diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b5f52563..0c6ec8ea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -732,6 +732,12 @@ jobs:
             VERSION=${{ steps.version.outputs.version }}
             REVISION=${{ steps.source.outputs.sha }}
             BUILD_TIME=${{ steps.version.outputs.build_time }}
+          # TEMPORARY: a cached rebuild replays the old apk/apt layer and would ship
+          # the vulnerable ca-certificates again. no-cache re-runs every step; pull re-resolves
+          # FROM, because no-cache alone leaves a base image that carries the bad package
+          # untouched. Revert once every repo has been rebuilt and redeployed. See #953.
+          no-cache: true
+          pull: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
           secrets: |
@@ -859,6 +865,12 @@ jobs:
             BUILD_TIME=${{ steps.version.outputs.build_time }}
           sbom: generator=docker/scout-sbom-indexer:latest
           provenance: mode=max
+          # TEMPORARY: a cached rebuild replays the old apk/apt layer and would ship
+          # the vulnerable ca-certificates again. no-cache re-runs every step; pull re-resolves
+          # FROM, because no-cache alone leaves a base image that carries the bad package
+          # untouched. Revert once every repo has been rebuilt and redeployed. See #953.
+          no-cache: true
+          pull: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
           secrets: |
diff --git a/src/build/docker-build-ts/action.yml b/src/build/docker-build-ts/action.yml
index 15c67a0a..ac2c547c 100644
--- a/src/build/docker-build-ts/action.yml
+++ b/src/build/docker-build-ts/action.yml
@@ -295,6 +295,12 @@ runs:
         push: true
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
+        # TEMPORARY: a cached rebuild replays the old apk/apt layer and would ship
+        # the vulnerable ca-certificates again. no-cache re-runs every step; pull re-resolves
+        # FROM, because no-cache alone leaves a base image that carries the bad package
+        # untouched. Revert once every repo has been rebuilt and redeployed. See #953.
+        no-cache: true
+        pull: true
         cache-from: type=gha
         cache-to: type=gha,mode=max
         secrets: ${{ steps.secrets.outputs.value }}