diff --git a/ci/stage-node-image.py b/ci/stage-node-image.py
index b5b1b64..a4f098b 100644
--- a/ci/stage-node-image.py
+++ b/ci/stage-node-image.py
@@ -4,11 +4,13 @@
 from __future__ import annotations
 
 import argparse
+import os
 import shutil
 import subprocess
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
+FIXED_MTIME = 946684800  # 2000-01-01T00:00:00Z
 BACKEND = ROOT / "backend"
 STATIC_MSQUIC = ROOT / "packaging/native/msquic"
 IGNORED_PARTS = {".git", ".release", "artifacts", "bin", "obj", "TestResults", "tests"}
@@ -86,6 +88,14 @@ def stage(component: str, runtime_identifier: str, destination: Path) -> None:
     # 更新清单和请求放在这里；空的命名卷第一次挂载时会带上这个目录
     (config / "update").mkdir()
     (config / "update" / ".keep").write_text("", encoding="utf-8")
+    normalize_mtimes(destination / "restore")
+
+
+def normalize_mtimes(directory: Path) -> None:
+    """The Buildah layer cache keys COPY layers on file metadata as well as content. Files copied from a fresh checkout carry a new
+    mtime every run, so the restore layer (and the ~70 s of NuGet downloads under it) never hit the cache. Pin the mtimes."""
+    for path in [directory, *directory.rglob("*")]:
+        os.utime(path, (FIXED_MTIME, FIXED_MTIME))
 
 
 def main() -> None:
diff --git a/packaging/container/Agent.NativeBuild.Containerfile b/packaging/container/Agent.NativeBuild.Containerfile
index 8379d62..37ee5f1 100644
--- a/packaging/container/Agent.NativeBuild.Containerfile
+++ b/packaging/container/Agent.NativeBuild.Containerfile
@@ -29,7 +29,8 @@ RUN dotnet publish agent/src/MoShiro.Agent -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
     -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
     -p:UseAppHost=true -p:StripSymbols=true \
-    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll \
+    && rm -rf /artifacts
 RUN test -x /out/agent/moshiro-agent && test -x /out/enroll/fleet-enroll \
     && test "$(stat -c%s /out/agent/moshiro-agent)" -gt 2000000 \
     && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 \
diff --git a/packaging/container/Probe.NativeBuild.Containerfile b/packaging/container/Probe.NativeBuild.Containerfile
index 785eb70..1586904 100644
--- a/packaging/container/Probe.NativeBuild.Containerfile
+++ b/packaging/container/Probe.NativeBuild.Containerfile
@@ -29,7 +29,8 @@ RUN dotnet publish probe/src/MoShiro.Probe -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
     -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
     -p:UseAppHost=true -p:StripSymbols=true \
-    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll \
+    && rm -rf /artifacts
 RUN test -x /out/probe/moshiro-probe && test -x /out/enroll/fleet-enroll \
     && test "$(stat -c%s /out/probe/moshiro-probe)" -gt 2000000 \
     && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 \