diff --git a/.github/actions/docker-build/action.yml b/.github/actions/docker-build/action.yml
index bb241713490..a607a720afd 100644
--- a/.github/actions/docker-build/action.yml
+++ b/.github/actions/docker-build/action.yml
@@ -25,9 +25,28 @@ inputs:
 runs:
   using: composite
   steps:
+    # One sticky disk per Dockerfile per platform. v1 keyed it on the repo name
+    # alone, so every image shared one disk: matrix jobs all clone the same
+    # parent snapshot and only the first to finish becomes the next parent, so
+    # the app image's `deps` layer was written and discarded every run (~300-465s
+    # rebuilt each time). Platform is in the key because amd64 and arm64 build
+    # the same Dockerfiles concurrently on main and share no layers. Ref is
+    # deliberately not: cross-ref reuse is the point, and an occasional overlap
+    # costs one rebuild.
+    - name: Resolve Docker layer cache key
+      id: cache-key
+      if: inputs.provider == '' || inputs.provider == 'blacksmith'
+      shell: bash
+      env:
+        FILE: ${{ inputs.file }}
+        PLATFORMS: ${{ inputs.platforms }}
+      run: echo "value=${GITHUB_REPOSITORY##*/}/${FILE#./}/${PLATFORMS//\//-}" >> "$GITHUB_OUTPUT"
+
     - name: Set up Blacksmith builder
       if: inputs.provider == '' || inputs.provider == 'blacksmith'
-      uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
+      uses: useblacksmith/setup-docker-builder@a5256a73e30f09e37e3eceb8ca36043d17621d24 # v2
+      with:
+        cache-key: ${{ steps.cache-key.outputs.value }}
 
     - name: Build and push (Blacksmith)
       if: inputs.provider == '' || inputs.provider == 'blacksmith'