diff --git a/.github/workflows/automerge.yaml b/.github/workflows/automerge.yaml
index 14d76eca..6868f1b3 100644
--- a/.github/workflows/automerge.yaml
+++ b/.github/workflows/automerge.yaml
@@ -35,7 +35,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the build jobs save the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       # The merge has to come from the bot (or a PAT): a merge made with the
       # workflow's own token would not trigger the main build workflow.
       - name: Bot token
@@ -83,7 +83,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the build jobs save the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       # removing the label with this token doesn't start the unlabeled run above, so
       # turn auto-merge off here as well
       - name: Remove the automerge label
diff --git a/.github/workflows/bot.yaml b/.github/workflows/bot.yaml
index 12e0423d..18438903 100644
--- a/.github/workflows/bot.yaml
+++ b/.github/workflows/bot.yaml
@@ -74,6 +74,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       - id: plan
         env:
           GITHUB_TOKEN: ${{ github.token }}  # GitHub API: ros/rosdistro sync tags
@@ -134,7 +135,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the plan job saves the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       - name: robostack-bot ${{ matrix.command }} ${{ matrix.distro }}
         id: bot
         env:
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 0b70cfa4..b325e21a 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -88,8 +88,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          # one job saves the shared pixi environment cache (same key for all)
-          cache-write: ${{ matrix.distro == fromJSON(needs.plan.outputs.distros)[0] && matrix.platform == 'linux-64' }}
+          cache-write: false  # saved by pixi-cache.yaml
       - name: Generate and push the build branch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pixi-cache.yaml b/.github/workflows/pixi-cache.yaml
new file mode 100644
index 00000000..f1d5239b
--- /dev/null
+++ b/.github/workflows/pixi-cache.yaml
@@ -0,0 +1,32 @@
+# The pixi environment caches, saved from main only: pull requests restore them (a
+# pull request can read its base branch's caches) instead of each saving its own copy
+# for every lock file, which pushed the build caches out of the repository's 10 GB.
+name: pixi environment caches
+
+on:
+  push:
+    branches: [main]
+    paths: [pixi.toml, pixi.lock]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  save:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-15-intel, macos-15, windows-2022]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Disable git auto-maintenance
+        run: git config --global maintenance.auto false && git config --global gc.auto 0 && git config --global core.longpaths true
+      - uses: prefix-dev/setup-pixi@v0.11.0
+        with:
+          locked: true  # the lock file must match pixi.toml
+          pixi-version: v0.81.0
+          cache-write: true
diff --git a/.github/workflows/testpr.yaml b/.github/workflows/testpr.yaml
index 36644a32..a997b291 100644
--- a/.github/workflows/testpr.yaml
+++ b/.github/workflows/testpr.yaml
@@ -41,7 +41,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the build jobs save the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       - name: Which distributions changed
         id: plan
         env:
@@ -76,7 +76,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the build jobs save the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       - name: Sanity checks (every distribution assembles, generated files up to date, sorted)
         run: pixi run rs check
       - name: Unit tests of the tooling
@@ -109,7 +109,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the build jobs save the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       - name: Generate the recipes of every platform
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -171,9 +171,7 @@ jobs:
       with:
         locked: true  # the lock file must match pixi.toml
         pixi-version: v0.81.0
-        # every distribution's job on a platform has the same cache key; let one
-        # of them save it instead of all racing ("Unable to reserve cache")
-        cache-write: ${{ matrix.distro == fromJSON(needs.plan.outputs.distros)[0] }}
+        cache-write: false  # saved from main only (pixi-cache.yaml)
 
     - name: Windows workarounds (short build path, long paths, PATH and SDK clean-up)
       if: runner.os == 'Windows'
@@ -352,7 +350,7 @@ jobs:
         with:
           locked: true  # the lock file must match pixi.toml
           pixi-version: v0.81.0
-          cache-write: false  # the build jobs save the pixi environment cache
+          cache-write: false  # saved from main only (pixi-cache.yaml)
       - uses: actions/download-artifact@v7
         with:
           pattern: abi-check-*