diff --git a/.github/workflows/publish-eks-ami.yml b/.github/workflows/publish-eks-ami.yml
index 89b0d6483..f2c9600f9 100644
--- a/.github/workflows/publish-eks-ami.yml
+++ b/.github/workflows/publish-eks-ami.yml
@@ -26,7 +26,7 @@ concurrency:
 jobs:
   publish:
     name: Build + publish eks-node AMI
-    runs-on: ubuntu-24.04
+    runs-on: [ self-hosted, ci-single ]
 
     steps:
       - name: Checkout Spinifex
@@ -51,8 +51,12 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          cache-dependency-path: "spinifex/go.sum"
           go-version-file: "spinifex/go.mod"
+          # Self-hosted runner: the Go module + build cache already persists on
+          # local disk between runs. setup-go's cache-save ("Post Setup Go")
+          # otherwise re-uploads hundreds of MB to the Actions cache backend,
+          # taking longer than the build itself.
+          cache: false
 
       - name: Setup Go Workspace
         run: go work init ./spinifex ./viperblock ./predastore
diff --git a/scripts/build-system-image.sh b/scripts/build-system-image.sh
index 6da9c732d..80bbac487 100755
--- a/scripts/build-system-image.sh
+++ b/scripts/build-system-image.sh
@@ -26,10 +26,11 @@ PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 export LIBGUESTFS_BACKEND="${LIBGUESTFS_BACKEND:-direct}"
 
 usage() {
-    echo "Usage: $0 <manifest.conf> [--import]"
+    echo "Usage: $0 <manifest.conf> [--import] [--no-cache]"
     echo ""
     echo "  manifest.conf  Path to image manifest (see scripts/images/ for examples)"
     echo "  --import       Import the built image as an AMI"
+    echo "  --no-cache     Always rebuild; ignore a recently-built cached raw"
     exit 1
 }
 
@@ -47,10 +48,12 @@ fi
 
 DO_IMPORT=false
 QUIET=false
+NO_CACHE=false
 for arg in "$@"; do
     case "$arg" in
-        --import) DO_IMPORT=true ;;
-        --quiet)  QUIET=true ;;
+        --import)   DO_IMPORT=true ;;
+        --quiet)    QUIET=true ;;
+        --no-cache) NO_CACHE=true ;;
     esac
 done
 
@@ -184,7 +187,9 @@ echo "Lock acquired"
 
 # If the raw image was built recently (< 10 min), skip the entire build.
 # This avoids duplicate work when concurrent CI jobs build the same image.
-if [[ -f "$OUTPUT_RAW" ]] && [[ $(( $(date +%s) - $(stat -c %Y "$OUTPUT_RAW") )) -lt 600 ]]; then
+# --no-cache (e.g. the publish path) forces a fresh build so a stale raw from
+# a prior/concurrent run on a persistent runner is never republished.
+if [[ "$NO_CACHE" == false ]] && [[ -f "$OUTPUT_RAW" ]] && [[ $(( $(date +%s) - $(stat -c %Y "$OUTPUT_RAW") )) -lt 600 ]]; then
     echo "=== Skipping build — $OUTPUT_RAW is fresh (< 10 min old) ==="
 
     # Restore stdout if suppressed, then jump to import
diff --git a/scripts/publish-system-image.sh b/scripts/publish-system-image.sh
index 3a5c05df1..b2a684345 100755
--- a/scripts/publish-system-image.sh
+++ b/scripts/publish-system-image.sh
@@ -89,7 +89,9 @@ fi
 
 if [[ "$DO_BUILD" == true ]]; then
     echo "=== Building ${IMAGE_NAME} ==="
-    "${SCRIPT_DIR}/build-system-image.sh" "$MANIFEST"
+    # --no-cache: publishing must never reuse a stale raw left by a prior or
+    # concurrent build on a persistent runner.
+    "${SCRIPT_DIR}/build-system-image.sh" "$MANIFEST" --no-cache
 fi
 
 if [[ ! -f "$RAW_IMAGE" ]]; then