diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60b27d9ef4..7e7e91056c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,7 +55,8 @@ jobs:
       # sccache cannot reuse Cargo incremental artifacts, so avoid generating them in CI.
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
+      # Fork PRs cannot read repository secrets, so retain the GHA backend for them.
+      SCCACHE_GHA_ENABLED: ${{ secrets.SCCACHE_S3_BUCKET == '' && 'true' || 'false' }}
     steps:
       - uses: actions/checkout@v5
 
@@ -86,6 +87,14 @@ jobs:
         run: cargo fmt --check
 
       - name: Cargo clippy
+        env:
+          SCCACHE_BUCKET: ${{ secrets.SCCACHE_S3_BUCKET }}
+          SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_S3_ENDPOINT }}
+          SCCACHE_REGION: ${{ secrets.SCCACHE_S3_REGION }}
+          SCCACHE_S3_KEY_PREFIX: ${{ secrets.SCCACHE_S3_KEY_PREFIX }}
+          SCCACHE_S3_USE_SSL: "true"
+          AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_ACCESS_KEY }}
         run: cargo clippy --workspace --locked --all-targets
 
       - name: Show sccache stats
@@ -101,7 +110,8 @@ jobs:
       # sccache cannot reuse Cargo incremental artifacts, so avoid generating them in CI.
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
+      # Fork PRs cannot read repository secrets, so retain the GHA backend for them.
+      SCCACHE_GHA_ENABLED: ${{ secrets.SCCACHE_S3_BUCKET == '' && 'true' || 'false' }}
     steps:
       - uses: actions/checkout@v5
 
@@ -127,6 +137,14 @@ jobs:
           cache-on-failure: true
 
       - name: Cargo test
+        env:
+          SCCACHE_BUCKET: ${{ secrets.SCCACHE_S3_BUCKET }}
+          SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_S3_ENDPOINT }}
+          SCCACHE_REGION: ${{ secrets.SCCACHE_S3_REGION }}
+          SCCACHE_S3_KEY_PREFIX: ${{ secrets.SCCACHE_S3_KEY_PREFIX }}
+          SCCACHE_S3_USE_SSL: "true"
+          AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_ACCESS_KEY }}
         run: cargo test --workspace --locked
 
       - name: Show sccache stats
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 789e415064..b50f050402 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,6 +88,11 @@ jobs:
             arch: arm64
 
     runs-on: ${{ matrix.platform }}
+    env:
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      # Keep releases working until the shared S3 secrets are configured.
+      SCCACHE_GHA_ENABLED: ${{ secrets.SCCACHE_S3_BUCKET == '' && 'true' || 'false' }}
     steps:
       - uses: actions/checkout@v5
 
@@ -107,6 +112,11 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+        with:
+          version: "v0.10.0"
+
       - name: Compute Rust dependency hash
         id: deps-hash
         shell: bash
@@ -127,6 +137,8 @@ jobs:
           workspaces: "./ -> target"
           shared-key: release-${{ matrix.target }}-${{ steps.deps-hash.outputs.hash }}
           add-rust-environment-hash-key: false
+          # Release tags cannot reuse target caches across refs; sccache handles compiler outputs.
+          cache-targets: false
           cache-on-failure: true
 
       - name: Install Apple certificate (macOS)
@@ -184,6 +196,13 @@ jobs:
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SCCACHE_BUCKET: ${{ secrets.SCCACHE_S3_BUCKET }}
+          SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_S3_ENDPOINT }}
+          SCCACHE_REGION: ${{ secrets.SCCACHE_S3_REGION }}
+          SCCACHE_S3_KEY_PREFIX: ${{ secrets.SCCACHE_S3_KEY_PREFIX }}
+          SCCACHE_S3_USE_SSL: "true"
+          AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_ACCESS_KEY }}
           APPLE_SIGNING_IDENTITY: ${{ startsWith(matrix.platform, 'macos') && secrets.APPLE_SIGNING_IDENTITY || '' }}
           APPLE_ID: ${{ startsWith(matrix.platform, 'macos') && secrets.APPLE_ID || '' }}
           APPLE_PASSWORD: ${{ startsWith(matrix.platform, 'macos') && secrets.APPLE_PASSWORD || '' }}
@@ -196,6 +215,20 @@ jobs:
           prerelease: false
           args: --target ${{ matrix.target }}
 
+      - name: Show sccache stats
+        if: always()
+        continue-on-error: true
+        env:
+          SCCACHE_BUCKET: ${{ secrets.SCCACHE_S3_BUCKET }}
+          SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_S3_ENDPOINT }}
+          SCCACHE_REGION: ${{ secrets.SCCACHE_S3_REGION }}
+          SCCACHE_S3_KEY_PREFIX: ${{ secrets.SCCACHE_S3_KEY_PREFIX }}
+          SCCACHE_S3_USE_SSL: "true"
+          AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_ACCESS_KEY }}
+        shell: bash
+        run: ${SCCACHE_PATH} --show-stats
+
       - name: Upload Windows portable ZIP
         if: matrix.arch == 'x64' || matrix.arch == 'arm64'
         shell: pwsh