diff --git a/.gitea/workflows/cms-content-validation.yml b/.gitea/workflows/cms-content-validation.yml
index 2494d61..d05f34f 100644
--- a/.gitea/workflows/cms-content-validation.yml
+++ b/.gitea/workflows/cms-content-validation.yml
@@ -20,6 +20,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Verify Decap configuration and content boundaries
diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml
index cdfc57a..51c11de 100644
--- a/.gitea/workflows/deploy-blog.yml
+++ b/.gitea/workflows/deploy-blog.yml
@@ -33,6 +33,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 41001ae..91cc1b9 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -33,6 +33,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site
diff --git a/.gitea/workflows/production-blog.yml b/.gitea/workflows/production-blog.yml
index 2224ba8..d015bf0 100644
--- a/.gitea/workflows/production-blog.yml
+++ b/.gitea/workflows/production-blog.yml
@@ -34,6 +34,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production blog
diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml
index 7334870..2a773d8 100644
--- a/.gitea/workflows/production-candidate.yml
+++ b/.gitea/workflows/production-candidate.yml
@@ -34,6 +34,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production site
diff --git a/docs/decap-cms-pilot.md b/docs/decap-cms-pilot.md
index c75d9c6..57d29d0 100644
--- a/docs/decap-cms-pilot.md
+++ b/docs/decap-cms-pilot.md
@@ -81,14 +81,12 @@ the pilot:
 - The existing branch preview workflows remain in place. Local output checks
   now prove preview robots rules and page metadata stay no-index and that the
   admin response has a no-index header rule.
-- Validation, preview, and production workflows use clean `npm ci` installs with
-  `--prefer-offline --no-audit --no-fund`. Do not enable `setup-node`'s npm cache
-  until the Actions runner cache service is reachable from job containers. The
-  September 4 pilot test timed out against the runner's auto-detected private
-  address during both cache restore and cleanup. Give `act_runner` a fixed
-  `cache.host` and `cache.port` reachable from its job containers, publish that
-  port (or attach runner and jobs to a shared network), restart the runner, and
-  then restore the lockfile-keyed `cache: npm` configuration.
+- Validation, preview, and production workflows cache npm's download store by
+  `package-lock.json` while retaining clean `npm ci` installs with
+  `--prefer-offline --no-audit --no-fund`. The runner advertises its cache on a
+  fixed host and port reachable from job containers, avoiding the timeout caused
+  by its former auto-detected private address. Warm jobs reuse dependency
+  tarballs without caching `node_modules`.
 
 The pilot dependencies are active: the public client ID, exact-origin CORS
 policy, `cms-pilot` branch, and both protection rules have been verified.
diff --git a/scripts/verify-decap.mjs b/scripts/verify-decap.mjs
index 349b9e6..fe6abe2 100644
--- a/scripts/verify-decap.mjs
+++ b/scripts/verify-decap.mjs
@@ -227,6 +227,7 @@ for (const path of [
   '.gitea/workflows/production-blog.yml',
 ]) {
   const text = await readFile(path, 'utf8');
+  assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`);
   assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install with quiet, cache-friendly npm options.`);
 }