diff --git a/.gitea/ci/Dockerfile b/.gitea/ci/Dockerfile
index 708a831..42503b3 100644
--- a/.gitea/ci/Dockerfile
+++ b/.gitea/ci/Dockerfile
@@ -16,8 +16,11 @@ FROM php:${PHP_VERSION}-cli-alpine
 # (actions/checkout, actions/cache, actions/upload-artifact) *inside* the job
 # container, and shells `run:` steps through bash.
 #
-# coreutils, gawk, grep and sed replace the busybox applets with the GNU ones
-# the workflow scripts are written against (`tac`, `grep --include`).
+# coreutils, gawk, grep, sed and tar replace the busybox applets with the GNU
+# ones the workflow scripts are written against (`tac`, `grep --include`).
+# tar is not optional: actions/cache shells out to `tar --posix -P`, which
+# busybox rejects outright, so every cache step fails without it. zstd is what
+# actions/cache prefers over gzip when it is present.
 #
 # jq, curl, git and zip/unzip are used by release.yml and bin/build-zip.sh.
 RUN apk add --no-cache \
@@ -30,8 +33,10 @@ RUN apk add --no-cache \
         jq \
         nodejs \
         sed \
+        tar \
         unzip \
         zip \
+        zstd \
         icu-libs \
         libzip \
  && apk add --no-cache --virtual .build-deps \
@@ -52,6 +57,7 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_HOME=/composer
 
 RUN mkdir -p "$COMPOSER_HOME" \
+ && tar --version | head -1 | grep -q 'GNU tar' \
  && php -v \
  && php -m | grep -qx intl \
  && php -m | grep -qx mbstring \
diff --git a/docs/ci.md b/docs/ci.md
index 1822194..2c97eef 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -30,8 +30,12 @@ inside the cluster replaces the whole thing (#187).
   (`actions/checkout`, `actions/cache`, `actions/upload-artifact`) *inside*
   the job container and shells `run:` steps through bash. Without these, the
   first step of every job fails.
-- **`coreutils`, `gawk`, `grep`, `sed`** — GNU versions, because the workflow
-  scripts use `tac` and `grep --include`, which busybox does not provide.
+- **`coreutils`, `gawk`, `grep`, `sed`, `tar`** — GNU versions, because the
+  workflow scripts use `tac` and `grep --include`, which busybox does not
+  provide. GNU `tar` matters most: `actions/cache` shells out to
+  `tar --posix -P`, and busybox rejects those flags, so every cache step fails
+  without it. `zstd` is what `actions/cache` reaches for over gzip when it is
+  installed.
 - **`curl`, `jq`, `git`, `zip`, `unzip`** — used by `release.yml` and
   `bin/build-zip.sh`.
 - **`intl` and `zip` PHP extensions**, plus Composer 2. `mbstring` is already