diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 1adc90236..a36ebb93d 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -45,7 +45,9 @@ jobs:
       - uses: actions/cache@v5
         with:
           path: ~/.cache/ccache
-          key: ccache-android
+          key: ccache-android-${{ github.sha }}
+          restore-keys: |
+            ccache-android-
       # necessary for newer versions of the Gradle plugin
       - uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 65c9612cd..6343818d2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -54,9 +54,11 @@ jobs:
       uses: actions/cache@v5
       with:
         path: ~/.cache/ccache
-        key: ccache-ubuntu-latest-gcc-codeql
+        key: ccache-ubuntu-latest-gcc-codeql-${{ github.sha }}
         restore-keys: |
-          ccache-ubuntu-latest-gcc-all
+          ccache-ubuntu-latest-gcc-codeql
+          ccache-ubuntu-latest-gcc-all-${{ github.sha }}
+          ccache-ubuntu-latest-gcc-all-
           ccache-ubuntu-latest-gcc-
     - if: matrix.language == 'cpp'
       run: |
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index bfe40eb0e..e2f64b46d 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -72,8 +72,9 @@ jobs:
           # builds and, similarly, builds with leak-detective only differ in two
           # files (LD itself and library.c); but different tests build different
           # dependencies, so different caches are needed
-          key: ccache-ubuntu-latest-${{ env.CC }}-${{ matrix.test }}
+          key: ccache-ubuntu-latest-${{ env.CC }}-${{ matrix.test }}-${{ github.sha }}
           restore-keys: |
+            ccache-ubuntu-latest-${{ env.CC }}-${{ matrix.test }}-
             ccache-ubuntu-latest-${{ env.CC }}-
       - run: |
           sudo apt-get install -qq ccache
@@ -129,9 +130,11 @@ jobs:
           path: |
             ~/.cache/ccache
             ~/.ccache
-          key: ccache-${{ matrix.os }}-${{ env.CC }}-${{ matrix.test }}
+          key: ccache-${{ matrix.os }}-${{ env.CC }}-${{ matrix.test }}-${{ github.sha }}
           restore-keys: |
-            ccache-${{ matrix.os }}-${{ env.CC }}-all
+            ccache-${{ matrix.os }}-${{ env.CC }}-${{ matrix.test }}-
+            ccache-${{ matrix.os }}-${{ env.CC }}-all-${{ github.sha }}
+            ccache-${{ matrix.os }}-${{ env.CC }}-all-
             ccache-${{ matrix.os }}-${{ env.CC }}-
       - run: |
           sudo apt-get install -qq ccache
@@ -180,8 +183,9 @@ jobs:
           path: |
             ~/.cache/ccache
             ~/.ccache
-          key: ccache-${{ matrix.os }}-${{ env.CC }}-${{ matrix.test }}
+          key: ccache-${{ matrix.os }}-${{ env.CC }}-${{ matrix.test }}-${{ github.sha }}
           restore-keys: |
+            ccache-${{ matrix.os }}-${{ env.CC }}-${{ matrix.test }}-
             ccache-${{ matrix.os }}-${{ env.CC }}-
       - run: |
           sudo apt-get install -qq ccache
@@ -214,7 +218,9 @@ jobs:
       - uses: actions/cache@v5
         with:
           path: ~/.cache/ccache
-          key: ccache-alpine
+          key: ccache-alpine-${{ github.sha }}
+          restore-keys: |
+            ccache-alpine-
       - run: ccache -z
       # don't use the default action as we don't want to build dependencies or install bash
       - run: ./scripts/test.sh deps
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 412c6b5d3..2bd155bfc 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -39,7 +39,9 @@ jobs:
       - uses: actions/cache@v5
         with:
           path: ~/Library/Caches/ccache
-          key: ccache-${{ runner.os }}
+          key: ccache-${{ runner.os }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-
       # workaround for conflict between Python installed in the image and via brew
       - run: find /usr/local/bin -lname '*/Library/Frameworks/Python.framework/*' -delete -print
       - run: |
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 9aa439838..47d9e8be2 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -37,7 +37,9 @@ jobs:
         with:
           path: |
             ~/.cache/ccache
-          key: ccache-sonarcloud
+          key: ccache-sonarcloud-${{ github.sha }}
+          restore-keys: |
+            ccache-sonarcloud-
       - run: |
           sudo apt-get install -qq ccache
           echo "PATH=/usr/lib/ccache:$PATH" >> $GITHUB_ENV
diff --git a/.github/workflows/tkm.yml b/.github/workflows/tkm.yml
index 0a6dcd032..c6be0af31 100644
--- a/.github/workflows/tkm.yml
+++ b/.github/workflows/tkm.yml
@@ -35,7 +35,9 @@ jobs:
       - uses: actions/cache@v5
         with:
           path: ${{ env.CCACHE_DIR }}
-          key: ccache-tkm
+          key: ccache-tkm-${{ github.sha }}
+          restore-keys: |
+            ccache-tkm-
       - name: Build Docker Image
         run: docker build -t strongswan-tkm -f testing/tkm/Dockerfile testing
       - name: Run Tests in Container
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index ae80bf56d..8adce49bd 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -42,7 +42,9 @@ jobs:
       - uses: actions/cache@v5
         with:
           path: ~/.cache/ccache
-          key: ccache-${{ runner.os }}-${{ matrix.test }}
+          key: ccache-${{ runner.os }}-${{ matrix.test }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-${{ matrix.test }}-
       - run: |
           sudo apt-get install -qq ccache
           echo "PATH=/usr/lib/ccache:$PATH" >> $GITHUB_ENV