diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml
index 2f22aff..f220c1f 100644
--- a/.github/workflows/desktop.yml
+++ b/.github/workflows/desktop.yml
@@ -40,11 +40,21 @@ jobs:
           node-version: '24'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
+      - name: Prepare Linux package cache
+        if: runner.os == 'Linux'
+        id: linux-cache
+        run: echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+      - name: Cache Linux package downloads
+        if: runner.os == 'Linux'
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/utm-adapter-apt/archives/*.deb
+          key: linux-native-ubuntu24.04-${{ runner.arch }}-${{ hashFiles('build/ci/install-linux-deps.sh') }}-${{ steps.linux-cache.outputs.week }}
+          restore-keys: |
+            linux-native-ubuntu24.04-${{ runner.arch }}-${{ hashFiles('build/ci/install-linux-deps.sh') }}-
       - name: Linux native dependencies
         if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential pkg-config libgtk-4-dev libwebkitgtk-6.0-dev libx11-dev
+        run: bash build/ci/install-linux-deps.sh
       - name: Install pinned Wails CLI
         run: go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.34
       - name: Backend tests and vet
diff --git a/README.md b/README.md
index d160949..28bdf8a 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,8 @@ The [Desktop binaries workflow](https://github.com/openutm/utm-adapter/actions/w
 
 The separate [Tests workflow](https://github.com/openutm/utm-adapter/actions/workflows/tests.yml) runs backend tests with the race detector, Go vet, and Svelte/TypeScript checks on pull requests and pushes to `main`. It does not package desktop binaries or upload artifacts.
 
+Linux CI installs only required native packages from Ubuntu's official HTTPS repositories and caches downloaded packages. APT still refreshes package indexes on every run; the cache is refreshed weekly or when the dependency script changes.
+
 Open a successful binary build run and download its **Artifacts** (GitHub sign-in required). Each contains an archive and SHA-256 checksum:
 
 | Artifact | Contents | Runtime requirements |
diff --git a/build/ci/install-linux-deps.sh b/build/ci/install-linux-deps.sh
new file mode 100644
index 0000000..2687e09
--- /dev/null
+++ b/build/ci/install-linux-deps.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${RUNNER_TEMP:?This script is intended for GitHub Actions runners}"
+
+# Keep the build's Ubuntu sources separate from runner and third-party sources.
+# The runner's HTTP Azure mirror downloaded at only 121 kB/s in our baseline.
+apt_dir="$RUNNER_TEMP/utm-adapter-apt"
+mkdir -p "$apt_dir/archives"
+cat > "$apt_dir/ubuntu.sources" <<'EOF'
+Types: deb
+URIs: https://archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+Types: deb
+URIs: https://security.ubuntu.com/ubuntu/
+Suites: noble-security
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+EOF
+
+apt_options=(
+  -o "Dir::Etc::sourcelist=$apt_dir/ubuntu.sources"
+  -o "Dir::Etc::sourceparts=-"
+  -o "Dir::Cache::archives=$apt_dir/archives"
+  -o "APT::Keep-Downloaded-Packages=true"
+)
+
+# Always refresh indexes and let APT validate cached archives against them.
+sudo apt-get "${apt_options[@]}" update
+sudo apt-get "${apt_options[@]}" install -y --no-install-recommends \
+  build-essential pkg-config libgtk-4-dev libwebkitgtk-6.0-dev libx11-dev