diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 632dbf47..96b307db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,12 +28,14 @@ jobs:
       with:
         arguments: check -PslimTests
         gradle-home-cache-cleanup: true
+        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
 
     - name: Run Detekt
       uses: gradle/gradle-build-action@3fbe033aaae657f011f88f29be9e65ed26bd29ef # tag=v2.3.3
       with:
         arguments: detektMain
         gradle-home-cache-cleanup: true
+        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
 
     - name: (Fail-only) Upload test report
       if: failure()
@@ -66,6 +68,7 @@ jobs:
       with:
         arguments: collectReleaseApks
         gradle-home-cache-cleanup: true
+        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
 
     - name: Clean secrets
       run: scripts/signing-cleanup.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e400aed..02bc1a10 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,7 @@ jobs:
       with:
         arguments: collectReleaseBundle
         gradle-home-cache-cleanup: true
+        cache-read-only: true
 
     - name: Publish bundle to Google Play
       uses: r0adkll/upload-google-play@78c9e796b1035c94169c101d8e46cb880194bfc3 # tag=v1.0.19