diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 541aa01e1..ef274a718 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -65,13 +65,23 @@ jobs:
           java-version: 21
           cache: gradle
 
-      # `-PskipVlcSetup=true` disables the vlcDownload / upxDownload / vlcSetup
-      # tasks (see desktopApp/build.gradle.kts). PR CI artifacts are smoke-test
-      # only — get.videolan.org is too flaky from GitHub-hosted runners to gate
-      # PRs on. Release packaging (create-release.yml) deliberately omits this
-      # flag so shipped artifacts still bundle VLC.
+      # Cache vlc-setup plugin downloads (VLC + UPX archives) keyed on the
+      # versions pinned in desktopApp/build.gradle.kts. Each OS gets its own
+      # cache namespace because the plugin downloads platform-specific archives.
+      # On a hit the vlcDownload / upxDownload tasks are up-to-date and we
+      # never touch get.videolan.org; on a miss (version bump or new runner)
+      # we fall back to fetching, which is what the in-build retry budget
+      # exists for.
+      - name: Cache vlc-setup downloads
+        uses: actions/cache@v4
+        with:
+          path: ~/.gradle/vlcSetup
+          key: vlcsetup-${{ runner.os }}-${{ hashFiles('desktopApp/build.gradle.kts') }}
+          restore-keys: |
+            vlcsetup-${{ runner.os }}-
+
       - name: Test + Build Desktop (gradle)
-        run: ./gradlew :quartz:jvmTest :commons:jvmTest :nestsClient:jvmTest :cli:test :desktopApp:test :desktopApp:${{ matrix.desktop-task }} --no-daemon -PskipVlcSetup=true
+        run: ./gradlew :quartz:jvmTest :commons:jvmTest :nestsClient:jvmTest :cli:test :desktopApp:test :desktopApp:${{ matrix.desktop-task }} --no-daemon
 
       # jpackage pins libicu to the build host's version (libicu74 on
       # ubuntu-24.04). Rewrite the .deb so testers on other Debian/Ubuntu