diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 57ef6794d..cbe300f4c 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -34,10 +34,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-lint-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-lint-${{ env.PYTHON_VERSION }}-
+
             - name: Run lint via nox
               run: |
                   mkdir -p build
@@ -78,10 +86,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-typecheck-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-typecheck-${{ env.PYTHON_VERSION }}-
+
             - name: Run typecheck via nox
               run: |
                   mkdir -p build
@@ -116,10 +132,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-security-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-security-${{ env.PYTHON_VERSION }}-
+
             - name: Run security scan via nox
               run: |
                   mkdir -p build
@@ -160,10 +184,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-quality-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-quality-${{ env.PYTHON_VERSION }}-
+
             - name: Run complexity check via nox
               run: |
                   mkdir -p build
@@ -211,10 +243,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-unit-tests-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-unit-tests-${{ env.PYTHON_VERSION }}-
+
             - name: Run unit tests via nox
               run: |
                   mkdir -p build
@@ -262,10 +302,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-integration-tests-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-integration-tests-${{ env.PYTHON_VERSION }}-
+
             - name: Run integration tests via nox
               run: |
                   mkdir -p build
@@ -308,10 +356,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-e2e-tests-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-e2e-tests-${{ env.PYTHON_VERSION }}-
+
             - name: Run E2E tests via nox
               run: |
                   mkdir -p build
@@ -338,9 +394,11 @@ jobs:
         runs-on: docker
         container:
             image: ${{vars.docker_prefix}}python:3.13-slim
-        # unit_tests is included so coverage only runs after tests pass,
-        # preventing misleading results when tests are still in-flight or failing.
-        needs: [lint, typecheck, security, quality, unit_tests]
+        # Coverage runs the full unit-test suite independently under slipcover.
+        # It no longer waits for lint/typecheck/security/quality -- those jobs
+        # are independent static-analysis checks that do not affect test results.
+        # Removing the unnecessary dependency allows coverage to start immediately
+        # in parallel with all other jobs, cutting the critical path significantly.
         steps:
             - name: Install system dependencies (nodejs for checkout, git for merge tests)
               run: |
@@ -356,10 +414,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-coverage-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-coverage-${{ env.PYTHON_VERSION }}-
+
             - name: Run coverage report via nox (fail-under 97%)
               id: coverage
               run: |
@@ -430,10 +496,18 @@ jobs:
               uses: actions/cache@v3
               with:
                   path: ~/.cache/uv
-                  key: uv-${{ hashFiles('pyproject.toml') }}
+                  key: uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
                   restore-keys: |
                       uv-
 
+            - name: Cache nox virtualenvs
+              uses: actions/cache@v3
+              with:
+                  path: .nox
+                  key: nox-build-${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+                  restore-keys: |
+                      nox-build-${{ env.PYTHON_VERSION }}-
+
             - name: Build wheel via nox
               run: |
                   nox -s build
@@ -441,7 +515,10 @@ jobs:
                   NOX_DEFAULT_VENV_BACKEND: uv
 
     docker:
-        needs: [lint, typecheck, security, quality, unit_tests]
+        # Only gate on unit_tests -- the most critical functional check.
+        # lint/typecheck/security/quality run in parallel and are not
+        # prerequisites for a successful Docker image build.
+        needs: [unit_tests]
         runs-on: docker
         container:
             image: ${{vars.docker_prefix}}docker:dind