diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cc433558..8894f3b5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -186,8 +186,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
-      # The self-hosted runner keeps its build directory and Cargo home instead.
-      - if: runner.environment == 'github-hosted'
+      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
+      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
+      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: repo-checks
@@ -227,8 +228,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
-      # The self-hosted runner keeps its build directory and Cargo home instead.
-      - if: runner.environment == 'github-hosted'
+      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
+      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
+      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: native-clippy
@@ -451,8 +453,9 @@ jobs:
         if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
         run: scripts/ci/warm-target.sh doc-tests
       - uses: dtolnay/rust-toolchain@stable
-      # The self-hosted runner keeps its build directory and Cargo home instead.
-      - if: runner.environment == 'github-hosted'
+      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
+      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
+      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: doc-tests
@@ -501,8 +504,9 @@ jobs:
         if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
         run: scripts/ci/warm-target.sh oracle
       - uses: dtolnay/rust-toolchain@stable
-      # The self-hosted runner keeps its build directory and Cargo home instead.
-      - if: runner.environment == 'github-hosted'
+      # The trusted self-hosted runners keep their build directory and Cargo home instead; the
+      # untrusted ones (fork pull requests) start empty and restore main's cache, read-only.
+      - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: oracle