diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index 487aec30..09f66e19 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -28,7 +28,6 @@ on:
       - main
   merge_group:
     types: [checks_requested]
-  workflow_call:
 jobs:
   build:
     runs-on: ubuntu-24.04
@@ -39,12 +38,9 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v4.2.2
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-${{ matrix.config }}
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.workflow }}-${{ github.job }}-${{ matrix.config }}
 
       - name: Build with Bazel
         run: |
diff --git a/.github/workflows/build-qnx.yml b/.github/workflows/build-qnx.yml
index a8119eb3..fa37fb56 100644
--- a/.github/workflows/build-qnx.yml
+++ b/.github/workflows/build-qnx.yml
@@ -25,12 +25,10 @@ on:
     types: [opened, reopened, synchronize]
   merge_group:
     types: [checks_requested]
-  push:
-    branches:
-      - main
+  workflow_call:
 jobs:
   qnx-build:
-    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     permissions:
       contents: read
       pull-requests: read
@@ -42,7 +40,7 @@ jobs:
       bazel-config: ${{ matrix.config }}
       credential-helper: 'tools/qnx_credential_helper.py'
       environment-name: 'workflow-approval'
-      bazel-disk-cache: ${{ github.workflow }}-${{ github.job }}-${{ matrix.config }}
+      bazel-disk-cache: -${{ matrix.config }}
     secrets:
       score-qnx-license: ${{ secrets.SCORE_QNX_LICENSE }}
       score-qnx-user: ${{ secrets.SCORE_QNX_USER }}
diff --git a/.github/workflows/bzlmod-lock.yml b/.github/workflows/bzlmod-lock.yml
index a4700ef7..35634b32 100644
--- a/.github/workflows/bzlmod-lock.yml
+++ b/.github/workflows/bzlmod-lock.yml
@@ -33,6 +33,6 @@ on:
 
 jobs:
   bzlmod-lock:
-    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     with:
       working-directory: .
diff --git a/.github/workflows/cache_maintenance.yml b/.github/workflows/cache_maintenance.yml
new file mode 100644
index 00000000..3a81b91a
--- /dev/null
+++ b/.github/workflows/cache_maintenance.yml
@@ -0,0 +1,68 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Cache maintenance
+
+# Refreshes caches and rebuilds a new bazel repository cache when MODULE.bazel.lock changes.
+# Caches are only saved on pushes to the main branch or on workflow_dispatch events.
+# In merge_groups and pull requests a fast dry-run is executed to ensure inputs are valid and caches can be rebuilt successfully.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+  merge_group:
+    types: [checks_requested]
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  repository_cache_maintenance:
+    permissions:
+      actions: write # needed for cache deletion after cache refresh
+      contents: read
+    secrets:
+      score-qnx-license: ${{ secrets.SCORE_QNX_LICENSE }}
+      score-qnx-user: ${{ secrets.SCORE_QNX_USER }}
+      score-qnx-password: ${{ secrets.SCORE_QNX_PASSWORD }}
+    uses: eclipse-score/cicd-workflows/.github/workflows/cache-maintenance.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
+    with:
+      variants: |
+        //...
+        --config=x86_64-linux //...
+        --config=arm64-linux //...
+        --config=x86_64-qnx //score/... //examples/...
+        --config=arm64-qnx //score/... //examples/...
+
+  warmup-qnx:
+    needs: repository_cache_maintenance
+    # PR and merge-queue runs validate variants above but never warm or write
+    # shared caches.
+    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+    permissions:
+      contents: read
+      pull-requests: read
+    secrets: inherit
+    uses: ./.github/workflows/build-qnx.yml
+
+  delete_old_caches:
+    runs-on: ubuntu-24.04
+    needs:
+      - warmup-qnx
+    permissions:
+      actions: write # needed for deletion of old caches
+      contents: read
+    if: ${{ !cancelled() && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+    steps:
+      - name: Prune obsolete Bazel caches
+        uses: eclipse-score/cicd-actions/prune-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
diff --git a/.github/workflows/clang-tidy.yml b/.github/workflows/clang-tidy.yml
index 538f1b67..a5d1ac90 100644
--- a/.github/workflows/clang-tidy.yml
+++ b/.github/workflows/clang-tidy.yml
@@ -41,12 +41,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.workflow }}-${{ github.job }}
 
       - name: Run clang-tidy
         # continue-on-error is required: bazel exits non-zero when violations exist.
diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml
index dc24706d..049e5b14 100644
--- a/.github/workflows/code-coverage.yml
+++ b/.github/workflows/code-coverage.yml
@@ -30,7 +30,7 @@ on:
 
 jobs:
   code-coverage:
-    uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     with:
       bazel-target: "//score/..."
       bazel-config: "x86_64-linux"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7e9beb42..716df9cd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,12 +39,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-codeql
-          repository-cache: true
-          cache-save: true
+          unique-cache-name: ${{ github.workflow }}-${{ github.job }}
 
       - name: Run MISRA C++:2023 analysis
         run: |
diff --git a/.github/workflows/comp-tests.yml b/.github/workflows/comp-tests.yml
index 36f5e072..d8e373b4 100644
--- a/.github/workflows/comp-tests.yml
+++ b/.github/workflows/comp-tests.yml
@@ -31,7 +31,7 @@ on:
 
 jobs:
   run-comp-tests:
-    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/copyright.yml b/.github/workflows/copyright.yml
index ae44d53c..4a6a466a 100644
--- a/.github/workflows/copyright.yml
+++ b/.github/workflows/copyright.yml
@@ -27,4 +27,4 @@ on:
     types: [checks_requested]
 jobs:
   copyright-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
diff --git a/.github/workflows/docs-cleanup.yml b/.github/workflows/docs-cleanup.yml
index c134104c..fa0489f0 100644
--- a/.github/workflows/docs-cleanup.yml
+++ b/.github/workflows/docs-cleanup.yml
@@ -24,6 +24,6 @@ on:
 
 jobs:
   docs-cleanup:
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 3d7939ef..8e0f5b17 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,7 +30,7 @@ on:
 
 jobs:
   docs-verify:
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     permissions:
       pull-requests: write
       contents: read
@@ -39,7 +39,7 @@ jobs:
 
   docs-build:
     needs: docs-verify
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     permissions:
       contents: write
       pages: write
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 2a563e0f..a71691ae 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -40,12 +40,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-format-check
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.workflow }}-${{ github.job }}
 
       - name: Run format check
         run: bazel test //:format.check
diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml
index a3cf1833..5fda4e93 100644
--- a/.github/workflows/license-check.yml
+++ b/.github/workflows/license-check.yml
@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   license-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
     secrets:
diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml
index a3b0378c..b2020bab 100644
--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -42,12 +42,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-${{ matrix.config }}
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.workflow }}-${{ github.job }}-${{ matrix.config }}
 
       - name: Run tests with sanitizers
         # continue-on-error is required: bazel exits non-zero when tests fail.