composer.json composer.lock ./
+RUN composer install --no-interaction --no-progress --prefer-dist --no-scripts