diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 9cef9df..598ac62 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -84,14 +84,7 @@ jobs:
           done
           [ "$ok" = "1" ] || { echo "::error::dependency install failed after 3 attempts" >&2; exit 1; }
 
-      - name: Save deps cache
-        uses: actions/cache@v4
-        continue-on-error: true
-        with:
-          path: |
-            node_modules
-            $HOME/.bun/install/cache
-          key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }}
+      # No explicit save step: caches marked by the restore steps are uploaded automatically at job end.
 
       - name: Build
         run: npm run build
@@ -102,6 +95,15 @@ jobs:
       # Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser
       # server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps
       # the job self-contained.
+      # Browser binaries (~187 MiB) cached across runs: the runner's uplink is flaky and
+      # cdn.playwright.dev downloads time out mid-transfer; once seeded, installs skip the download.
+      - name: Restore browser cache
+        uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: $HOME/.cache/ms-playwright
+          key: ${{ runner.os }}-pw-browsers-${{ hashFiles('package.json') }}
+
       - name: Install browsers (local)
         run: npx playwright install --with-deps chromium
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f72228a..b5d6691 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@
 - **CI e2e deploy command stays alive** (`E2E_DEPLOY_CMD` now ends with `docker compose … logs -f`): Playwright's webServer requires a long-running process — `up -d` returns immediately and triggered "Process from config.webServer exited early" (run #16); `logs -f` also streams app logs into CI output for debugging
 - **CI e2e step bypasses proxies for the in-network app host** (`NO_PROXY`/`no_proxy=app,localhost,127.0.0.1,.kkhost.pl`) and prints proxy/DNS/curl diagnostics before the suite — run #18 showed Chromium getting `ERR_SSL_PROTOCOL_ERROR` on http://app:3000 while node-side HTTP worked (9 API-only tests passed), pointing at a TLS-terminating proxy env var that Chromium honors but Node's HTTP client ignores
 - **CI e2e targets the app at a static in-network IP** (`172.39.0.10`, pinned subnet `172.39.0.0/24` created by "Prepare e2e network"; stale networks with other subnets are recreated) instead of the DNS alias — Chromium got `ERR_SSL_PROTOCOL_ERROR` via the hostname while node-side HTTP worked, so DNS is removed from the equation; post-deploy connectivity diagnostics added as a CI-gated globalSetup (`e2e/ci-diagnostics.ts`, no-op locally) comparing node resolution/HTTP against Chromium navigation on both hostname and static IP
+- **CI caches Playwright browser binaries across runs** (`$HOME/.cache/ms-playwright` via actions/cache): the flaky runner uplink makes the ~187 MiB Chrome-for-Testing download unreliable (runs #20/#21 died mid-download at "Install browsers"); also removed the no-op "Save deps cache" step — on this runner caches marked by a restore step are uploaded automatically at job end, so an explicit save never did anything
 - Verified: unit suite 234 green locally; e2e not run locally by design (would deploy to production) — first real pass happens in the PR's CI run
 
 ## v0.12.2 — 2026-09-18 14:06