diff --git a/ci/cleanup-build-cache.sh b/ci/cleanup-build-cache.sh
index 8fb9818..0c7117e 100644
--- a/ci/cleanup-build-cache.sh
+++ b/ci/cleanup-build-cache.sh
@@ -24,4 +24,7 @@ for image in "${expired[@]}"; do
 done
 echo "expired build layers considered: ${#expired[@]} (retention: 7 days; NuGet cache retained)"
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-buildah unshare python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home
+# 旧的 Buildah 存储目录需要在 buildah unshare 里删（属主是映射后的 uid）；这台主机上 unshare 失败时（memfd_create 之类）只警告，下次再试，不影响调用方。
+if ! buildah unshare python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home; then
+  echo 'warning: retired Buildah stores were not cleaned (buildah unshare failed); the next run retries' >&2
+fi
diff --git a/ci/restore-linux-dependencies.sh b/ci/restore-linux-dependencies.sh
index 77e0b37..e7a8b5b 100644
--- a/ci/restore-linux-dependencies.sh
+++ b/ci/restore-linux-dependencies.sh
@@ -149,8 +149,9 @@ PY
   done
   flock -u 9
   agent_lock_held=false
+  # 清理只是尽力而为：依赖已经还原好了，清理失败（比如 buildah unshare 在这台主机上报 memfd_create 错误）不能让这一步失败
   if flock -n -x 9; then
-    bash "$root/ci/cleanup-build-cache.sh"
+    bash "$root/ci/cleanup-build-cache.sh" || echo 'warning: build cache cleanup failed' >&2
     flock -u 9
   fi
 fi
diff --git a/scripts/test-linux-agent-build.py b/scripts/test-linux-agent-build.py
index 95d639a..df9b949 100644
--- a/scripts/test-linux-agent-build.py
+++ b/scripts/test-linux-agent-build.py
@@ -129,6 +129,16 @@ esac
                         self.assertEqual((base / 'output/moshiro-agent').read_bytes(), b'agent')
                         self.assertEqual((base / 'output/fleet-enroll').read_bytes(), b'enroll')
 
+    def test_cache_cleanup_never_fails_the_step_that_called_it(self):
+        # 清理在调用方持锁之后才做，依赖已经还原或构建好了：它失败（比如 buildah unshare 报 memfd_create）只能是警告。
+        for script in ('ci/restore-linux-dependencies.sh', 'ci/build-linux-agent.sh'):
+            calls = [line for line in (ROOT / script).read_text().splitlines() if 'cleanup-build-cache.sh' in line and not line.lstrip().startswith('#')]
+            self.assertTrue(calls, script)
+            for line in calls:
+                self.assertIn('||', line, f'{script}: {line.strip()}')
+        cleanup = (ROOT / 'ci/cleanup-build-cache.sh').read_text()
+        self.assertIn('if ! buildah unshare python3', cleanup)
+
     def test_linux_packages_preserve_installers_and_shared_library_payloads(self):
         with tempfile.TemporaryDirectory() as directory:
             base = Path(directory)