diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0f554fe1f7..7f442b1ea8 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -24,6 +24,11 @@ jobs:
       tools: ${{ steps.collect.outputs.tools }}
     steps:
 
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
     - name: Install uniget
       uses: uniget-org/uniget-action@v1
       with:
@@ -56,7 +61,44 @@ jobs:
             | helper/usr/local/bin/jq --slurp --compact-output '.'
         )"
         echo "    JSON: ${TOOLS_JSON}"
+
+        TOOLS_JSON_LEN="$(
+            echo -n "${TOOLS}" \
+            | jq 'length'
+        )"
+        echo "    TOOLS_JSON_LEN=${TOOLS_JSON_LEN}"
+
+        if test "${TOOLS_JSON_LEN}" -ge 256; then
+            echo "### Too many tools to process: ${TOOLS_JSON_LEN}."
+            echo "### Fallback to last commit"
+
+            TOOLS="$(
+                git log -1 --pretty=format: --name-only --diff-filter=d \
+                | grep ^tools/ \
+                | cut -d/ -f2 \
+                | sort \
+                | uniq \
+                | xargs echo
+            )"
+            echo "### Got tools=${TOOLS}."
+            
+            TOOLS_JSON="$(
+                echo -n "${TOOLS}" \
+                | tr ' ' '\n' \
+                | helper/usr/local/bin/jq --raw-input '.' \
+                | helper/usr/local/bin/jq --slurp --compact-output '.'
+            )"
+            echo "    JSON: ${TOOLS_JSON}"
+
+            TOOLS_JSON_LEN="$(
+                echo -n "${TOOLS}" \
+                | jq 'length'
+            )"
+            echo "    TOOLS_JSON_LEN=${TOOLS_JSON_LEN}"
+        fi
+
         echo "tools=${TOOLS_JSON}" >>"${GITHUB_OUTPUT}"
+        echo "tools_len=${TOOLS_JSON_LEN}" >>"${GITHUB_OUTPUT}"
 
   build:
     name: Build container image
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index d1ef196294..1a2ac74b9c 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -66,7 +66,7 @@ jobs:
             CHANGED_TOOLS="$(
                 git log --pretty=format: --name-only --diff-filter=d ${OLD_COMMIT_SHA}..${GITHUB_SHA} \
                 | sort \
-                | grep -E "^tools/[^/]+/" \
+                | grep "^tools/" \
                 | cut -d/ -f2 \
                 | uniq \
                 | while read -r TOOL; do test -d "tools/${TOOL}" && echo "${TOOL}"; done \
diff --git a/@template/Dockerfile.template b/@template/Dockerfile.template
index 6d22fc07d0..5a71ee1f54 100644
--- a/@template/Dockerfile.template
+++ b/@template/Dockerfile.template
@@ -18,7 +18,7 @@ ARG name
 ARG version
 
 # tarball
-#RUN <<EOF
+#RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 #echo "### Setting architecture string for ${TARGETPLATFORM}"
 #case "${arch}" in
 #    x86_64)
@@ -34,14 +34,20 @@ ARG version
 #esac
 #echo "    Using ${arch_suffix}"
 #
-#check-github-release-asset "foo/bar" "v${version}" "foo-${version}-linux-amd64.tar.gz"
-#check-download ""
-#curl --silent --show-error --location --fail "" \
-#| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+#url=""
+#filename="$( basename "${url}" )"
+#
+#check-download "${url}"
+#check-github-release-asset "foo/bar" "v${version}" "${filename}"
+#curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+#    "${url}"
+#
+#tar --file="${uniget_cache_download}/${filename}" --list
+#tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 #EOF
 
 # executable
-#RUN <<EOF
+#RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 #echo "### Setting architecture string for ${TARGETPLATFORM}"
 #case "${arch}" in
 #    x86_64)
@@ -57,15 +63,21 @@ ARG version
 #esac
 #echo "    Using ${arch_suffix}"
 #
-#check-github-release-asset "foo/bar" "v${version}" "foo-${version}-linux-amd64.tar.gz"
-#check-download ""
-#curl --silent --show-error --location --fail --output "${prefix}/bin/foo" \
-#    ""
-#chmod +x "${prefix}/bin/foo"
+#url=""
+#filename="$( basename "${url}" )"
+#
+#check-download "${url}"
+#check-github-release-asset "foo/bar" "v${version}" "${filename}"
+#curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+#    "${url}"
+#
+#install --mode=0755 \
+#    "${uniget_cache_download}/${filename}" \
+#    "${prefix}/bin/foo"
 #EOF
 
 # zip
-#RUN <<EOF
+#RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 #echo "### Setting architecture string for ${TARGETPLATFORM}"
 #case "${arch}" in
 #    x86_64)
@@ -81,19 +93,33 @@ ARG version
 #esac
 #echo "    Using ${arch_suffix}"
 #
-#check-github-release-asset "foo/bar" "v${version}" "foo-${version}-linux-amd64.tar.gz"
-#check-download ""
 #url=""
 #filename="$(basename "${url}")"
-#curl --silent --show-error --location --fail --remote-name "${url}"
-#unzip -q -o -d "${prefix}/bin" "${filename}"
+#
+#check-download "${url}"
+#check-github-release-asset "foo/bar" "v${version}" "${filename}"
+#curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+#    "${url}"
+#
+#unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 #EOF
 
 # go
+#RUN --mount=type=cache,target=/var/cache/apt <<EOF
+#apt-get update
+#apt-get -y install --no-install-recommends \
+#    foo
+#EOF
+#RUN --mount=type=cache,target=/var/cache/apk <<EOF
+#apk add --update-cache \
+#    foo
+#EOF
 #COPY --link --from=go / /usr/local/
 #COPY --link --from=make / /usr/local/
 #WORKDIR /go/src/github.com/foo/bar
-#RUN <<EOF
+#ARG name
+#ARG version
+#RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 #check-clone "https://github.com/foo/bar" "v${version}"
 #git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/foo/bar .
 #make
@@ -103,7 +129,7 @@ ARG version
 # rust
 #COPY --link --from=rust / /usr/local/
 #WORKDIR /tmp/github.com/foo/bar
-#RUN <<EOF
+#RUN <<EOF # no download cache
 #git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/foo/bar .
 #export CARGO_HOME=/usr/local/cargo
 #export RUSTUP_HOME=/usr/local/rustup
@@ -115,14 +141,7 @@ ARG version
 # python
 #COPY --link --from=python / /usr/local/
 #COPY --link --from=shiv / /usr/local/
-#RUN <<EOF
-#apt-get update
-#apt-get -y install --no-install-recommends \
-#    python3-pip \
-#    python3-venv \
-#    python-is-python3
-#EOF
-#RUN <<EOF
+#RUN --mount=type=cache,target=/root/.cache/pip <<EOF # no download cache
 #shiv --output-file "${prefix}/bin/foo" --console-script foo "foo==${version}"
 #EOF
 
@@ -132,7 +151,7 @@ ARG version
 #WORKDIR /uniget_bootstrap/libexec/foo
 #ARG name
 #ARG version
-#RUN <<EOF
+#RUN <<EOF # no download cache
 #npm install \
 #    --omit=dev \
 #    "foo@${version}"
@@ -140,9 +159,18 @@ ARG version
 #EOF
 
 # c
+#RUN --mount=type=cache,target=/var/cache/apt <<EOF
+#apt-get update
+#apt-get -y install --no-install-recommends \
+#    foo
+#EOF
+#RUN --mount=type=cache,target=/var/cache/apk <<EOF
+#apk add --update-cache \
+#    foo
+#EOF
 #COPY --link --from=make / /usr/local/
 #WORKDIR /tmp/foo
-#RUN <<EOF
+#RUN <<EOF # no download cache
 #git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/foo/bar .
 #./configure --prefix="${prefix}"
 #make LDFLAGS=-static
@@ -150,12 +178,12 @@ ARG version
 #EOF
 
 # dummy for testing
-#RUN <<EOF
+#RUN <<EOF # no download cache
 #touch "${prefix}/foo"
 #EOF
 
 # completion
-#RUN <<EOF
+#RUN <<EOF # no download cache
 #"${prefix}/bin/foo" completion bash >"${prefix}/share/bash-completion/completions/foo"
 #"${prefix}/bin/foo" completion fish >"${prefix}/share/fish/vendor_completions.d/foo.fish"
 #"${prefix}/bin/foo" completion zsh >"${prefix}/share/zsh/vendor-completions/_foo"
diff --git a/renovate.json b/renovate.json
index cd289e7452..39e66cf287 100644
--- a/renovate.json
+++ b/renovate.json
@@ -354,7 +354,7 @@
     {
       "customType": "regex",
       "datasourceTemplate": "github-releases",
-      "depNameTemplate": "foo/bar",
+      "depNameTemplate": "warpstreamlabs/bento",
       "extractVersionTemplate": "^v(?<version>.+)$",
       "fileMatch": [
         "^tools/bento/manifest.yaml$"
diff --git a/scripts/rebuild-all.sh b/scripts/rebuild-all.sh
new file mode 100644
index 0000000000..8d9c31c31d
--- /dev/null
+++ b/scripts/rebuild-all.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+set -o errexit
+
+if test -z "${GITHUB_TOKEN}"; then
+    echo "ERROR: GITHUB_TOKEN is not set"
+    exit 1
+fi
+: "${ref:=main}"
+: "${workflow:=rebuild.yml}"
+: "${repository:=uniget-org/tools}"
+: "${batch_size:=100}"
+
+function dispatch() {
+    local repository="${1}"
+    local ref="${2}"
+    local workflow="${3}"
+    local tools="${4}"
+    local dryrun="${5:-false}"
+
+    CURL="curl"
+    if test -n "${dryrun}" && test "${dryrun}" == "true"; then
+        CURL="echo curl"
+    fi
+
+    ${CURL} --silent --show-error --location --fail \
+        --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+        --url "https://api.github.com/repos/${repository}/actions/workflows/${workflow}/dispatches" \
+        --data "{\"ref\": \"${ref}\", \"inputs\": {\"tool\": \"$(echo "${tools}" | xargs echo)\"}}"
+}
+
+make metadata.json
+
+TOOLS_DEPS="$(
+    jq --raw-output '.tools[] | select(.build_dependencies != null) | .build_dependencies[]' <metadata.json \
+    | sort \
+    | uniq
+)"
+dispatch "${repository}" "${ref}" "${workflow}" "${TOOLS_DEPS}"
+TOOLS_DEPS_REGEX_OR="$(
+    echo "${TOOLS_DEPS}" \
+    | jq --raw-input --raw-output '[inputs] | join("|")'
+)"
+
+TOOLS="$(
+    jq --raw-output '.tools[].name' <metadata.json \
+    | sort \
+    | grep -E -v "(${TOOLS_DEPS_REGEX_OR})"
+)"
+SHUFFLED_TOOLS="$(
+    echo "${TOOLS}" | shuf
+)"
+TOOLS_COUNT="$(echo "${TOOLS}" | wc -l)"
+
+start_index=1
+end_index="${TOOLS_COUNT}"
+echo "### Processing ${TOOLS_COUNT} tools"
+while test "${start_index}" -lt "${end_index}"; do
+    echo "### Starting at ${start_index}"
+    NEXT_TOOLS="$(
+        echo "${SHUFFLED_TOOLS}" | tail -n +$(( start_index + 1 )) | head -n "${batch_size}"
+    )"
+
+    dispatch "${repository}" "${ref}" "${workflow}" "${NEXT_TOOLS}" true
+
+    start_index=$(( start_index + 100 ))
+done
diff --git a/scripts/rewrite-add-download-cache.sh b/scripts/rewrite-add-download-cache.sh
new file mode 100644
index 0000000000..d042e12d96
--- /dev/null
+++ b/scripts/rewrite-add-download-cache.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+set -o errexit
+
+find tools -type f -name Dockerfile.template \
+| sort \
+| while read -r FILENAME; do
+
+    if grep -P -z -q 'RUN <<EOF # no download cache\n' "${FILENAME}"; then
+        #echo "Ignoring ${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\nnpm install ' "${FILENAME}"; then
+        #echo "Ignoring ${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\nshiv ' "${FILENAME}"; then
+        #echo "Ignoring ${FILENAME}"
+        continue
+    fi
+
+    if grep -q "^unzip -q " "${FILENAME}"; then
+        sed -E -z -i 's@RUN <<EOF\ncheck-github-release-asset "([^"]+)" "([^"]+)" "([^"]+)"\n\n?url="([^"]+)"\nfilename=".+"\ncurl --silent --show-error --location --fail --remote-name "([^"]+)"\nunzip -q -o -d "([^"]+)" "([^"]+)"@RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\nurl="\4"\nfilename="$( basename "${url}" )"\n\ncheck-github-release-asset "\1" "\2" "${filename}"\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n\nunzip -t "${uniget_cache_download}/${filename}"\nunzip -q -o -d "\6" "${uniget_cache_download}/${filename}"@' "${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\ncurl ' "${FILENAME}"; then
+        echo "Missing handler ${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\ngit clone ' "${FILENAME}"; then
+        #sed -E -z -i 's@RUN <<EOF\ngit clone -q --config advice.detachedHead=false --depth 1 --branch "([^"]+)" https://github.com/([^ ]+) .@RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\nurl="https://github.com/\2/archive/refs/tags/\1.tar.gz"\nfilename="$( basename "${url}" )"\n\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n@' "${FILENAME}"
+        #echo "Ignoring ${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\ncheck-github-release-asset "[^"]+" "[^"]+" "[^"]+"\n\n?curl --silent --show-error --location --fail "[^"]+" \\\n| tar' "${FILENAME}"; then
+        sed -E -z -i 's@RUN <<EOF\ncheck-github-release-asset "([^"]+)" "([^"]+)" "([^"]+)"\n\n?curl --silent --show-error --location --fail "([^"]+)" \\\n\| tar @RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\nurl="\4"\nfilename="$( basename "${url}" )"\n\ncheck-github-release-asset "\1" "\2" "${filename}"\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n\ntar --file "${uniget_cache_download}/${filename}" --list\ntar --file "${uniget_cache_download}/${filename}" @' "${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\ncheck-github-release-asset "[^"]+" "[^"]+" "[^"]+"\n\n?curl --silent --show-error --location --fail --output "[^"]+" \\\n\s+"[^"]+"' "${FILENAME}"; then
+        sed -E -z -i 's@RUN <<EOF\ncheck-github-release-asset "([^"]+)" "([^"]+)" "([^"]+)"\n\n?curl --silent --show-error --location --fail --output "([^"]+)" \\\n\s+"([^"]+)"\nchmod \+x "([^"]+)"@RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\nurl="\5"\nfilename="$( basename "${url}" )"\n\ncheck-github-release-asset "\1" "\2" "${filename}"\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n\ninstall --mode=0755 \\\n    "${uniget_cache_download}/${filename}" \\\n    "\6"\n@' "${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\ncheck-github-release-asset "[^"]+" "[^"]+" "[^"]+"\n' "${FILENAME}"; then
+        sed -E -z -i 's@RUN <<EOF\ncheck-github-release-asset "([^"]+)" "([^"]+)" "([^"]+)"\n@RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\ncheck-github-release-asset "\1" "\2" "\3"\n@' "${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\ncheck-download "[^"]+"\n\n?curl --silent --show-error --location --fail --output "[^"]+" \\\n\s+"[^"]+"' "${FILENAME}"; then
+        sed -E -z -i 's@RUN <<EOF\ncheck-download "([^"]+)"\n\n?curl --silent --show-error --location --fail --output "([^"]+)" \\\n\s+"([^"]+)"\nchmod \+x "([^"]+)"@RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\nurl="\1"\nfilename="$( basename "${url}" )"\n\ncheck-download "${url}"\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n\ninstall --mode=0755 \\\n    "${uniget_cache_download}/${filename}" \\\n    "\4"\n@' "${FILENAME}"
+        continue
+    fi
+
+    if grep -P -z -q 'RUN <<EOF\necho "### Setting' "${FILENAME}" && grep -P -z -q 'check-github-release-asset' "${FILENAME}"; then
+        sed -E -z -i 's@echo "### Downloading [^"]+"\n@@; s@RUN <<EOF\n@RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF\n@; s@check-github-release-asset "([^"]+)" "([^"]+)" "([^"]+)"\n\n?curl --silent --show-error --location --fail "([^"]+)" \\\n\| tar @url="\4"\nfilename="$( basename "${url}" )"\n\ncheck-github-release-asset "\1" "\2" "${filename}"\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n\ntar --file "${uniget_cache_download}/${filename}" --list\ntar --file "${uniget_cache_download}/${filename}" @; s@check-github-release-asset "([^"]+)" "([^"]+)" "([^"]+)"\n\n?curl --silent --show-error --location --fail --output "([^"]+)" \\\n\s+"([^"]+)"\nchmod \+x "([^"]+)"@url="\5"\nfilename="$( basename "${url}" )"\n\ncheck-github-release-asset "\1" "\2" "${filename}"\ncurl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \\\n    "${url}"\n\ninstall --mode=0755 \\\n    "${uniget_cache_download}/${filename}" \\\n    "\6"\n@' "${FILENAME}"
+        continue
+    fi
+
+    if grep -q "RUN <<EOF" "${FILENAME}"; then
+        echo "Unhandled ${FILENAME}"
+    fi
+
+done
diff --git a/tools/acorn/Dockerfile.template b/tools/acorn/Dockerfile.template
index af13754c05..82a8ef6754 100644
--- a/tools/acorn/Dockerfile.template
+++ b/tools/acorn/Dockerfile.template
@@ -7,11 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "acorn-io/runtime" "v${version}" "acorn-v${version}-linux-${alt_arch}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/acorn-io/runtime/releases/download/v${version}/acorn-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-curl --silent --show-error --location --fail "https://github.com/acorn-io/runtime/releases/download/v${version}/acorn-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "acorn-io/runtime" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     acorn
 
 "${prefix}/bin/acorn" completion bash >"${prefix}/share/bash-completion/completions/acorn"
diff --git a/tools/acr/Dockerfile.template b/tools/acr/Dockerfile.template
index 3f73f329d8..d7f01e7f1b 100644
--- a/tools/acr/Dockerfile.template
+++ b/tools/acr/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/Azure/acr-cli
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/Azure/acr-cli .
 make -j$(nproc) binaries GO_LDFLAGS="-ldflags '-s -w -linkmode external -extldflags -static'"
 cp bin/acr "${prefix}/bin/"
diff --git a/tools/act/Dockerfile.template b/tools/act/Dockerfile.template
index 562335f926..5a58f346f1 100644
--- a/tools/act/Dockerfile.template
+++ b/tools/act/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "nektos/act" "v${version}" "act_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/nektos/act/releases/download/v${version}/act_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/nektos/act/releases/download/v${version}/act_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "nektos/act" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     act
 EOF
\ No newline at end of file
diff --git a/tools/actions-runner/Dockerfile.template b/tools/actions-runner/Dockerfile.template
index a01bf8eda7..d039155a1f 100644
--- a/tools/actions-runner/Dockerfile.template
+++ b/tools/actions-runner/Dockerfile.template
@@ -8,7 +8,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /uniget_bootstrap/opt/actions-runner
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -24,9 +24,13 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "actions/runner" "v${version}" "actions-runner-linux-${arch_suffix}-${version}.tar.gz"
+url="https://github.com/actions/runner/releases/download/v${version}/actions-runner-linux-${arch_suffix}-${version}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading actions-runner ${version}"
-curl --silent --show-error --location --fail "https://github.com/actions/runner/releases/download/v${version}/actions-runner-linux-${arch_suffix}-${version}.tar.gz" \
-| tar --extract --gzip --no-same-owner
+check-github-release-asset "actions/runner" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/actions-usage/Dockerfile.template b/tools/actions-usage/Dockerfile.template
index bc45717959..f85a8cb0b3 100644
--- a/tools/actions-usage/Dockerfile.template
+++ b/tools/actions-usage/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "self-actuated/actions-usage" "v${version}" "actions-usage${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/actions-usage" \
-    "https://github.com/self-actuated/actions-usage/releases/download/v${version}/actions-usage${arch_suffix}"
-chmod +x "${prefix}/bin/actions-usage"
+url="https://github.com/self-actuated/actions-usage/releases/download/v${version}/actions-usage${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "self-actuated/actions-usage" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/actions-usage"
+
 EOF
\ No newline at end of file
diff --git a/tools/age/Dockerfile.template b/tools/age/Dockerfile.template
index 587f3e7864..5d96c17e94 100644
--- a/tools/age/Dockerfile.template
+++ b/tools/age/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "FiloSottile/age" "v${version}" "age-v${version}-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/FiloSottile/age/releases/download/v${version}/age-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/FiloSottile/age/releases/download/v${version}/age-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "FiloSottile/age" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     age/age \
     age/age-keygen
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/age.1" \
diff --git a/tools/ah/Dockerfile.template b/tools/ah/Dockerfile.template
index ff27d4436f..1ebadaaf83 100644
--- a/tools/ah/Dockerfile.template
+++ b/tools/ah/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "artifacthub/hub" "v${version}" "ah_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/artifacthub/hub/releases/download/v${version}/ah_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/artifacthub/hub/releases/download/v${version}/ah_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "artifacthub/hub" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ah
 EOF
\ No newline at end of file
diff --git a/tools/aiac/Dockerfile.template b/tools/aiac/Dockerfile.template
index 8180c9fba5..5513076d39 100644
--- a/tools/aiac/Dockerfile.template
+++ b/tools/aiac/Dockerfile.template
@@ -8,8 +8,14 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG TARGETPLATFORM
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gofireflyio/aiac" "v${version}" "aiac_${version}_linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gofireflyio/aiac/releases/download/v${version}/aiac_${version}_linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gofireflyio/aiac/releases/download/v${version}/aiac_${version}_linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gofireflyio/aiac" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/air/Dockerfile.template b/tools/air/Dockerfile.template
index b499cbce9b..71c3611bf0 100644
--- a/tools/air/Dockerfile.template
+++ b/tools/air/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "air-verse/air" "v${version}" "air_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/air-verse/air/releases/download/v${version}/air_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/air-verse/air/releases/download/v${version}/air_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "air-verse/air" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/alertmanager/Dockerfile.template b/tools/alertmanager/Dockerfile.template
index babec001df..69c25b59c3 100644
--- a/tools/alertmanager/Dockerfile.template
+++ b/tools/alertmanager/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus/alertmanager" "v${version}" "alertmanager-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus/alertmanager/releases/download/v${version}/alertmanager-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus/alertmanager/releases/download/v${version}/alertmanager-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus/alertmanager" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "alertmanager-${version}.linux-${alt_arch}/alertmanager" \
     "alertmanager-${version}.linux-${alt_arch}/amtool"
 EOF
\ No newline at end of file
diff --git a/tools/alex/Dockerfile.template b/tools/alex/Dockerfile.template
index 04d364200c..a1411a7bc7 100644
--- a/tools/alex/Dockerfile.template
+++ b/tools/alex/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/alex
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "alex@${version}"
diff --git a/tools/ansi/Dockerfile.template b/tools/ansi/Dockerfile.template
index c6a9c272e2..eefeeb4a06 100644
--- a/tools/ansi/Dockerfile.template
+++ b/tools/ansi/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/fidian/ansi/raw/${version}/ansi"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-download "https://github.com/fidian/ansi/raw/${version}/ansi"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ansi"
 
-curl --silent --show-error --location --fail --output "${prefix}/bin/ansi" \
-    "https://github.com/fidian/ansi/raw/${version}/ansi"
-chmod +x "${prefix}/bin/ansi"
 EOF
\ No newline at end of file
diff --git a/tools/apk/Dockerfile.template b/tools/apk/Dockerfile.template
index 6db3b0066d..da1f86c04e 100644
--- a/tools/apk/Dockerfile.template
+++ b/tools/apk/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic//v${version}/${arch}/apk.static"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic//v${version}/${arch}/apk.static"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/apk"
 
-curl --silent --show-error --location --fail --output "${prefix}/bin/apk" \
-    "https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic//v${version}/${arch}/apk.static"
-chmod +x "${prefix}/bin/apk"
 EOF
\ No newline at end of file
diff --git a/tools/apko/Dockerfile.template b/tools/apko/Dockerfile.template
index 68f935178d..171d928c2e 100644
--- a/tools/apko/Dockerfile.template
+++ b/tools/apko/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/chainguard-dev/apko
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://github.com/chainguard-dev/apko" "v${version}"
 
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/chainguard-dev/apko .
diff --git a/tools/aqua/Dockerfile.template b/tools/aqua/Dockerfile.template
index aab5af72c4..ffc231fda0 100644
--- a/tools/aqua/Dockerfile.template
+++ b/tools/aqua/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "aquaproj/aqua" "v${version}" "aqua_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/aquaproj/aqua/releases/download/v${version}/aqua_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/aquaproj/aqua/releases/download/v${version}/aqua_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "aquaproj/aqua" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     aqua
 "${prefix}/bin/aqua" completion bash >"${prefix}/share/bash-completion/completions/aqua"
 "${prefix}/bin/aqua" completion zsh >"${prefix}/share/zsh/vendor-completions/_aqua"
diff --git a/tools/argo/Dockerfile.template b/tools/argo/Dockerfile.template
index 7f578d5580..3a65a47e4f 100644
--- a/tools/argo/Dockerfile.template
+++ b/tools/argo/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "argoproj/argo-workflows" "v${version}" "argo-linux-${alt_arch}.gz"
 curl --silent --show-error --location --fail "https://github.com/argoproj/argo-workflows/releases/download/v${version}/argo-linux-${alt_arch}.gz" \
 | gunzip \
diff --git a/tools/argocd/Dockerfile.template b/tools/argocd/Dockerfile.template
index 6026ca7244..7d213e1deb 100644
--- a/tools/argocd/Dockerfile.template
+++ b/tools/argocd/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "argoproj/argo-cd" "v${version}" "argocd-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/argocd" \
-    "https://github.com/argoproj/argo-cd/releases/download/v${version}/argocd-linux-${alt_arch}"
-chmod +x "${prefix}/bin/argocd"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/argoproj/argo-cd/releases/download/v${version}/argocd-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "argoproj/argo-cd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/argocd"
+
 "${prefix}/bin/argocd" completion bash >"${prefix}/share/bash-completion/completions/argocd"
 "${prefix}/bin/argocd" completion zsh >"${prefix}/share/zsh/vendor-completions/_argocd"
 EOF
\ No newline at end of file
diff --git a/tools/arkade/Dockerfile.template b/tools/arkade/Dockerfile.template
index 505d85f5e6..02b19a51b0 100644
--- a/tools/arkade/Dockerfile.template
+++ b/tools/arkade/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,12 +23,17 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "alexellis/arkade" "${version}" "arkade${arch_suffix}"
+url="https://github.com/alexellis/arkade/releases/download/${version}/arkade${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "alexellis/arkade" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/arkade"
 
-echo "### Downloading arkade ${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/arkade" \
-    "https://github.com/alexellis/arkade/releases/download/${version}/arkade${arch_suffix}"
-chmod +x "${prefix}/bin/arkade"
 
 "${prefix}/bin/arkade" completion bash >"${prefix}/share/bash-completion/completions/arkade"
 "${prefix}/bin/arkade" completion fish >"${prefix}/share/fish/vendor_completions.d/arkade.fish"
diff --git a/tools/artifactory-cleanup/Dockerfile.template b/tools/artifactory-cleanup/Dockerfile.template
index 2b3cc9b523..448aa70382 100644
--- a/tools/artifactory-cleanup/Dockerfile.template
+++ b/tools/artifactory-cleanup/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "crazy-max/artifactory-cleanup" "v${version}" "artifactory-cleanup_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/crazy-max/artifactory-cleanup/releases/download/v${version}/artifactory-cleanup_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/crazy-max/artifactory-cleanup/releases/download/v${version}/artifactory-cleanup_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "crazy-max/artifactory-cleanup" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     ./artifactory-cleanup
 EOF
\ No newline at end of file
diff --git a/tools/asciigraph/Dockerfile.template b/tools/asciigraph/Dockerfile.template
index 2d0d059c97..499eaf8c62 100644
--- a/tools/asciigraph/Dockerfile.template
+++ b/tools/asciigraph/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "guptarohit/asciigraph" "v${version}" "asciigraph_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/guptarohit/asciigraph/releases/download/v${version}/asciigraph_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/guptarohit/asciigraph/releases/download/v${version}/asciigraph_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "guptarohit/asciigraph" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     asciigraph
 EOF
\ No newline at end of file
diff --git a/tools/asciinema/Dockerfile.template b/tools/asciinema/Dockerfile.template
index e859d41d41..28f95574e3 100644
--- a/tools/asciinema/Dockerfile.template
+++ b/tools/asciinema/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/asciinema" --console-script asciinema "asciinema==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/autocert/Dockerfile.template b/tools/autocert/Dockerfile.template
index 522476efaf..63d41d9d17 100644
--- a/tools/autocert/Dockerfile.template
+++ b/tools/autocert/Dockerfile.template
@@ -10,24 +10,27 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "smallstep/autocert" "v${version}" "autocert_linux_${version}_amd64.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/smallstep/autocert/releases/download/v${version}/autocert_linux_${version}_${alt_arch}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "smallstep/autocert" "v${version}" "${filename}"
 echo "### Downloading autocert ${version}"
-curl --silent --show-error --location --fail --remote-name \
-    "https://github.com/smallstep/autocert/releases/download/v${version}/autocert_linux_${version}_amd64.tar.gz"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking keyless signature for autocert ${version}"
-curl --silent --show-error --location --fail --remote-name \
-    "https://github.com/smallstep/autocert/releases/download/v${version}/autocert_linux_${version}_amd64.tar.gz.pem"
-curl --silent --show-error --location --fail --remote-name \
-    "https://github.com/smallstep/autocert/releases/download/v${version}/autocert_linux_${version}_amd64.tar.gz.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.pem" \
+    "${url}.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
 SHA="$(
     git ls-remote --tags https://github.com/smallstep/autocert "v${version}" \
     | cut -f1
 )"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "autocert_linux_${version}_amd64.tar.gz.pem" \
-    --signature "autocert_linux_${version}_amd64.tar.gz.sig" \
+    --cert "${uniget_cache_download}/${filename}.pem" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity "https://github.com/smallstep/workflows/.github/workflows/goreleaser.yml@refs/heads/main" \
     --certificate-github-workflow-name "Create Release & Upload Assets" \
@@ -35,9 +38,9 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob \
     --certificate-github-workflow-repository "smallstep/autocert" \
     --certificate-github-workflow-sha "${SHA}" \
     --certificate-github-workflow-trigger push \
-    "autocert_linux_${version}_amd64.tar.gz"
+    "${uniget_cache_download}/${filename}"
 
-tar --extract --gzip --directory="${prefix}/bin/" --file "autocert_linux_${version}_amd64.tar.gz" --strip-components=1 --no-same-owner \
+tar --file="autocert_linux_${version}_amd64.tar.gz" --list
+tar --file="autocert_linux_${version}_amd64.tar.gz" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "autocert_${version}/autocert"
-#rm "autocert_linux_${version}_amd64.tar.gz"
 EOF
\ No newline at end of file
diff --git a/tools/aws/Dockerfile.template b/tools/aws/Dockerfile.template
index efb2ba5673..e75ef12b89 100644
--- a/tools/aws/Dockerfile.template
+++ b/tools/aws/Dockerfile.template
@@ -15,6 +15,6 @@ ARG version
 COPY <<EOF /uniget_bootstrap/etc/profile.d/aws
 complete -C '/usr/local/bin/aws_completer' aws
 EOF
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/aws" --console-script aws "awscli==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/aws2/Dockerfile.template b/tools/aws2/Dockerfile.template
index a378c84d51..a8e3d654fd 100644
--- a/tools/aws2/Dockerfile.template
+++ b/tools/aws2/Dockerfile.template
@@ -10,14 +10,20 @@ ARG version
 COPY <<EOF /uniget_bootstrap/etc/profile.d/aws
 complete -C '/usr/local/bin/aws_completer' aws
 EOF
-RUN <<EOF
-check-download "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${version}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${version}.zip"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q "${uniget_cache_download}/${filename}"
 
-curl --silent --show-error --location --fail --remote-name \
-    "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${version}.zip"
-unzip "awscli-exe-linux-x86_64-${version}.zip"
 mkdir -p "${prefix}/aws-cli/v2/${version}/bin"
 mv aws/dist "${prefix}/aws-cli/v2/${version}"
+
 ln --symbolic --relative --force "${prefix}/aws-cli/v2/${version}" "${prefix}/aws-cli/v2/current"
 ln --symbolic --relative --force "${prefix}/aws-cli/v2/current/dist/aws" "${prefix}/aws-cli/v2/current/bin/aws"
 ln --symbolic --relative --force "${prefix}/aws-cli/v2/current/dist/aws_completer" "${prefix}/aws-cli/v2/current/bin/aws_completer"
diff --git a/tools/axel/Dockerfile.template b/tools/axel/Dockerfile.template
index e7bbcd2dad..dd6fef379a 100644
--- a/tools/axel/Dockerfile.template
+++ b/tools/axel/Dockerfile.template
@@ -7,8 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     openssl-dev \
     openssl-libs-static
 EOF
@@ -16,9 +16,17 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/axel
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail https://github.com/axel-download-accelerator/axel/releases/download/v${version}/axel-${version}.tar.gz \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/axel-download-accelerator/axel/releases/download/v${version}/axel-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "axel-download-accelerator/axel" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 ./configure --prefix="${prefix}"
 make LDFLAGS=-static -j$(nproc)
 make install
diff --git a/tools/az/Dockerfile.template b/tools/az/Dockerfile.template
index 065d8fff78..f9088cc13b 100644
--- a/tools/az/Dockerfile.template
+++ b/tools/az/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/az" --console-script az "azure-cli==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/bandwhich/Dockerfile.template b/tools/bandwhich/Dockerfile.template
index 836848597c..f42dacc891 100644
--- a/tools/bandwhich/Dockerfile.template
+++ b/tools/bandwhich/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "imsnif/bandwhich" "v${version}" "bandwhich-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/imsnif/bandwhich/releases/download/v${version}/bandwhich-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/imsnif/bandwhich/releases/download/v${version}/bandwhich-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "imsnif/bandwhich" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/bat/Dockerfile.template b/tools/bat/Dockerfile.template
index da04367ea6..93c66f5196 100644
--- a/tools/bat/Dockerfile.template
+++ b/tools/bat/Dockerfile.template
@@ -8,10 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/bat
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "sharkdp/bat" "v${version}" "bat-v${version}-x86_64-unknown-linux-gnu.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/sharkdp/bat/releases/download/v${version}/bat-v${version}-x86_64-unknown-linux-gnu.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sharkdp/bat/releases/download/v${version}/bat-v${version}-x86_64-unknown-linux-gnu.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sharkdp/bat" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 mv bat "${prefix}/bin/"
 mv bat.1 "${prefix}/share/man/man1/"
 mv autocomplete/bat.bash "${prefix}/share/bash-completion/completions/bat"
diff --git a/tools/bento/Dockerfile.template b/tools/bento/Dockerfile.template
index 730338785c..551b5ba464 100644
--- a/tools/bento/Dockerfile.template
+++ b/tools/bento/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/warpstreamlabs/bento
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 check-clone "https://github.com/warpstreamlabs/bento" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/warpstreamlabs/bento .
 make all
diff --git a/tools/bento/manifest.yaml b/tools/bento/manifest.yaml
index 83130cf143..56c1b52efa 100644
--- a/tools/bento/manifest.yaml
+++ b/tools/bento/manifest.yaml
@@ -18,6 +18,6 @@ repository: https://github.com/warpstreamlabs/bento
 description: Fancy stream processing made operationally mundane
 renovate:
   datasource: github-releases
-  package: foo/bar
+  package: warpstreamlabs/bento
   extractVersion: ^v(?<version>.+)$
   priority: low
\ No newline at end of file
diff --git a/tools/bicep/Dockerfile.template b/tools/bicep/Dockerfile.template
index 2a36f5eace..c388185b8a 100644
--- a/tools/bicep/Dockerfile.template
+++ b/tools/bicep/Dockerfile.template
@@ -7,10 +7,10 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=musl / /usr/local
+COPY --link --from=musl / /usr/local
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -26,8 +26,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "Azure/bicep" "v${version}" "bicep-linux-${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/bicep" \
-    "https://github.com/Azure/bicep/releases/download/v${version}/bicep-linux-${arch_suffix}"
-chmod +x "${prefix}/bin/bicep"
+url="https://github.com/Azure/bicep/releases/download/v${version}/bicep-linux-${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Azure/bicep" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/bicep"
+
 EOF
\ No newline at end of file
diff --git a/tools/bif/Dockerfile.template b/tools/bif/Dockerfile.template
index 35b0a7e506..f3e10511f9 100644
--- a/tools/bif/Dockerfile.template
+++ b/tools/bif/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "FairwindsOps/bif" "v${version}" "bif_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/FairwindsOps/bif/releases/download/v${version}/bif_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/FairwindsOps/bif/releases/download/v${version}/bif_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "FairwindsOps/bif" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     bif
     
 "${prefix}/bin/bif" completion bash >"${prefix}/share/bash-completion/completions/bif"
diff --git a/tools/bin/Dockerfile.template b/tools/bin/Dockerfile.template
index 959f03e8d4..da6be80234 100644
--- a/tools/bin/Dockerfile.template
+++ b/tools/bin/Dockerfile.template
@@ -7,9 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "marcosnils/bin" "v${version}" "bin_${version}_linux_${alt_arch}"
-
 echo "### Downloading bin ${version}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/bin" \
     "https://github.com/marcosnils/bin/releases/download/v${version}/bin_${version}_linux_${alt_arch}"
diff --git a/tools/blackbox-exporter/Dockerfile.template b/tools/blackbox-exporter/Dockerfile.template
index bd5d7419bf..d47782dbfe 100644
--- a/tools/blackbox-exporter/Dockerfile.template
+++ b/tools/blackbox-exporter/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus/blackbox_exporter" "v${version}" "blackbox_exporter-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus/blackbox_exporter/releases/download/v${version}/blackbox_exporter-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus/blackbox_exporter/releases/download/v${version}/blackbox_exporter-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus/blackbox_exporter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "blackbox_exporter-${version}.linux-${alt_arch}/blackbox_exporter"
 EOF
 COPY blackbox.yaml /uniget_bootstrap/etc/blackbox/
diff --git a/tools/blincus/Dockerfile.template b/tools/blincus/Dockerfile.template
index a165dabc58..092223aba8 100644
--- a/tools/blincus/Dockerfile.template
+++ b/tools/blincus/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://github.com/ublue-os/blincus/raw/${version}/blincus"
-curl --silent --show-error --location --fail --output "${prefix}/bin/blincus" \
-    "https://github.com/ublue-os/blincus/raw/${version}/blincus"
-chmod +x "${prefix}/bin/blincus"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ublue-os/blincus/raw/${version}/blincus"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/blincus"
+
 
 curl --silent --show-error --location --fail --output "${prefix}/share/bash-completion/completions/blincus" \
     "https://github.com/ublue-os/blincus/raw/${version}/completions/blincus"
diff --git a/tools/bogrod/Dockerfile.template b/tools/bogrod/Dockerfile.template
index d57f4b8ff7..1bd637d942 100644
--- a/tools/bogrod/Dockerfile.template
+++ b/tools/bogrod/Dockerfile.template
@@ -12,8 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-which python3
-ldd /usr/local/bin/python3
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/bogrod" --console-script bogrod "bogrod==${version}" pyyaml tabulate
 EOF
\ No newline at end of file
diff --git a/tools/bom/Dockerfile.template b/tools/bom/Dockerfile.template
index 07be8d8ea1..a1864b32e0 100644
--- a/tools/bom/Dockerfile.template
+++ b/tools/bom/Dockerfile.template
@@ -7,11 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/bom" "v${version}" "bom-amd64-linux"
-curl --silent --show-error --location --fail --output "${prefix}/bin/bom" \
-    "https://github.com/kubernetes-sigs/bom/releases/download/v${version}/bom-amd64-linux"
-chmod +x "${prefix}/bin/bom"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/bom/releases/download/v${version}/bom-amd64-linux"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/bom" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/bom"
 "${prefix}/bin/bom" completion bash >"${prefix}/share/bash-completion/completions/bom"
 "${prefix}/bin/bom" completion fish >"${prefix}/share/fish/vendor_completions.d/bom.fish"
 "${prefix}/bin/bom" completion zsh >"${prefix}/share/zsh/vendor-completions/_bom"
diff --git a/tools/bomber/Dockerfile.template b/tools/bomber/Dockerfile.template
index eae9e66acd..467a03c90c 100644
--- a/tools/bomber/Dockerfile.template
+++ b/tools/bomber/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "devops-kung-fu/bomber" "v${version}" "bomber_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/devops-kung-fu/bomber/releases/download/v${version}/bomber_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/devops-kung-fu/bomber/releases/download/v${version}/bomber_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "devops-kung-fu/bomber" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     bomber
 "${prefix}/bin/bomber" completion bash | tail -n +9 >"${prefix}/share/bash-completion/completions/bomber"
 "${prefix}/bin/bomber" completion fish | tail -n +9 >"${prefix}/share/fish/vendor_completions.d/bomber.fish"
diff --git a/tools/bomshell/Dockerfile.template b/tools/bomshell/Dockerfile.template
index f21bccf33a..e67a7d44a5 100644
--- a/tools/bomshell/Dockerfile.template
+++ b/tools/bomshell/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "chainguard-dev/bomshell" "v${version}" "bomshell-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/bomshell" \
-    "https://github.com/chainguard-dev/bomshell/releases/download/v${version}/bomshell-linux-${alt_arch}"
-chmod +x "${prefix}/bin/bomshell"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/chainguard-dev/bomshell/releases/download/v${version}/bomshell-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "chainguard-dev/bomshell" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/bomshell"
+
 EOF
\ No newline at end of file
diff --git a/tools/botsay/Dockerfile.template b/tools/botsay/Dockerfile.template
index c991604768..660608b2d0 100644
--- a/tools/botsay/Dockerfile.template
+++ b/tools/botsay/Dockerfile.template
@@ -7,11 +7,11 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/xyproto/botsay
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/xyproto/botsay" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/xyproto/botsay .
 go build -o "${prefix}/bin/botsay" .
diff --git a/tools/box/Dockerfile.template b/tools/box/Dockerfile.template
index 6c7eab6951..f992991080 100644
--- a/tools/box/Dockerfile.template
+++ b/tools/box/Dockerfile.template
@@ -7,14 +7,21 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
+COPY --link --from=php / /usr/local/
 ARG name
 ARG version
-COPY --from=php / /usr/local/
-RUN <<EOF
-check-github-release-asset "box-project/box" "${version}" "box.phar"
-curl --silent --show-error --location --fail --output "${prefix}/bin/box" \
-    "https://github.com/box-project/box/releases/download/${version}/box.phar"
-chmod +x "${prefix}/bin/box"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/box-project/box/releases/download/${version}/box.phar"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "box-project/box" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/box"
+
 
 "${prefix}/bin/box" completion bash >"${prefix}/share/bash-completion/completions/box"
 EOF
\ No newline at end of file
diff --git a/tools/bpftool/Dockerfile.template b/tools/bpftool/Dockerfile.template
index bdc5dac5a2..fed2a3a045 100644
--- a/tools/bpftool/Dockerfile.template
+++ b/tools/bpftool/Dockerfile.template
@@ -7,27 +7,40 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=make / /usr/local/
+COPY --link --from=make / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "libbpf/bpftool" "v${version}" "bpftool-v${version}-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/libbpf/bpftool/releases/download/v${version}/bpftool-v${version}-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/libbpf/bpftool/releases/download/v${version}/bpftool-v${version}-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "libbpf/bpftool" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 chmod +x "${prefix}/bin/bpftool"
 EOF
 WORKDIR /tmp/bpftool
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     python3-docutils
 EOF
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/libbpf/bpftool/releases/download/v${version}/bpftool-libbpf-v${version}-sources.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/libbpf/bpftool/releases/download/v${version}/bpftool-libbpf-v${version}-sources.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "libbpf/bpftool" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    ${url}
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 make -C docs man
 find docs -name "*.8" -exec cp {} "${prefix}/share/man/man8/" \;
 EOF
-RUN <<EOF
-cp bash-completion/bpftool "${prefix}/share/bash-completion/completions/bpftool"
+RUN <<EOF # no download cache
+cpbash-completion/bpftool "${prefix}/share/bash-completion/completions/bpftool"
 EOF
\ No newline at end of file
diff --git a/tools/bubblewrap/Dockerfile.template b/tools/bubblewrap/Dockerfile.template
index 2735ce7c56..3442cb5b13 100644
--- a/tools/bubblewrap/Dockerfile.template
+++ b/tools/bubblewrap/Dockerfile.template
@@ -5,8 +5,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     xz \
     libcap-dev \
     libcap-static
@@ -14,10 +14,16 @@ EOF
 WORKDIR /tmp/bwrap
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "containers/bubblewrap" "v${version}" "bubblewrap-${version}.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/containers/bubblewrap/releases/download/v${version}/bubblewrap-${version}.tar.xz" \
-| tar --extract --xz --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containers/bubblewrap/releases/download/v${version}/bubblewrap-${version}.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containers/bubblewrap" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --strip-components=1
 ./autogen.sh
 make LDFLAGS=-static -j$(nproc)
 make install DESTDIR="${prefix}" prefix=""
diff --git a/tools/buildah/Dockerfile.template b/tools/buildah/Dockerfile.template
index 5fefb19189..b59decad3f 100644
--- a/tools/buildah/Dockerfile.template
+++ b/tools/buildah/Dockerfile.template
@@ -9,14 +9,9 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=go / /usr/local/
-COPY --from=make / /usr/local/
-COPY --from=go-md2man / /usr/local/
-ARG name
-ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
 apk update
-apk add \
+apk add --update-cache \
     bats \
     libassuan-dev \
     libassuan-static \
@@ -30,14 +25,19 @@ apk add \
     libseccomp-static \
     libselinux-dev
 EOF
+COPY --link --from=go / /usr/local/
+COPY --link --from=make / /usr/local/
+COPY --from=go-md2man / /usr/local/
 WORKDIR /tmp/buildah
+ARG name
+ARG version
 RUN git clone --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containers/buildah .
 ENV CFLAGS='-static -pthread' \
     LDFLAGS='-s -w -static-libgcc -static' \
     EXTRA_LDFLAGS='-s -w -linkmode external -extldflags "-static -lm -lgpgme -lgpg-error -lassuan"' \
     BUILDTAGS='static netgo osusergo exclude_graphdriver_btrfs exclude_graphdriver_devicemapper seccomp apparmor selinux' \
     CGO_ENABLED=1
-RUN <<EOF
+RUN <<EOF # no download cache
 make -j$(nproc) bin/buildah
 make -C docs -j$(nproc) GOMD2MAN=go-md2man
 mkdir -p /usr/local/share/bash-completion/completions
diff --git a/tools/buildg/Dockerfile.template b/tools/buildg/Dockerfile.template
index d88f1de40b..89298901fd 100644
--- a/tools/buildg/Dockerfile.template
+++ b/tools/buildg/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ktock/buildg" "v${version}" "buildg-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ktock/buildg/releases/download/v${version}/buildg-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ktock/buildg/releases/download/v${version}/buildg-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ktock/buildg" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/buildkit/Dockerfile.template b/tools/buildkit/Dockerfile.template
index 57fe5c2605..bd045a240f 100644
--- a/tools/buildkit/Dockerfile.template
+++ b/tools/buildkit/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "moby/buildkit" "v${version}" "buildkit-v${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/moby/buildkit/releases/download/v${version}/buildkit-v${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/moby/buildkit/releases/download/v${version}/buildkit-v${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "moby/buildkit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner
 
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/buildkit.service.go-template" \
     "https://github.com/moby/buildkit/raw/v${version}/examples/systemd/system/buildkit.service"
diff --git a/tools/buildx/Dockerfile.template b/tools/buildx/Dockerfile.template
index e87b895a44..f36ffe1999 100644
--- a/tools/buildx/Dockerfile.template
+++ b/tools/buildx/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/buildx" "v${version}" "buildx-v${version}.linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/libexec/docker/cli-plugins/docker-buildx" \
-    "https://github.com/docker/buildx/releases/download/v${version}/buildx-v${version}.linux-${alt_arch}"
-chmod +x "${prefix}/libexec/docker/cli-plugins/docker-buildx"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/buildx/releases/download/v${version}/buildx-v${version}.linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/buildx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/libexec/docker/cli-plugins/docker-buildx"
+
 "${prefix}/libexec/docker/cli-plugins/docker-buildx" completion bash | sed "s|${prefix}||g" >"${prefix}/share/bash-completion/completions/docker-buildx"
 "${prefix}/libexec/docker/cli-plugins/docker-buildx" completion fish | sed "s|${prefix}||g" >"${prefix}/share/fish/vendor_completions.d/docker-buildx.fish"
 "${prefix}/libexec/docker/cli-plugins/docker-buildx" completion zsh  | sed "s|${prefix}||g" >"${prefix}/share/zsh/vendor-completions/_docker-buildx"
diff --git a/tools/bumblebee/Dockerfile.template b/tools/bumblebee/Dockerfile.template
index 23eebabc22..c8ebe088bd 100644
--- a/tools/bumblebee/Dockerfile.template
+++ b/tools/bumblebee/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "solo-io/bumblebee" "v${version}" "bee-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/bee" \
-    "https://github.com/solo-io/bumblebee/releases/download/v${version}/bee-linux-${alt_arch}"
-chmod +x "${prefix}/bin/bee"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/solo-io/bumblebee/releases/download/v${version}/bee-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "solo-io/bumblebee" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/bee"
+
 "${prefix}/bin/bee" completion bash >"${prefix}/share/bash-completion/completions/bee"
 "${prefix}/bin/bee" completion fish >"${prefix}/share/fish/vendor_completions.d/bee.fish"
 "${prefix}/bin/bee" completion zsh >"${prefix}/share/zsh/vendor-completions/_bee"
diff --git a/tools/bypass4netns/Dockerfile.template b/tools/bypass4netns/Dockerfile.template
index 251cc1d5ca..49eaab66e3 100644
--- a/tools/bypass4netns/Dockerfile.template
+++ b/tools/bypass4netns/Dockerfile.template
@@ -8,8 +8,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     libseccomp-dev \
     libseccomp-static
 EOF
@@ -18,7 +18,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/rootless-containers/bypass4netns
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://github.com/rootless-containers/bypass4netns" "v${version}"
 
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/rootless-containers/bypass4netns .
diff --git a/tools/caddy/Dockerfile.template b/tools/caddy/Dockerfile.template
index 105ab15ad8..da01a35c14 100644
--- a/tools/caddy/Dockerfile.template
+++ b/tools/caddy/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "caddyserver/caddy" "v${version}" "caddy_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/caddyserver/caddy/releases/download/v${version}/caddy_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/caddyserver/caddy/releases/download/v${version}/caddy_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "caddyserver/caddy" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     caddy
     
 "${prefix}/bin/caddy" completion bash >"${prefix}/share/bash-completion/completions/caddy"
diff --git a/tools/cadvisor/Dockerfile.template b/tools/cadvisor/Dockerfile.template
index f4ee623eb9..56879389f8 100644
--- a/tools/cadvisor/Dockerfile.template
+++ b/tools/cadvisor/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "google/cadvisor" "v${version}" "cadvisor-v${version}-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/cadvisor" \
-    "https://github.com/google/cadvisor/releases/download/v${version}/cadvisor-v${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/cadvisor"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/google/cadvisor/releases/download/v${version}/cadvisor-v${version}-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "google/cadvisor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/cadvisor"
+
 EOF
diff --git a/tools/calicoctl/Dockerfile.template b/tools/calicoctl/Dockerfile.template
index 2cfdc04af4..a64fa7b40e 100644
--- a/tools/calicoctl/Dockerfile.template
+++ b/tools/calicoctl/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectcalico/calico" "v${version}" "calicoctl-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/calicoctl" \
-    "https://github.com/projectcalico/calico/releases/download/v${version}/calicoctl-linux-${alt_arch}"
-chmod +x "${prefix}/bin/calicoctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/projectcalico/calico/releases/download/v${version}/calicoctl-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectcalico/calico" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/calicoctl"
+
 EOF
\ No newline at end of file
diff --git a/tools/car/Dockerfile.template b/tools/car/Dockerfile.template
index ae2d90e169..3eb5bb6c68 100644
--- a/tools/car/Dockerfile.template
+++ b/tools/car/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tetratelabs/car" "v${version}" "car_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/tetratelabs/car/releases/download/v${version}/car_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tetratelabs/car/releases/download/v${version}/car_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tetratelabs/car" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/cascadia-code/Dockerfile.template b/tools/cascadia-code/Dockerfile.template
index a48f751a5d..84a2f53224 100644
--- a/tools/cascadia-code/Dockerfile.template
+++ b/tools/cascadia-code/Dockerfile.template
@@ -7,14 +7,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "microsoft/cascadia-code" "v${version}" "CascadiaCode-${version}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/microsoft/cascadia-code/releases/download/v${version}/CascadiaCode-${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
+
+check-github-release-asset "microsoft/cascadia-code" "v${version}" "${filename}"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p \
     "${prefix}/share/cascadia-code" \
     "${prefix}/share/fonts/cascadia-code"
-unzip -q -o -d "${prefix}/share/cascadia-code/" "${filename}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/share/cascadia-code/" "${uniget_cache_download}/${filename}"
+
 find "${prefix}/share/cascadia-code/ttf" -maxdepth 1 -type f -exec cp {} "${prefix}/share/fonts/cascadia-code" \;
 EOF
\ No newline at end of file
diff --git a/tools/catatonit/Dockerfile.template b/tools/catatonit/Dockerfile.template
index 8c13c8adfe..b9ee6e3075 100644
--- a/tools/catatonit/Dockerfile.template
+++ b/tools/catatonit/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "openSUSE/catatonit" "v${version}" "catatonit.${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/catatonit" \
-    "https://github.com/openSUSE/catatonit/releases/download/v${version}/catatonit.${arch}"
-chmod +x "${prefix}/bin/catatonit"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/openSUSE/catatonit/releases/download/v${version}/catatonit.${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "openSUSE/catatonit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/catatonit"
+
 EOF
\ No newline at end of file
diff --git a/tools/catgpt/Dockerfile.template b/tools/catgpt/Dockerfile.template
index c34680f538..326f278cd2 100644
--- a/tools/catgpt/Dockerfile.template
+++ b/tools/catgpt/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "ibuildthecloud/catgpt" "v${version}" "catgpt_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ibuildthecloud/catgpt/releases/download/v${version}/catgpt_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/ibuildthecloud/catgpt/releases/download/v${version}/catgpt_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ibuildthecloud/catgpt" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "catgpt_Linux_${arch_suffix}/catgpt"
 EOF
\ No newline at end of file
diff --git a/tools/cdebug/Dockerfile.template b/tools/cdebug/Dockerfile.template
index 8fa4d66caa..bd35b44e8e 100644
--- a/tools/cdebug/Dockerfile.template
+++ b/tools/cdebug/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "iximiuz/cdebug" "v${version}" "cdebug_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/iximiuz/cdebug/releases/download/v${version}/cdebug_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/iximiuz/cdebug/releases/download/v${version}/cdebug_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "iximiuz/cdebug" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     cdebug
 
 "${prefix}/bin/cdebug" completion bash >"${prefix}/share/bash-completion/completions/cdebug"
diff --git a/tools/cdncheck/Dockerfile.template b/tools/cdncheck/Dockerfile.template
index 6c9c36c2db..f8a6151aa1 100644
--- a/tools/cdncheck/Dockerfile.template
+++ b/tools/cdncheck/Dockerfile.template
@@ -7,12 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/cdncheck" "v${version}" "cdncheck_${version}_linux_${alt_arch}.zip"
-
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/cdncheck/releases/download/v${version}/cdncheck_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/cdncheck" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     cdncheck
 EOF
\ No newline at end of file
diff --git a/tools/cdxgen/Dockerfile.template b/tools/cdxgen/Dockerfile.template
index 9634433445..0527a358a4 100644
--- a/tools/cdxgen/Dockerfile.template
+++ b/tools/cdxgen/Dockerfile.template
@@ -15,7 +15,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/cdxgen
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "@cyclonedx/cdxgen@${version}"
diff --git a/tools/cfssl/Dockerfile.template b/tools/cfssl/Dockerfile.template
index 92805a806a..b08e0ccc10 100644
--- a/tools/cfssl/Dockerfile.template
+++ b/tools/cfssl/Dockerfile.template
@@ -8,11 +8,15 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 ARG BINARIES="cfssl-bundle cfssl-certinfo cfssl-newkey cfssl-scan cfssljson cfssl mkbundle multirootca"
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 for BINARY in ${BINARIES}; do
-    check-github-release-asset "cloudflare/cfssl" "v${version}" "${BINARY}_${version}_linux_amd64"
-    curl --silent --show-error --location --fail --output "${prefix}/bin/${BINARY}" \
-        "https://github.com/cloudflare/cfssl/releases/download/v${version}/${BINARY}_${version}_linux_amd64"
-    chmod +x "${prefix}/bin/${BINARY}"
+    url="https://github.com/cloudflare/cfssl/releases/download/v${version}/${BINARY}_${version}_linux_amd64"
+    filename="$(basename "${url}")"
+    check-github-release-asset "cloudflare/cfssl" "v${version}" "${filename}"
+    curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+        "${url}"
+    install --mode=0755 \
+        "${uniget_cache_download}/${filename}" \
+        "${prefix}/bin/${BINARY}"
 done
 EOF
\ No newline at end of file
diff --git a/tools/chainsaw/Dockerfile.template b/tools/chainsaw/Dockerfile.template
index 374920d26f..8fc7b6ca22 100644
--- a/tools/chainsaw/Dockerfile.template
+++ b/tools/chainsaw/Dockerfile.template
@@ -10,26 +10,29 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kyverno/chainsaw" "v${version}" "chainsaw_linux_amd64.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kyverno/chainsaw/releases/download/v${version}/chainsaw_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kyverno/chainsaw" "v${version}" "${filename}"
 echo "### Downloading chainsaw ${version}"
-curl --silent --show-error --location --fail --remote-name \
-      "https://github.com/kyverno/chainsaw/releases/download/v${version}/chainsaw_linux_${alt_arch}.tar.gz"
-echo "    - SHA256: $(cat chainsaw_linux_${alt_arch}.tar.gz | sha256sum  | cut -d' ' -f1)"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+echo "    - SHA256: $(cat ${uniget_cache_download}/${filename} | sha256sum  | cut -d' ' -f1)"
 
 echo "### Checking keyless signature for chainsaw ${version}"
-curl --silent --show-error --location --fail --remote-name \
-      "https://github.com/kyverno/chainsaw/releases/download/v${version}/chainsaw_linux_${alt_arch}.tar.gz.pem"
-curl --silent --show-error --location --fail --remote-name \
-      "https://github.com/kyverno/chainsaw/releases/download/v${version}/chainsaw_linux_${alt_arch}.tar.gz.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.pem" \
+      "${url}.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+      "${url}.sig"
 SHA="$(
     git ls-remote --tags https://github.com/kyverno/chainsaw "v${version}^{}" \
     | cut -f1
 )"
 echo "    - SHA: ${SHA}"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "chainsaw_linux_${alt_arch}.tar.gz.pem" \
-    --signature "chainsaw_linux_${alt_arch}.tar.gz.sig" \
+    --cert "${uniget_cache_download}/${filename}.pem" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
     --certificate-identity "https://github.com/kyverno/chainsaw/.github/workflows/release.yaml@refs/tags/v${version}" \
     --certificate-github-workflow-name "Release" \
@@ -37,12 +40,12 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob \
     --certificate-github-workflow-repository "kyverno/chainsaw" \
     --certificate-github-workflow-sha "${SHA}" \
     --certificate-github-workflow-trigger push \
-    "chainsaw_linux_${alt_arch}.tar.gz"
+    "${uniget_cache_download}/${filename}"
 
 echo "### Installing chainsaw ${version}"
-tar --extract --gzip --directory="${prefix}/bin" --file "chainsaw_linux_${alt_arch}.tar.gz" \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" \
     chainsaw
-rm -f "chainsaw_linux_${alt_arch}.tar.gz"
 
 "${prefix}/bin/chainsaw" completion bash >"${prefix}/share/bash-completion/completions/chainsaw"
 "${prefix}/bin/chainsaw" completion fish >"${prefix}/share/fish/vendor_completions.d/chainsaw.fish"
diff --git a/tools/charm/Dockerfile.template b/tools/charm/Dockerfile.template
index d56b8cb9df..dd8c1b0307 100644
--- a/tools/charm/Dockerfile.template
+++ b/tools/charm/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/charm" "v${version}" "charm_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/charm/releases/download/v${version}/charm_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/charmbracelet/charm/releases/download/v${version}/charm_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/charm" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     charm \
     completions \
     manpages
diff --git a/tools/chart-releaser/Dockerfile.template b/tools/chart-releaser/Dockerfile.template
index e245e7070b..3f738d16c3 100644
--- a/tools/chart-releaser/Dockerfile.template
+++ b/tools/chart-releaser/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "helm/chart-releaser" "v${version}" "chart-releaser_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/helm/chart-releaser/releases/download/v${version}/chart-releaser_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/helm/chart-releaser/releases/download/v${version}/chart-releaser_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "helm/chart-releaser" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     cr
 
 "${prefix}/bin/cr" completion bash >"${prefix}/share/bash-completion/completions/cr"
diff --git a/tools/chart-testing/Dockerfile.template b/tools/chart-testing/Dockerfile.template
index 4e4976d549..888d78e952 100644
--- a/tools/chart-testing/Dockerfile.template
+++ b/tools/chart-testing/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "helm/chart-testing" "v${version}" "chart-testing_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/helm/chart-testing/releases/download/v${version}/chart-testing_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/helm/chart-testing/releases/download/v${version}/chart-testing_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "helm/chart-testing" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ct \
     etc
 mkdir -p "${prefix}/etc/ct"
diff --git a/tools/cheat/Dockerfile.template b/tools/cheat/Dockerfile.template
index df0ae5bcaf..02f748c34b 100644
--- a/tools/cheat/Dockerfile.template
+++ b/tools/cheat/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "cheat/cheat" "${version}" "cheat-linux-${alt_arch}.gz"
 curl --silent --show-error --location --fail "https://github.com/cheat/cheat/releases/download/${version}/cheat-linux-${alt_arch}.gz" \
 | gunzip \
diff --git a/tools/checkov/Dockerfile.template b/tools/checkov/Dockerfile.template
index fa11cec39e..060688fba7 100644
--- a/tools/checkov/Dockerfile.template
+++ b/tools/checkov/Dockerfile.template
@@ -12,14 +12,14 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 COPY --link --from=rust / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     clang
 EOF
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
 shiv --output-file "${prefix}/bin/checkov" --console-script checkov "checkov==${version}"
diff --git a/tools/chekr/Dockerfile.template b/tools/chekr/Dockerfile.template
index b157acdcc0..9f4a9c72a5 100644
--- a/tools/chekr/Dockerfile.template
+++ b/tools/chekr/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ckotzbauer/chekr" "${version}" "chekr_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ckotzbauer/chekr/releases/download/${version}/chekr_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ckotzbauer/chekr/releases/download/${version}/chekr_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ckotzbauer/chekr" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     chekr
 "${prefix}/bin/chekr" completion bash >"${prefix}/share/bash-completion/completions/chekr"
 "${prefix}/bin/chekr" completion fish >"${prefix}/share/fish/vendor_completions.d/chekr.fish"
diff --git a/tools/chigo/Dockerfile.template b/tools/chigo/Dockerfile.template
index 85faf4033c..3ed338e551 100644
--- a/tools/chigo/Dockerfile.template
+++ b/tools/chigo/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "UltiRequiem/chigo" "v${version}" "chigo_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/UltiRequiem/chigo/releases/download/v${version}/chigo_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/UltiRequiem/chigo/releases/download/v${version}/chigo_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "UltiRequiem/chigo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     chigo
 ln --symbolic --relative --force chigo "${prefix}/bin/lolcat"
 EOF
\ No newline at end of file
diff --git a/tools/chisel/Dockerfile.template b/tools/chisel/Dockerfile.template
index 93e216010c..6302439725 100644
--- a/tools/chisel/Dockerfile.template
+++ b/tools/chisel/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "jpillora/chisel" "v${version}" "chisel_${version}_linux_${alt_arch}.gz"
 curl --silent --show-error --location --fail "https://github.com/jpillora/chisel/releases/download/v${version}/chisel_${version}_linux_${alt_arch}.gz" \
 | gunzip \
diff --git a/tools/cilium/Dockerfile.template b/tools/cilium/Dockerfile.template
index c3cf174b9b..0781e4f0ca 100644
--- a/tools/cilium/Dockerfile.template
+++ b/tools/cilium/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cilium/cilium-cli" "v${version}" "cilium-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cilium/cilium-cli/releases/download/v${version}/cilium-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cilium/cilium-cli/releases/download/v${version}/cilium-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cilium/cilium-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 "${prefix}/bin/cilium" completion bash >"${prefix}/share/bash-completion/completions/cilium"
 "${prefix}/bin/cilium" completion fish >"${prefix}/share/fish/vendor_completions.d/cilium.fish"
 "${prefix}/bin/cilium" completion zsh >"${prefix}/share/zsh/vendor-completions/_cilium"
diff --git a/tools/cinf/Dockerfile.template b/tools/cinf/Dockerfile.template
index 5d6e125f1d..9ffc0bc2b5 100644
--- a/tools/cinf/Dockerfile.template
+++ b/tools/cinf/Dockerfile.template
@@ -5,13 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mhausenblas/cinf/releases/download/v${version}/cinf_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mhausenblas/cinf" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "mhausenblas/cinf" "v${version}" "cinf_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mhausenblas/cinf/releases/download/v${version}/cinf_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     cinf
 EOF
\ No newline at end of file
diff --git a/tools/civo/Dockerfile.template b/tools/civo/Dockerfile.template
index a9bbc034a0..19434cf2d6 100644
--- a/tools/civo/Dockerfile.template
+++ b/tools/civo/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "civo/cli" "v${version}" "civo-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/civo/cli/releases/download/v${version}/civo-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/civo/cli/releases/download/v${version}/civo-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "civo/cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     civo
 
 "${prefix}/bin/civo" completion bash >"${prefix}/share/bash-completion/completions/civo"
diff --git a/tools/click/Dockerfile.template b/tools/click/Dockerfile.template
index 44b826ed26..44fe033477 100644
--- a/tools/click/Dockerfile.template
+++ b/tools/click/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "databricks/click" "v${version}" "click-v${version}-x86_64-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/databricks/click/releases/download/v${version}/click-v${version}-x86_64-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/databricks/click/releases/download/v${version}/click-v${version}-x86_64-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "databricks/click" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     click-v${version}-x86_64-unknown-linux-musl/click
 EOF
\ No newline at end of file
diff --git a/tools/clive/Dockerfile.template b/tools/clive/Dockerfile.template
index 79295a078f..aa5f161974 100644
--- a/tools/clive/Dockerfile.template
+++ b/tools/clive/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "koki-develop/clive" "v${version}" "clive_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/koki-develop/clive/releases/download/v${version}/clive_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/koki-develop/clive/releases/download/v${version}/clive_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "koki-develop/clive" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     clive
 
 "${prefix}/bin/clive" completion bash >"${prefix}/share/bash-completion/completions/clive"
diff --git a/tools/cloudflared/Dockerfile.template b/tools/cloudflared/Dockerfile.template
index 295622acd2..3ffb7789e8 100644
--- a/tools/cloudflared/Dockerfile.template
+++ b/tools/cloudflared/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cloudflare/cloudflared/releases/download/${version}/cloudflared-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cloudflare/cloudflared" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/cloudflared"
 
-RUN <<EOF
-check-github-release-asset "cloudflare/cloudflared" "${version}" "cloudflared-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/cloudflared" \
-    "https://github.com/cloudflare/cloudflared/releases/download/${version}/cloudflared-linux-${alt_arch}"
-chmod +x "${prefix}/bin/cloudflared"
 EOF
\ No newline at end of file
diff --git a/tools/clusterawsadm/Dockerfile.template b/tools/clusterawsadm/Dockerfile.template
index eb47f7f0b9..18be53ccd6 100644
--- a/tools/clusterawsadm/Dockerfile.template
+++ b/tools/clusterawsadm/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases/download/v${version}/clusterawsadm-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/cluster-api-provider-aws" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/clusterawsadm"
 
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/cluster-api-provider-aws" "v${version}" "clusterawsadm-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/clusterawsadm" \
-    "https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases/download/v${version}/clusterawsadm-linux-${alt_arch}"
-chmod +x "${prefix}/bin/clusterawsadm"
 
 check-github-release-asset "kubernetes-sigs/cluster-api-provider-aws" "v${version}" "clusterctl-aws-linux-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/clusterctl-aws" \
diff --git a/tools/clusterctl/Dockerfile.template b/tools/clusterctl/Dockerfile.template
index c3235a23a8..fd684a01e8 100644
--- a/tools/clusterctl/Dockerfile.template
+++ b/tools/clusterctl/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/cluster-api" "v${version}" "clusterctl-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/clusterctl" \
-    "https://github.com/kubernetes-sigs/cluster-api/releases/download/v${version}/clusterctl-linux-${alt_arch}"
-chmod +x "${prefix}/bin/clusterctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/cluster-api/releases/download/v${version}/clusterctl-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/cluster-api" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/clusterctl"
+
 "${prefix}/bin/clusterctl" completion bash >"${prefix}/share/bash-completion/completions/clusterctl"
 "${prefix}/bin/clusterctl" completion zsh >"${prefix}/share/zsh/vendor-completions/_clusterctl"
 EOF
\ No newline at end of file
diff --git a/tools/clusterlint/Dockerfile.template b/tools/clusterlint/Dockerfile.template
index d964a0942b..830da417bf 100644
--- a/tools/clusterlint/Dockerfile.template
+++ b/tools/clusterlint/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "digitalocean/clusterlint" "v${version}" "clusterlint-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/digitalocean/clusterlint/releases/download/v${version}/clusterlint-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/digitalocean/clusterlint/releases/download/v${version}/clusterlint-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "digitalocean/clusterlint" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/cmctl/Dockerfile.template b/tools/cmctl/Dockerfile.template
index 77f8234e49..ae8485df4d 100644
--- a/tools/cmctl/Dockerfile.template
+++ b/tools/cmctl/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cert-manager/cmctl" "v${version}" "cmctl_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/cmctl" \
-    "https://github.com/cert-manager/cmctl/releases/download/v${version}/cmctl_linux_${alt_arch}"
-chmod +x "${prefix}/bin/cmctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cert-manager/cmctl/releases/download/v${version}/cmctl_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cert-manager/cmctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/cmctl"
+
 
 ln --symbolic --relative --force "${prefix}/bin/cmctl" "${prefix}/bin/kubectl-cert_manager"
 
diff --git a/tools/cni/Dockerfile.template b/tools/cni/Dockerfile.template
index 77895a3144..ef680f05b4 100644
--- a/tools/cni/Dockerfile.template
+++ b/tools/cni/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "containernetworking/plugins" "v${version}" "cni-plugins-linux-${alt_arch}-v${version}.tgz"
 mkdir -p "${prefix}/libexec/cni"
 curl --silent --show-error --location --fail "https://github.com/containernetworking/plugins/releases/download/v${version}/cni-plugins-linux-${alt_arch}-v${version}.tgz" \
diff --git a/tools/cnitool/Dockerfile.template b/tools/cnitool/Dockerfile.template
index ce511f178c..30a1e313d0 100644
--- a/tools/cnitool/Dockerfile.template
+++ b/tools/cnitool/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/containernetworking/cni
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containernetworking/cni .
 cd cnitool
 CGO_ENABLED=0 go build -ldflags '-s -w' -o cnitool .
diff --git a/tools/cntr/Dockerfile.template b/tools/cntr/Dockerfile.template
index 81570d1840..28551271b1 100644
--- a/tools/cntr/Dockerfile.template
+++ b/tools/cntr/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Mic92/cntr" "${version}" "cntr-bin-${version}-${arch}-unknown-linux-musl"
-curl --silent --show-error --location --fail --output "${prefix}/bin/cntr" \
-    "https://github.com/Mic92/cntr/releases/download/${version}/cntr-bin-${version}-${arch}-unknown-linux-musl"
-chmod +x "${prefix}/bin/cntr"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Mic92/cntr/releases/download/${version}/cntr-bin-${version}-${arch}-unknown-linux-musl"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Mic92/cntr" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/cntr"
+
 EOF
\ No newline at end of file
diff --git a/tools/cobra-cli/Dockerfile.template b/tools/cobra-cli/Dockerfile.template
index 818e013cf1..ed3d28ea2e 100644
--- a/tools/cobra-cli/Dockerfile.template
+++ b/tools/cobra-cli/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/spf13/cobra-cli
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/spf13/cobra-cli" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 https://github.com/spf13/cobra-cli .
 go build -o "${prefix}/bin/cobra-cli" .
diff --git a/tools/cockroach/Dockerfile.template b/tools/cockroach/Dockerfile.template
index 540a0b8b3a..5afb270a99 100644
--- a/tools/cockroach/Dockerfile.template
+++ b/tools/cockroach/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # download cache
 check-download "https://binaries.cockroachdb.com/cockroach-v${version}.linux-${alt_arch}.tgz"
 curl --silent --show-error --location --fail "https://binaries.cockroachdb.com/cockroach-v${version}.linux-${alt_arch}.tgz" \
 | tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
diff --git a/tools/code-server/Dockerfile.template b/tools/code-server/Dockerfile.template
index af26d3f4b0..67fbe62b1c 100644
--- a/tools/code-server/Dockerfile.template
+++ b/tools/code-server/Dockerfile.template
@@ -7,9 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "coder/code-server" "v${version}" "code-server-${version}-linux-${alt_arch}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/coder/code-server/releases/download/v${version}/code-server-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-curl --silent --show-error --location --fail "https://github.com/coder/code-server/releases/download/v${version}/code-server-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/" --strip-components=1 --no-same-owner
+check-github-release-asset "coder/code-server" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/" --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/coder/Dockerfile.template b/tools/coder/Dockerfile.template
index be857ba9ea..62bd9db577 100644
--- a/tools/coder/Dockerfile.template
+++ b/tools/coder/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "coder/coder" "v${version}" "coder_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/coder/coder/releases/download/v${version}/coder_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/coder/coder/releases/download/v${version}/coder_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "coder/coder" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ./coder
 EOF
\ No newline at end of file
diff --git a/tools/colima/Dockerfile.template b/tools/colima/Dockerfile.template
index a6c515cbd4..71e71d64d1 100644
--- a/tools/colima/Dockerfile.template
+++ b/tools/colima/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/abiosoft/colima/releases/download/v${version}/colima-Linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "abiosoft/colima" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/colima"
 
-RUN <<EOF
-check-github-release-asset "abiosoft/colima" "v${version}" "colima-Linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/colima" \
-    "https://github.com/abiosoft/colima/releases/download/v${version}/colima-Linux-${arch}"
-chmod +x "${prefix}/bin/colima"
 "${prefix}/bin/colima" completion bash >"${prefix}/share/bash-completion/completions/colima"
 "${prefix}/bin/colima" completion fish >"${prefix}/share/fish/vendor_completions.d/colima.fish"
 "${prefix}/bin/colima" completion zsh >"${prefix}/share/zsh/vendor-completions/_colima"
diff --git a/tools/compose-bridge/Dockerfile.template b/tools/compose-bridge/Dockerfile.template
index 77479deeb1..903a561ec4 100644
--- a/tools/compose-bridge/Dockerfile.template
+++ b/tools/compose-bridge/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/compose-bridge-binaries" "v${version}" "compose-bridge-linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/compose-bridge" \
-    "https://github.com/docker/compose-bridge-binaries/releases/download/v${version}/compose-bridge-linux-${arch}"
-chmod +x "${prefix}/bin/compose-bridge"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/compose-bridge-binaries/releases/download/v${version}/compose-bridge-linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/compose-bridge-binaries" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/compose-bridge"
+
 EOF
\ No newline at end of file
diff --git a/tools/composer/Dockerfile.template b/tools/composer/Dockerfile.template
index e54a9c0168..13d4653e6c 100644
--- a/tools/composer/Dockerfile.template
+++ b/tools/composer/Dockerfile.template
@@ -9,12 +9,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-COPY --from=php / /usr/local/
-RUN <<EOF
-check-github-release-asset "composer/composer" "${version}" "composer.phar"
-curl --silent --show-error --location --fail --output "${prefix}/bin/composer" \
-    "https://github.com/composer/composer/releases/download/${version}/composer.phar"
-chmod +x "${prefix}/bin/composer"
+COPY --link --from=php / /usr/local/
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/composer/composer/releases/download/${version}/composer.phar"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "composer/composer" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/composer"
+
 
 "${prefix}/bin/composer" completion bash >"${prefix}/share/bash-completion/completions/composer"
 EOF
\ No newline at end of file
diff --git a/tools/composerize/Dockerfile.template b/tools/composerize/Dockerfile.template
index db92d1378b..a6cfb64b93 100644
--- a/tools/composerize/Dockerfile.template
+++ b/tools/composerize/Dockerfile.template
@@ -15,7 +15,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/composerize
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "composerize@${version}"
diff --git a/tools/concourse/Dockerfile.template b/tools/concourse/Dockerfile.template
index e5c4a64ee3..c5864c4c8a 100644
--- a/tools/concourse/Dockerfile.template
+++ b/tools/concourse/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/concourse/concourse/releases/download/v${version}/fly-${version}-linux-amd64.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "concourse/concourse" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "concourse/concourse" "v${version}" "fly-${version}-linux-amd64.tgz"
-curl --silent --show-error --location --fail "https://github.com/concourse/concourse/releases/download/v${version}/fly-${version}-linux-amd64.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 check-github-release-asset "concourse/concourse" "v${version}" "concourse-${version}-linux-amd64.tgz"
 curl --silent --show-error --location --fail "https://github.com/concourse/concourse/releases/download/v${version}/concourse-${version}-linux-amd64.tgz" \
diff --git a/tools/conftest/Dockerfile.template b/tools/conftest/Dockerfile.template
index ac8a8a5867..12d9bad1b9 100644
--- a/tools/conftest/Dockerfile.template
+++ b/tools/conftest/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/open-policy-agent/conftest/releases/download/v${version}/conftest_${version}_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "open-policy-agent/conftest" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "open-policy-agent/conftest" "v${version}" "conftest_${version}_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/open-policy-agent/conftest/releases/download/v${version}/conftest_${version}_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     conftest
 "${prefix}/bin/conftest" completion bash >"${prefix}/share/bash-completion/completions/conftest"
 "${prefix}/bin/conftest" completion fish >"${prefix}/share/fish/vendor_completions.d/conftest.fish"
diff --git a/tools/conmon/Dockerfile.template b/tools/conmon/Dockerfile.template
index be2d1de50f..2951da12b2 100644
--- a/tools/conmon/Dockerfile.template
+++ b/tools/conmon/Dockerfile.template
@@ -9,7 +9,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     git \
@@ -35,7 +35,7 @@ apt-get -y install --no-install-recommends \
 EOF
 WORKDIR /tmp/conmon
 RUN git clone --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containers/conmon.git .
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p "${prefix}/share/man/man8"
 make -j$(nproc) git-vars bin/conmon \
     PKG_CONFIG='pkg-config --static' \
diff --git a/tools/container2wasm/Dockerfile.template b/tools/container2wasm/Dockerfile.template
index a6a3fe1c62..4845cb9b84 100644
--- a/tools/container2wasm/Dockerfile.template
+++ b/tools/container2wasm/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ktock/container2wasm" "v${version}" "container2wasm-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ktock/container2wasm/releases/download/v${version}/container2wasm-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ktock/container2wasm/releases/download/v${version}/container2wasm-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ktock/container2wasm" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 check-github-release-asset "ktock/container2wasm" "v${version}" "c2w-net-proxy.wasm"
 curl --silent --show-error --location --fail --output "${prefix}/libexec/container2wasm/c2w-net-proxy.wasm" --create-dirs \
diff --git a/tools/containerd-shim-lunatic/Dockerfile.template b/tools/containerd-shim-lunatic/Dockerfile.template
index 2019b6ea9b..b954c68392 100644
--- a/tools/containerd-shim-lunatic/Dockerfile.template
+++ b/tools/containerd-shim-lunatic/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "containerd-wasm-shims-v1-lunatic-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v1-lunatic-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v1-lunatic-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/containerd-shim-slight/Dockerfile.template b/tools/containerd-shim-slight/Dockerfile.template
index 943f061f85..acc454cb46 100644
--- a/tools/containerd-shim-slight/Dockerfile.template
+++ b/tools/containerd-shim-slight/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "containerd-wasm-shims-v1-slight-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v1-slight-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v1-slight-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/containerd-shim-spin-runwasi/Dockerfile.template b/tools/containerd-shim-spin-runwasi/Dockerfile.template
index 34281eea84..3c258cadb1 100644
--- a/tools/containerd-shim-spin-runwasi/Dockerfile.template
+++ b/tools/containerd-shim-spin-runwasi/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "containerd-wasm-shims-v2-spin-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v2-spin-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v2-spin-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/containerd-shim-spin/Dockerfile.template b/tools/containerd-shim-spin/Dockerfile.template
index c1cb3e6ee8..4fd1d38783 100644
--- a/tools/containerd-shim-spin/Dockerfile.template
+++ b/tools/containerd-shim-spin/Dockerfile.template
@@ -8,17 +8,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
-COPY --link --from=rust / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get install -y --no-install-recommends \
     protobuf-compiler \
     libseccomp-dev \
     sudo
 EOF
+COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/spinkube/containerd-shim-spin
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/spinkube/containerd-shim-spin .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/containerd-shim-wasmedge/Dockerfile.template b/tools/containerd-shim-wasmedge/Dockerfile.template
index 31ba55a38d..f6489da398 100644
--- a/tools/containerd-shim-wasmedge/Dockerfile.template
+++ b/tools/containerd-shim-wasmedge/Dockerfile.template
@@ -8,11 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
-COPY --link --from=rust / /usr/local/
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get -y update
 apt-get -y install --no-install-recommends \
     pkg-config \
@@ -25,8 +21,12 @@ apt-get -y install --no-install-recommends \
     protobuf-compiler \
     sudo
 EOF
+COPY --link --from=rust / /usr/local/
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/github.com/containerd/runwasi
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "containerd-shim-wasmedge/v${version}" https://github.com/containerd/runwasi .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/containerd-shim-wasmer/Dockerfile.template b/tools/containerd-shim-wasmer/Dockerfile.template
index 05cabb2d4b..98a403ca45 100644
--- a/tools/containerd-shim-wasmer/Dockerfile.template
+++ b/tools/containerd-shim-wasmer/Dockerfile.template
@@ -8,11 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
-COPY --link --from=rust / /usr/local/
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get -y update
 apt-get -y install --no-install-recommends \
     pkg-config \
@@ -25,8 +21,12 @@ apt-get -y install --no-install-recommends \
     protobuf-compiler \
     sudo
 EOF
+COPY --link --from=rust / /usr/local/
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/github.com/containerd/runwasi
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 set -e -x
 git clone -q --config advice.detachedHead=false --depth 1 --branch "containerd-shim-wasmer/v${version}" https://github.com/containerd/runwasi .
 export CARGO_HOME=/usr/local/cargo
diff --git a/tools/containerd-shim-wasmtime/Dockerfile.template b/tools/containerd-shim-wasmtime/Dockerfile.template
index a9e3e66eaf..1c0cf29bd1 100644
--- a/tools/containerd-shim-wasmtime/Dockerfile.template
+++ b/tools/containerd-shim-wasmtime/Dockerfile.template
@@ -8,11 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
-COPY --link --from=rust / /usr/local/
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get -y update
 apt-get -y install --no-install-recommends \
     pkg-config \
@@ -25,8 +21,12 @@ apt-get -y install --no-install-recommends \
     protobuf-compiler \
     sudo
 EOF
+COPY --link --from=rust / /usr/local/
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/github.com/containerd/runwasi
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "containerd-shim-wasmtime/v${version}" https://github.com/containerd/runwasi .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/containerd-shim-wws/Dockerfile.template b/tools/containerd-shim-wws/Dockerfile.template
index 34d40b7d19..147532158a 100644
--- a/tools/containerd-shim-wws/Dockerfile.template
+++ b/tools/containerd-shim-wws/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "containerd-wasm-shims-v1-wws-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v1-wws-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/deislabs/containerd-wasm-shims/releases/download/v${version}/containerd-wasm-shims-v1-wws-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "deislabs/containerd-wasm-shims" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/containerd/Dockerfile.template b/tools/containerd/Dockerfile.template
index 8350e8b53e..8414ede9a8 100644
--- a/tools/containerd/Dockerfile.template
+++ b/tools/containerd/Dockerfile.template
@@ -13,16 +13,22 @@ ARG version
 COPY 10-containerd-net.conflist "/uniget_bootstrap/etc/cni/net.d/"
 COPY runtimes.toml "/uniget_bootstrap/etc/containerd/conf.d/runtimes.toml"
 COPY snapshotters.toml "/uniget_bootstrap/etc/containerd/conf.d/snapshotters.toml"
-RUN <<EOF
-check-github-release-asset "containerd/containerd" "v${version}" "containerd-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containerd/containerd/releases/download/v${version}/containerd-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containerd/containerd/releases/download/v${version}/containerd-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containerd/containerd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --no-same-owner
 
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/containerd.service.go-template" \
     "https://github.com/containerd/containerd/raw/v${version}/containerd.service"
 sed -i -E "s|^ExecStart=/usr/local/bin/containerd|ExecStart={{ .Target }}/bin/containerd|" "${prefix}/etc/systemd/system/containerd.service.go-template"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man8/containerd-config.8.md" \
     "https://github.com/containerd/containerd/raw/v${version}/docs/man/containerd-config.8.md"
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man5/containerd-config.toml.5.md" \
@@ -37,7 +43,7 @@ rm \
     "${prefix}/share/man/man8/containerd-config.8.md" \
     "${prefix}/share/man/man5/containerd-config.toml.5.md"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p \
     /etc/containerd/conf.d \
     /etc/containerd/certs.d
diff --git a/tools/containers-common/Dockerfile.template b/tools/containers-common/Dockerfile.template
index 02002adc89..696fd53fd0 100644
--- a/tools/containers-common/Dockerfile.template
+++ b/tools/containers-common/Dockerfile.template
@@ -10,7 +10,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=go-md2man / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 for file in \
     Containerfile.5 \
     containerignore.5 \
diff --git a/tools/containers-image/Dockerfile.template b/tools/containers-image/Dockerfile.template
index 3c3e3fb172..ee6fe27090 100644
--- a/tools/containers-image/Dockerfile.template
+++ b/tools/containers-image/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go-md2man / /usr/local/
 WORKDIR /tmp/containers-image
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 for file in \
     containers-auth.json.5 \
     containers-certs.d.5 \
diff --git a/tools/containers-storage/Dockerfile.template b/tools/containers-storage/Dockerfile.template
index ee6d620aa1..0eba357f57 100644
--- a/tools/containers-storage/Dockerfile.template
+++ b/tools/containers-storage/Dockerfile.template
@@ -15,7 +15,7 @@ COPY --link --from=go-md2man / /usr/local/
 WORKDIR /tmp/containers-storage
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://github.com/containers/storage" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containers/storage .
 make containers-storage
diff --git a/tools/containerssh/Dockerfile.template b/tools/containerssh/Dockerfile.template
index 42b9f84627..882d8c14ea 100644
--- a/tools/containerssh/Dockerfile.template
+++ b/tools/containerssh/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ContainerSSH/ContainerSSH/releases/download/v${version}/containerssh_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ContainerSSH/ContainerSSH" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "ContainerSSH/ContainerSSH" "v${version}" "containerssh_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ContainerSSH/ContainerSSH/releases/download/v${version}/containerssh_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     containerssh \
     containerssh-auditlog-decoder \
     containerssh-testauthconfigserver
diff --git a/tools/copa/Dockerfile.template b/tools/copa/Dockerfile.template
index 6257d7a8a6..ee4c08d703 100644
--- a/tools/copa/Dockerfile.template
+++ b/tools/copa/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "project-copacetic/copacetic" "v${version}" "copa_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/project-copacetic/copacetic/releases/download/v${version}/copa_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/project-copacetic/copacetic/releases/download/v${version}/copa_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "project-copacetic/copacetic" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     copa
     
 "${prefix}/bin/copa" completion bash >"${prefix}/share/bash-completion/completions/copa"
diff --git a/tools/cosign/Dockerfile.template b/tools/cosign/Dockerfile.template
index 6fe0571863..882e2af9b8 100644
--- a/tools/cosign/Dockerfile.template
+++ b/tools/cosign/Dockerfile.template
@@ -9,17 +9,23 @@ ARG TARGETPLATFORM
 # renovate: datasource=github-releases depName=sigstore/cosign extractVersion=^v(?<version>.+?)$
 ARG COSIGN_VERSION=2.2.3
 COPY checksums.txt .
-RUN <<EOF
-check-github-release-asset "sigstore/cosign" "v${COSIGN_VERSION}" "cosign-linux-${alt_arch}"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sigstore/cosign" "v${COSIGN_VERSION}" "${filename}"
 echo "### Installing cosign ${COSIGN_VERSION} for bootstrapping on ${TARGETPLATFORM} (${alt_arch})"
-curl --silent --show-error --location --fail --remote-name \
-    "https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-${alt_arch}"
-chmod +x "cosign-linux-${alt_arch}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking cosign ${COSIGN_VERSION} for bootstrapping"
+pushd "${uniget_cache_download}"
 sha256sum --check --ignore-missing checksums.txt
+popd
 
-mv "cosign-linux-${alt_arch}" /usr/local/bin/cosign
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    /usr/local/bin/cosign
 cosign version
 EOF
 
@@ -31,37 +37,40 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=cosign-bootstrap /usr/local/bin/cosign /usr/local/bin/
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "sigstore/cosign" "v${version}" "cosign-linux-${alt_arch}"
-echo "### Installing cosign ${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/cosign" \
-    "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-${alt_arch}"
-chmod +x "${prefix}/bin/cosign"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-${alt_arch}"
+filename="$( basename "${url}" )"
 
-echo "### Installing shell completion for cosign ${version}"
-"${prefix}/bin/cosign" completion bash >"${prefix}/share/bash-completion/completions/cosign"
-"${prefix}/bin/cosign" completion fish >"${prefix}/share/fish/vendor_completions.d/cosign.fish"
-"${prefix}/bin/cosign" completion zsh >"${prefix}/share/zsh/vendor-completions/_cosign"
+check-github-release-asset "sigstore/cosign" "v${version}" "${filename}"
+echo "### Installing cosign ${version}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking PGP signature for cosign ${version}"
-curl --silent --show-error --location --fail --output "cosign-linux-${alt_arch}.sig" \
-    "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-${alt_arch}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
 COSIGN_PUB_KEY="https://github.com/sigstore/cosign/releases/download/v${version}/release-cosign.pub"
-cosign verify-blob --key "${COSIGN_PUB_KEY}" --signature "cosign-linux-${alt_arch}.sig" "${prefix}/bin/cosign"
-rm -f "cosign-linux-${alt_arch}.sig"
+cosign verify-blob --key "${COSIGN_PUB_KEY}" --signature "${uniget_cache_download}/${filename}.sig" "${prefix}/bin/cosign"
 
 echo "### Checking keyless signature for cosign ${version}"
-curl --silent --show-error --location --fail --output "cosign-linux-${alt_arch}-keyless.pem" \
-    "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-${alt_arch}-keyless.pem"
-curl --silent --show-error --location --fail --output "cosign-linux-${alt_arch}-keyless.sig" \
-    "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-${alt_arch}-keyless.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}-keyless.pem" \
+    "${url}-keyless.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}-keyless.sig" \
+    "${url}-keyless.sig"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "cosign-linux-${alt_arch}-keyless.pem" \
-    --signature "cosign-linux-${alt_arch}-keyless.sig" \
+    --cert "${uniget_cache_download}/${filename}-keyless.pem" \
+    --signature "${uniget_cache_download}/${filename}-keyless.sig" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity "keyless@projectsigstore.iam.gserviceaccount.com" \
-    "${prefix}/bin/cosign"
-rm -f "cosign-linux-${alt_arch}-keyless.pem" "cosign-linux-${alt_arch}-keyless.sig"
+    "${uniget_cache_download}/${filename}"
 
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/cosign"
 "${prefix}/bin/cosign" version
+
+echo "### Installing shell completion for cosign ${version}"
+"${prefix}/bin/cosign" completion bash >"${prefix}/share/bash-completion/completions/cosign"
+"${prefix}/bin/cosign" completion fish >"${prefix}/share/fish/vendor_completions.d/cosign.fish"
+"${prefix}/bin/cosign" completion zsh >"${prefix}/share/zsh/vendor-completions/_cosign"
 EOF
\ No newline at end of file
diff --git a/tools/cowsay/Dockerfile.template b/tools/cowsay/Dockerfile.template
index a596eea61f..dfa33802e8 100644
--- a/tools/cowsay/Dockerfile.template
+++ b/tools/cowsay/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Code-Hex/Neo-cowsay/releases/download/v${version}/cowsay_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Code-Hex/Neo-cowsay" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "Code-Hex/Neo-cowsay" "v${version}" "cowsay_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Code-Hex/Neo-cowsay/releases/download/v${version}/cowsay_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     cowsay \
     cowthink
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/cowsay.1" \
diff --git a/tools/crane/Dockerfile.template b/tools/crane/Dockerfile.template
index 5560570d9f..7cf612dcf2 100644
--- a/tools/crane/Dockerfile.template
+++ b/tools/crane/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,11 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "google/go-containerregistry" "v${version}" "go-containerregistry_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/google/go-containerregistry/releases/download/v${version}/go-containerregistry_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading crane ${version}"
-curl --silent --show-error --location --fail "https://github.com/google/go-containerregistry/releases/download/v${version}/go-containerregistry_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+check-github-release-asset "google/go-containerregistry" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     crane
     
 "${prefix}/bin/crane" completion bash >"${prefix}/share/bash-completion/completions/crane"
diff --git a/tools/cri-dockerd/Dockerfile.template b/tools/cri-dockerd/Dockerfile.template
index 1df84c93b4..514cb533f8 100644
--- a/tools/cri-dockerd/Dockerfile.template
+++ b/tools/cri-dockerd/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Mirantis/cri-dockerd" "v${version}" "cri-dockerd-${version}.${alt_arch}.tgz"
-curl --silent --show-error --location --fail "https://github.com/Mirantis/cri-dockerd/releases/download/v${version}/cri-dockerd-${version}.${alt_arch}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Mirantis/cri-dockerd/releases/download/v${version}/cri-dockerd-${version}.${alt_arch}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Mirantis/cri-dockerd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     cri-dockerd
 
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/cri-docker.service.go-template" \
diff --git a/tools/cri-o/Dockerfile.template b/tools/cri-o/Dockerfile.template
index 444e50ee2c..dacdc1ca35 100644
--- a/tools/cri-o/Dockerfile.template
+++ b/tools/cri-o/Dockerfile.template
@@ -13,30 +13,37 @@ COPY --from=go-md2man / /usr/local/
 ARG name
 ARG version
 COPY crio.conf /uniget_bootstrap/etc/crio.conf
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://storage.googleapis.com/cri-o/artifacts/cri-o.${alt_arch}.v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
 echo "### Downloading cri-o ${version}"
-check-download "https://storage.googleapis.com/cri-o/artifacts/cri-o.${alt_arch}.v${version}.tar.gz"
-curl --silent --show-error --location --fail --remote-name "https://storage.googleapis.com/cri-o/artifacts/cri-o.${alt_arch}.v${version}.tar.gz"
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking keyless signature for cri-o ${version}"
-curl --silent --show-error --location --fail --remote-name "https://storage.googleapis.com/cri-o/artifacts/cri-o.${alt_arch}.v${version}.tar.gz.sig"
-curl --silent --show-error --location --fail --remote-name "https://storage.googleapis.com/cri-o/artifacts/cri-o.${alt_arch}.v${version}.tar.gz.cert"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
 SHA="$(
     git ls-remote --tags https://github.com/cri-o/cri-o "v${version}" \
     | cut -f1
 )"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "cri-o.${alt_arch}.v${version}.tar.gz.cert" \
-    --signature "cri-o.${alt_arch}.v${version}.tar.gz.sig" \
+    --cert "${uniget_cache_download}/${filename}.cert" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
-    "cri-o.${alt_arch}.v${version}.tar.gz"
+    "${uniget_cache_download}/${filename}"
 
 echo "### Installing cri-o ${version}"
-tar --file "cri-o.${alt_arch}.v${version}.tar.gz" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner \
     cri-o/bin/crio
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/share/bash-completion/completions/crio" \
     "https://github.com/cri-o/cri-o/raw/v${version}/completions/bash/crio"
 curl --silent --show-error --location --fail --output "${prefix}/share/fish/vendor_completions.d/crio.fish" \
@@ -44,7 +51,7 @@ curl --silent --show-error --location --fail --output "${prefix}/share/fish/vend
 curl --silent --show-error --location --fail --output "${prefix}/share/zsh/vendor-completions/_crio" \
     "https://github.com/cri-o/cri-o/raw/v${version}/completions/zsh/_crio"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p \
     "${prefix}/etc/sysconfig"
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/crio.service.go-template" \
@@ -58,7 +65,7 @@ sed -i -E 's|^ExecStart=/usr/local/bin/crio|ExecStart={{ .Target }}/bin/crio|' "
 curl --silent --show-error --location --fail --output "${prefix}/etc/sysconfig/crio" \
     "https://github.com/cri-o/cri-o/raw/v${version}/contrib/sysconfig/crio"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p \
     "${prefix}/etc/cni/net.d"
 curl --silent --show-error --location --fail --output "${prefix}/etc/cni/net.d/10-crio-bridge.conflist" \
@@ -68,7 +75,7 @@ curl --silent --show-error --location --fail --output "${prefix}/etc/cni/net.d/1
 curl --silent --show-error --location --fail --output "${prefix}/etc/cni/net.d/99-loopback.conflist" \
     "https://github.com/cri-o/cri-o/raw/v${version}/contrib/cni/99-loopback.conflist"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man8/crio.8.md" \
     "https://github.com/cri-o/cri-o/raw/v${version}/docs/crio.8.md"
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man5/crio.conf.5.md" \
diff --git a/tools/crictl/Dockerfile.template b/tools/crictl/Dockerfile.template
index b3bc0150ba..0aea2a56f2 100644
--- a/tools/crictl/Dockerfile.template
+++ b/tools/crictl/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/cri-tools" "v${version}" "crictl-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kubernetes-sigs/cri-tools/releases/download/v${version}/crictl-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory "${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/cri-tools/releases/download/v${version}/crictl-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/cri-tools" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
 COPY crictl.yaml "/uniget_bootstrap/etc/"
\ No newline at end of file
diff --git a/tools/croc/Dockerfile.template b/tools/croc/Dockerfile.template
index f7a53f21b4..26e5d24029 100644
--- a/tools/croc/Dockerfile.template
+++ b/tools/croc/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "schollz/croc" "v${version}" "croc_v${version}_Linux-${arch_suffix}.tar.gz"
+url="https://github.com/schollz/croc/releases/download/v${version}/croc_v${version}_Linux-${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading croc ${version}"
-curl --silent --show-error --location --fail "https://github.com/schollz/croc/releases/download/v${version}/croc_v${version}_Linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "schollz/croc" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     croc
 EOF
\ No newline at end of file
diff --git a/tools/cross/Dockerfile.template b/tools/cross/Dockerfile.template
index 7bbbc30505..591a2fae0b 100644
--- a/tools/cross/Dockerfile.template
+++ b/tools/cross/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cross-rs/cross" "v${version}" "cross-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cross-rs/cross/releases/download/v${version}/cross-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cross-rs/cross/releases/download/v${version}/cross-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cross-rs/cross" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/crossplane/Dockerfile.template b/tools/crossplane/Dockerfile.template
index cf34f83662..553791b6cc 100644
--- a/tools/crossplane/Dockerfile.template
+++ b/tools/crossplane/Dockerfile.template
@@ -7,8 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubectl-crossplane" \
-    "https://releases.crossplane.io/stable/v${version}/bin/linux_${alt_arch}/crank"
-chmod +x "${prefix}/bin/kubectl-crossplane"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://releases.crossplane.io/stable/v${version}/bin/linux_${alt_arch}/crank"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubectl-crossplane"
 EOF
\ No newline at end of file
diff --git a/tools/crun/Dockerfile.template b/tools/crun/Dockerfile.template
index 743d1df0b5..10d9056f3d 100644
--- a/tools/crun/Dockerfile.template
+++ b/tools/crun/Dockerfile.template
@@ -5,7 +5,7 @@ ARG name
 ARG version
 WORKDIR /tmp/crun
 RUN git clone --config advice.detachedHead=false --depth 1 --recursive --branch "${version}" https://github.com/containers/crun.git .
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p /usr/local/bin/ /usr/local/share/man/man1/
 nix build -f nix --extra-experimental-features nix-command
 cp -rfp ./result/bin/crun /usr/local/bin/
diff --git a/tools/csvlens/Dockerfile.template b/tools/csvlens/Dockerfile.template
index 538107f5b3..af41af5882 100644
--- a/tools/csvlens/Dockerfile.template
+++ b/tools/csvlens/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/YS-L/csvlens
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/YS-L/csvlens .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/ct/Dockerfile.template b/tools/ct/Dockerfile.template
index 308d80a1bc..f2071f06c5 100644
--- a/tools/ct/Dockerfile.template
+++ b/tools/ct/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/flatcar/container-linux-config-transpiler
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/flatcar/container-linux-config-transpiler .
 make -j$(nproc)
 cp bin/ct "${prefix}/bin/"
diff --git a/tools/ct_server/Dockerfile.template b/tools/ct_server/Dockerfile.template
index dd91aefe23..3cd968ab10 100644
--- a/tools/ct_server/Dockerfile.template
+++ b/tools/ct_server/Dockerfile.template
@@ -12,7 +12,7 @@ ARG name
 ARG version
 COPY ct_server.service.go-template /uniget_bootstrap/etc/systemd/system/
 WORKDIR /go/src/github.com/google/certificate-transparency-go
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/google/certificate-transparency-go .
 export CGO_ENABLED=0
 go build -ldflags "-w -s" -o "${prefix}/bin/ct_server" ./trillian/ctfe/ct_server
diff --git a/tools/ctop/Dockerfile.template b/tools/ctop/Dockerfile.template
index a5ff37a5ba..999dfd00f9 100644
--- a/tools/ctop/Dockerfile.template
+++ b/tools/ctop/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/bcicen/ctop/releases/download/v${version}/ctop-${version}-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "bcicen/ctop" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ctop"
 
-RUN <<EOF
-check-github-release-asset "bcicen/ctop" "v${version}" "ctop-${version}-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ctop" \
-    "https://github.com/bcicen/ctop/releases/download/v${version}/ctop-${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/ctop"
 EOF
\ No newline at end of file
diff --git a/tools/cue/Dockerfile.template b/tools/cue/Dockerfile.template
index e99e1dcc17..9f32bb5174 100644
--- a/tools/cue/Dockerfile.template
+++ b/tools/cue/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cue-lang/cue/releases/download/v${version}/cue_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cue-lang/cue" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "cue-lang/cue" "v${version}" "cue_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cue-lang/cue/releases/download/v${version}/cue_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     cue
 "${prefix}/bin/cue" completion bash >"${prefix}/share/bash-completion/completions/cue"
 "${prefix}/bin/cue" completion fish >"${prefix}/share/fish/vendor_completions.d/cue.fish"
diff --git a/tools/curl/Dockerfile.template b/tools/curl/Dockerfile.template
index d9695e3f04..2dd2fe64ef 100644
--- a/tools/curl/Dockerfile.template
+++ b/tools/curl/Dockerfile.template
@@ -5,8 +5,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 ENV CC=clang
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     clang \
     openssl-dev \
     nghttp2-dev \
@@ -29,10 +29,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/curl
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "curl/curl" "curl-${version//./_}" "curl-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/curl/curl/releases/download/curl-${version//./_}/curl-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/curl/curl/releases/download/curl-${version//./_}/curl-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "curl/curl" "curl-${version//./_}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
 LDFLAGS="-static" \
 PKG_CONFIG="pkg-config --static" \
     ./configure \
diff --git a/tools/curlie/Dockerfile.template b/tools/curlie/Dockerfile.template
index 4f3963cd4f..2f07930ddf 100644
--- a/tools/curlie/Dockerfile.template
+++ b/tools/curlie/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rs/curlie" "v${version}" "curlie_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/rs/curlie/releases/download/v${version}/curlie_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rs/curlie/releases/download/v${version}/curlie_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rs/curlie" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     curlie
 EOF
\ No newline at end of file
diff --git a/tools/cve-bin-tool/Dockerfile.template b/tools/cve-bin-tool/Dockerfile.template
index 34792337aa..173e6f4eff 100644
--- a/tools/cve-bin-tool/Dockerfile.template
+++ b/tools/cve-bin-tool/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/cve-bin-tool" --console-script cve-bin-tool "cve-bin-tool==${version}"
 EOF
diff --git a/tools/cvemap/Dockerfile.template b/tools/cvemap/Dockerfile.template
index 7f9cb57532..634188a7d8 100644
--- a/tools/cvemap/Dockerfile.template
+++ b/tools/cvemap/Dockerfile.template
@@ -7,12 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/cvemap" "v${version}" "cvemap_${version}_linux_${alt_arch}.zip"
-
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/cvemap/releases/download/v${version}/cvemap_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/cvemap" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     cvemap
 EOF
\ No newline at end of file
diff --git a/tools/cyclonedx-cli/Dockerfile.template b/tools/cyclonedx-cli/Dockerfile.template
index 505973a10b..b7008147a5 100644
--- a/tools/cyclonedx-cli/Dockerfile.template
+++ b/tools/cyclonedx-cli/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/CycloneDX/cyclonedx-cli/releases/download/v${version}/cyclonedx-linux-x64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "CycloneDX/cyclonedx-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/cyclonedx-cli"
 
-RUN <<EOF
-check-github-release-asset "CycloneDX/cyclonedx-cli" "v${version}" "cyclonedx-linux-x64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/cyclonedx-cli" \
-    "https://github.com/CycloneDX/cyclonedx-cli/releases/download/v${version}/cyclonedx-linux-x64"
-chmod +x "${prefix}/bin/cyclonedx-cli"
 EOF
\ No newline at end of file
diff --git a/tools/cyclonedx-gomod/Dockerfile.template b/tools/cyclonedx-gomod/Dockerfile.template
index 757b90f3fc..27f1774ff9 100644
--- a/tools/cyclonedx-gomod/Dockerfile.template
+++ b/tools/cyclonedx-gomod/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "CycloneDX/cyclonedx-gomod" "v${version}" "cyclonedx-gomod_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/CycloneDX/cyclonedx-gomod/releases/download/v${version}/cyclonedx-gomod_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/CycloneDX/cyclonedx-gomod/releases/download/v${version}/cyclonedx-gomod_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "CycloneDX/cyclonedx-gomod" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     cyclonedx-gomod
 EOF
\ No newline at end of file
diff --git a/tools/cypher-shell/Dockerfile.template b/tools/cypher-shell/Dockerfile.template
index f252a49b63..f297fe16ce 100644
--- a/tools/cypher-shell/Dockerfile.template
+++ b/tools/cypher-shell/Dockerfile.template
@@ -7,12 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-mkdir -p "${prefix}/opt"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://dist.neo4j.org/cypher-shell/cypher-shell-${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/opt/" "${filename}"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+mkdir -p "${prefix}/opt"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt/" "${uniget_cache_download}/${filename}"
+
 mv "${prefix}/opt/cypher-shell-${version}" "${prefix}/opt/cypher-shell"
 ln --symbolic --relative --force "/opt/cypher-shell/bin/cypher-shell" "${prefix}/bin/"
 EOF
\ No newline at end of file
diff --git a/tools/dagger/Dockerfile.template b/tools/dagger/Dockerfile.template
index 70b40913fe..5b54555255 100644
--- a/tools/dagger/Dockerfile.template
+++ b/tools/dagger/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dagger/dagger" "v${version}" "dagger_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/dagger/dagger/releases/download/v${version}/dagger_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dagger/dagger/releases/download/v${version}/dagger_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dagger/dagger" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     dagger
 EOF
\ No newline at end of file
diff --git a/tools/dart/Dockerfile.template b/tools/dart/Dockerfile.template
index 587cb03178..3f6bf6209b 100644
--- a/tools/dart/Dockerfile.template
+++ b/tools/dart/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -24,12 +24,16 @@ esac
 echo "    Using ${arch_suffix}"
 
 url="https://storage.googleapis.com/dart-archive/channels/stable/release/${version}/sdk/dartsdk-linux-${arch_suffix}-release.zip"
-check-download "${url}"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/opt"
-unzip -q -o -d "${prefix}/opt/" "${filename}"
-rm "${filename}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt/" "${uniget_cache_download}/${filename}"
+
 mv "${prefix}/opt/dart-sdk" "${prefix}/opt/dart"
 
 ln --symbolic --relative --force \
diff --git a/tools/dasel/Dockerfile.template b/tools/dasel/Dockerfile.template
index 44344fc0e2..256fc915e0 100644
--- a/tools/dasel/Dockerfile.template
+++ b/tools/dasel/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/TomWright/dasel/releases/download/v${version}/dasel_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "TomWright/dasel" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/dasel"
 
-RUN <<EOF
-check-github-release-asset "TomWright/dasel" "v${version}" "dasel_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/dasel" \
-    "https://github.com/TomWright/dasel/releases/download/v${version}/dasel_linux_${alt_arch}"
-chmod +x "${prefix}/bin/dasel"
 EOF
\ No newline at end of file
diff --git a/tools/datree/Dockerfile.template b/tools/datree/Dockerfile.template
index 84a7ee75ad..5544e47412 100644
--- a/tools/datree/Dockerfile.template
+++ b/tools/datree/Dockerfile.template
@@ -7,16 +7,22 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "datreeio/datree" "${version}" "datree-cli_${version}_Linux_${arch}.zip"
-curl --silent --show-error --location --fail --remote-name "https://github.com/datreeio/datree/releases/download/${version}/datree-cli_${version}_Linux_${arch}.zip"
-unzip -q -o -d "/tmp" "datree-cli_${version}_Linux_${arch}.zip"
-rm "datree-cli_${version}_Linux_${arch}.zip"
-mv "/tmp/datree" "${prefix}/bin"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/datreeio/datree/releases/download/${version}/datree-cli_${version}_Linux_${arch}.zip"
+filename="$(basename "${url}")"
+
+check-github-release-asset "datreeio/datree" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
+    "datree"
+
 "${prefix}/bin/datree" completion bash >"${prefix}/share/bash-completion/completions/datree"
 "${prefix}/bin/datree" completion fish >"${prefix}/share/fish/vendor_completions.d/datree.fish"
 "${prefix}/bin/datree" completion zsh >"${prefix}/share/zsh/vendor-completions/_datree"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 "${prefix}/bin/datree" config set offline local
 EOF
\ No newline at end of file
diff --git a/tools/daytona/Dockerfile.template b/tools/daytona/Dockerfile.template
index eab02833df..1b1b10ec96 100644
--- a/tools/daytona/Dockerfile.template
+++ b/tools/daytona/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://download.daytona.io/daytona/v${version}/daytona-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/daytona" \
-    "https://download.daytona.io/daytona/v${version}/daytona-linux-${alt_arch}"
-chmod +x "${prefix}/bin/daytona"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://download.daytona.io/daytona/v${version}/daytona-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/daytona"
+
 EOF
\ No newline at end of file
diff --git a/tools/dbui/Dockerfile.template b/tools/dbui/Dockerfile.template
index ecf854b140..72ba426dd6 100644
--- a/tools/dbui/Dockerfile.template
+++ b/tools/dbui/Dockerfile.template
@@ -5,13 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/KenanBek/dbui/releases/download/v${version}/dbui_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "KenanBek/dbui" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "KenanBek/dbui" "v${version}" "dbui_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/KenanBek/dbui/releases/download/v${version}/dbui_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     dbui
 EOF
\ No newline at end of file
diff --git a/tools/dcp/Dockerfile.template b/tools/dcp/Dockerfile.template
index dba0d6eeb4..4c60d07a53 100644
--- a/tools/dcp/Dockerfile.template
+++ b/tools/dcp/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/exdx/dcp
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/exdx/dcp .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/ddosify/Dockerfile.template b/tools/ddosify/Dockerfile.template
index 9bd4fe1767..9363de05dc 100644
--- a/tools/ddosify/Dockerfile.template
+++ b/tools/ddosify/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ddosify/ddosify" "v${version}" "ddosify_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ddosify/ddosify/releases/download/v${version}/ddosify_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ddosify/ddosify/releases/download/v${version}/ddosify_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ddosify/ddosify" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ddosify
 EOF
\ No newline at end of file
diff --git a/tools/decktape/Dockerfile.template b/tools/decktape/Dockerfile.template
index eac6a9bf78..4821a03b76 100644
--- a/tools/decktape/Dockerfile.template
+++ b/tools/decktape/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/decktape
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "decktape@${version}"
diff --git a/tools/delta/Dockerfile.template b/tools/delta/Dockerfile.template
index da3c66187d..d17ac04304 100644
--- a/tools/delta/Dockerfile.template
+++ b/tools/delta/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/dandavison/delta
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/dandavison/delta .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/deno/Dockerfile.template b/tools/deno/Dockerfile.template
index 86374951aa..cd4f11eba0 100644
--- a/tools/deno/Dockerfile.template
+++ b/tools/deno/Dockerfile.template
@@ -7,17 +7,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "denoland/deno" "v${version}" "deno-${arch}-unknown-linux-gnu.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/denoland/deno/releases/download/v${version}/deno-${arch}-unknown-linux-gnu.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
+check-github-release-asset "denoland/deno" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 unzip -q -o -d "${prefix}/bin" "${filename}"
 
-check-github-release-asset "denoland/deno" "v${version}" "denort-${arch}-unknown-linux-gnu.zip"
 url="https://github.com/denoland/deno/releases/download/v${version}/denort-${arch}-unknown-linux-gnu.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
+check-github-release-asset "denoland/deno" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 unzip -q -o -d "${prefix}/bin" "${filename}"
 
 "${prefix}/bin/deno" completions bash >"${prefix}/share/bash-completion/completions/deno"
diff --git a/tools/dep-tree/Dockerfile.template b/tools/dep-tree/Dockerfile.template
index 88bbedd14b..f90e46a427 100644
--- a/tools/dep-tree/Dockerfile.template
+++ b/tools/dep-tree/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gabotechs/dep-tree" "v${version}" "dep-tree_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gabotechs/dep-tree/releases/download/v${version}/dep-tree_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gabotechs/dep-tree/releases/download/v${version}/dep-tree_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gabotechs/dep-tree" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     dep-tree
 EOF
\ No newline at end of file
diff --git a/tools/dependency-check/Dockerfile.template b/tools/dependency-check/Dockerfile.template
index c1b13bb526..1bf079dd27 100644
--- a/tools/dependency-check/Dockerfile.template
+++ b/tools/dependency-check/Dockerfile.template
@@ -7,12 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jeremylong/DependencyCheck" "v${version}" "dependency-check-${version}-release.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/jeremylong/DependencyCheck/releases/download/v${version}/dependency-check-${version}-release.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/opt" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jeremylong/DependencyCheck" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt" "${uniget_cache_download}/${filename}"
 ln --symbolic --relative --force "/opt/dependency-check/bin/dependency-check.sh" "${prefix}/bin/dependency-check.sh"
 mv "${prefix}/opt/dependency-check/bin/completion-for-dependency-check.sh" "${prefix}/share/bash-completion/completions/dependency-check.sh"
 EOF
\ No newline at end of file
diff --git a/tools/depot/Dockerfile.template b/tools/depot/Dockerfile.template
index 0dea84b9b8..dd8cc41707 100644
--- a/tools/depot/Dockerfile.template
+++ b/tools/depot/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "depot/cli" "v${version}" "depot_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/depot/cli/releases/download/v${version}/depot_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/depot/cli/releases/download/v${version}/depot_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "depot/cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     bin/depot
 
 "${prefix}/bin/depot" completion bash >"${prefix}/share/bash-completion/completions/depot"
diff --git a/tools/devbox/Dockerfile.template b/tools/devbox/Dockerfile.template
index 5040d82954..c88b532a2a 100644
--- a/tools/devbox/Dockerfile.template
+++ b/tools/devbox/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jetify-com/devbox" "${version}" "devbox_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jetify-com/devbox/releases/download/${version}/devbox_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jetify-com/devbox/releases/download/${version}/devbox_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jetify-com/devbox" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/devbox" completion bash >"${prefix}/share/bash-completion/completions/devbox"
 "${prefix}/bin/devbox" completion fish >"${prefix}/share/fish/vendor_completions.d/devbox.fish"
diff --git a/tools/devcontainer/Dockerfile.template b/tools/devcontainer/Dockerfile.template
index 28eb093fcb..7a5f33bbec 100644
--- a/tools/devcontainer/Dockerfile.template
+++ b/tools/devcontainer/Dockerfile.template
@@ -17,7 +17,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/devcontainer
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "@devcontainers/cli@${version}"
diff --git a/tools/devpod/Dockerfile.template b/tools/devpod/Dockerfile.template
index fc52c837de..fafd73675d 100644
--- a/tools/devpod/Dockerfile.template
+++ b/tools/devpod/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "loft-sh/devpod" "v${version}" "devpod-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/devpod" \
-    "https://github.com/loft-sh/devpod/releases/download/v${version}/devpod-linux-${alt_arch}"
-chmod +x "${prefix}/bin/devpod"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/loft-sh/devpod/releases/download/v${version}/devpod-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "loft-sh/devpod" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/devpod"
+
 
 "${prefix}/bin/devpod" completion bash >"${prefix}/share/bash-completion/completions/devpod"
 "${prefix}/bin/devpod" completion fish >"${prefix}/share/fish/vendor_completions.d/devpod.fish"
diff --git a/tools/diffoci/Dockerfile.template b/tools/diffoci/Dockerfile.template
index 518be97536..40ef891c5b 100644
--- a/tools/diffoci/Dockerfile.template
+++ b/tools/diffoci/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "reproducible-containers/diffoci" "v${version}" "diffoci-v${version}.linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/diffoci" \
-    "https://github.com/reproducible-containers/diffoci/releases/download/v${version}/diffoci-v${version}.linux-${alt_arch}"
-chmod +x "${prefix}/bin/diffoci"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/reproducible-containers/diffoci/releases/download/v${version}/diffoci-v${version}.linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "reproducible-containers/diffoci" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/diffoci"
+
 
 "${prefix}/bin/diffoci" completion bash >"${prefix}/share/bash-completion/completions/diffoci"
 "${prefix}/bin/diffoci" completion fish >"${prefix}/share/fish/vendor_completions.d/diffoci.fish"
diff --git a/tools/dinit/Dockerfile.template b/tools/dinit/Dockerfile.template
index 5a9d422bbe..2c777f7cfa 100644
--- a/tools/dinit/Dockerfile.template
+++ b/tools/dinit/Dockerfile.template
@@ -7,8 +7,13 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/dinit" \
-    "https://gitlab.com/tozd/dinit/-/releases/v${version}/downloads/linux-${alt_arch}/dinit"
-chmod +x "${prefix}/bin/dinit"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.com/tozd/dinit/-/releases/v${version}/downloads/linux-${alt_arch}/dinit"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/dinit"
 EOF
\ No newline at end of file
diff --git a/tools/direnv/Dockerfile.template b/tools/direnv/Dockerfile.template
index 0adebe414b..33bea61e17 100644
--- a/tools/direnv/Dockerfile.template
+++ b/tools/direnv/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "direnv/direnv" "v${version}" "direnv.linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/direnv" \
-    "https://github.com/direnv/direnv/releases/download/v${version}/direnv.linux-${alt_arch}"
-chmod +x "${prefix}/bin/direnv"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/direnv/direnv/releases/download/v${version}/direnv.linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "direnv/direnv" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/direnv"
+
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/direnv-fetchurl.1" \
     "https://github.com/direnv/direnv/raw/v${version}/man/direnv-fetchurl.1"
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/direnv-stdlib.1" \
diff --git a/tools/distrobox/Dockerfile.template b/tools/distrobox/Dockerfile.template
index 3af185ae34..54ba57cbc4 100644
--- a/tools/distrobox/Dockerfile.template
+++ b/tools/distrobox/Dockerfile.template
@@ -8,9 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/distrobox
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/89luca89/distrobox/archive/refs/tags/${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/89luca89/distrobox/archive/refs/tags/${version}.tar.gz"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 ./install --prefix="${prefix}"
 mv "${prefix}/share/zsh/site-functions/" "${prefix}/share/zsh/vendor-completions/"
 EOF
\ No newline at end of file
diff --git a/tools/diun/Dockerfile.template b/tools/diun/Dockerfile.template
index 70a8d3ee25..1da7bf0611 100644
--- a/tools/diun/Dockerfile.template
+++ b/tools/diun/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "crazy-max/diun" "v${version}" "diun_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/crazy-max/diun/releases/download/v${version}/diun_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/crazy-max/diun/releases/download/v${version}/diun_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "crazy-max/diun" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     ./diun
 EOF
\ No newline at end of file
diff --git a/tools/dive/Dockerfile.template b/tools/dive/Dockerfile.template
index 16ebdfed7a..5aee84fa94 100644
--- a/tools/dive/Dockerfile.template
+++ b/tools/dive/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "wagoodman/dive" "v${version}" "dive_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/wagoodman/dive/releases/download/v${version}/dive_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/wagoodman/dive/releases/download/v${version}/dive_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "wagoodman/dive" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     dive
 EOF
\ No newline at end of file
diff --git a/tools/dnsx/Dockerfile.template b/tools/dnsx/Dockerfile.template
index 6ef3a67f90..1a46f6b61e 100644
--- a/tools/dnsx/Dockerfile.template
+++ b/tools/dnsx/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/dnsx" "v${version}" "dnsx_${version}_linux_${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/dnsx/releases/download/v${version}/dnsx_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/dnsx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     dnsx
 EOF
\ No newline at end of file
diff --git a/tools/docker-base/Dockerfile.template b/tools/docker-base/Dockerfile.template
index 211bf14a46..08571ce434 100644
--- a/tools/docker-base/Dockerfile.template
+++ b/tools/docker-base/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/base-cli-plugin" "v${version}" "base-cli-plugin_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/docker/base-cli-plugin/releases/download/v${version}/base-cli-plugin_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/base-cli-plugin/releases/download/v${version}/base-cli-plugin_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/base-cli-plugin" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins" --no-same-owner \
     docker-base
 EOF
\ No newline at end of file
diff --git a/tools/docker-compose-switch/Dockerfile.template b/tools/docker-compose-switch/Dockerfile.template
index c84c06242e..6826cf8cd7 100644
--- a/tools/docker-compose-switch/Dockerfile.template
+++ b/tools/docker-compose-switch/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/compose-switch" "v${version}" "docker-compose-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/docker-compose-switch" \
-    "https://github.com/docker/compose-switch/releases/download/v${version}/docker-compose-linux-${alt_arch}"
-chmod +x "${prefix}/bin/docker-compose-switch"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/compose-switch/releases/download/v${version}/docker-compose-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/compose-switch" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/docker-compose-switch"
+
 
 ln --symbolic --relative --force "${prefix}/bin/docker-compose-switch" "${prefix}/bin/docker-compose"
 EOF
\ No newline at end of file
diff --git a/tools/docker-compose-systemd/Dockerfile.template b/tools/docker-compose-systemd/Dockerfile.template
index 2aa447aab3..79f58689c7 100644
--- a/tools/docker-compose-systemd/Dockerfile.template
+++ b/tools/docker-compose-systemd/Dockerfile.template
@@ -12,6 +12,6 @@ COPY <<EOF /uniget_bootstrap/etc/docker-compose
 Please see usage notes
 EOF
 COPY docker-compose@.service.go-template /uniget_bootstrap/etc/systemd/user/
-RUN <<EOF
+RUN <<EOF # no download cache
 sed -i "s|WorkingDirectory=/etc/docker-compose/%i|WorkingDirectory=%h/.config/docker-compose/%i|g" "${prefix}/etc/systemd/user/docker-compose@.service.go-template"
 EOF
diff --git a/tools/docker-compose-v1/Dockerfile.template b/tools/docker-compose-v1/Dockerfile.template
index 9beac0bc2a..a3999bb3bb 100644
--- a/tools/docker-compose-v1/Dockerfile.template
+++ b/tools/docker-compose-v1/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/compose" "${version}" "docker-compose-Linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/docker-compose" \
-    "https://github.com/docker/compose/releases/download/${version}/docker-compose-Linux-${arch}"
-chmod +x "${prefix}/bin/docker-compose"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/compose/releases/download/${version}/docker-compose-Linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/compose" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/docker-compose"
+
 EOF
\ No newline at end of file
diff --git a/tools/docker-compose/Dockerfile.template b/tools/docker-compose/Dockerfile.template
index 3250251d8d..fb39c53710 100644
--- a/tools/docker-compose/Dockerfile.template
+++ b/tools/docker-compose/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/compose" "v${version}" "docker-compose-linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/libexec/docker/cli-plugins/docker-compose" \
-    "https://github.com/docker/compose/releases/download/v${version}/docker-compose-linux-${arch}"
-chmod +x "${prefix}/libexec/docker/cli-plugins/docker-compose"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/compose/releases/download/v${version}/docker-compose-linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/compose" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/libexec/docker/cli-plugins/docker-compose"
+
 EOF
\ No newline at end of file
diff --git a/tools/docker-credential-acr-env/Dockerfile.template b/tools/docker-credential-acr-env/Dockerfile.template
index 18768cbcda..9645db8d00 100644
--- a/tools/docker-credential-acr-env/Dockerfile.template
+++ b/tools/docker-credential-acr-env/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "chrismellard/docker-credential-acr-env" "${version}" "docker-credential-acr-env_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/chrismellard/docker-credential-acr-env/releases/download/${version}/docker-credential-acr-env_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/chrismellard/docker-credential-acr-env/releases/download/${version}/docker-credential-acr-env_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "chrismellard/docker-credential-acr-env" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     docker-credential-acr-env
 EOF
\ No newline at end of file
diff --git a/tools/docker-credential-ecr-login/Dockerfile.template b/tools/docker-credential-ecr-login/Dockerfile.template
index 5c65129072..2e39e5f706 100644
--- a/tools/docker-credential-ecr-login/Dockerfile.template
+++ b/tools/docker-credential-ecr-login/Dockerfile.template
@@ -5,12 +5,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/${version}/linux-${alt_arch}/docker-credential-ecr-login"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/docker-credential-ecr-login" \
-    "https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/${version}/linux-${alt_arch}/docker-credential-ecr-login"
-chmod +x "${prefix}/bin/docker-credential-ecr-login"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/docker-credential-ecr-login"
 EOF
\ No newline at end of file
diff --git a/tools/docker-credential-gcr/Dockerfile.template b/tools/docker-credential-gcr/Dockerfile.template
index aa7a8d6e69..aea0496ad6 100644
--- a/tools/docker-credential-gcr/Dockerfile.template
+++ b/tools/docker-credential-gcr/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=goreleaser / /usr/local/
 WORKDIR /go/src/github.com/GoogleCloudPlatform/docker-credential-gcr
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/GoogleCloudPlatform/docker-credential-gcr" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/GoogleCloudPlatform/docker-credential-gcr .
 export CGO_ENABLED=0
diff --git a/tools/docker-credential-helpers/Dockerfile.template b/tools/docker-credential-helpers/Dockerfile.template
index ea673a4a78..460c29317c 100644
--- a/tools/docker-credential-helpers/Dockerfile.template
+++ b/tools/docker-credential-helpers/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/docker-credential-helpers/releases/download/v${version}/docker-credential-pass-v${version}.linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/docker-credential-helpers" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/docker-credential-pass"
 
-RUN <<EOF
-check-github-release-asset "docker/docker-credential-helpers" "v${version}" "docker-credential-pass-v${version}.linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/docker-credential-pass" \
-    "https://github.com/docker/docker-credential-helpers/releases/download/v${version}/docker-credential-pass-v${version}.linux-${alt_arch}"
-chmod +x "${prefix}/bin/docker-credential-pass"
 EOF
\ No newline at end of file
diff --git a/tools/docker-credential-magic/Dockerfile.template b/tools/docker-credential-magic/Dockerfile.template
index 1c63e7db52..cb23bb58ea 100644
--- a/tools/docker-credential-magic/Dockerfile.template
+++ b/tools/docker-credential-magic/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker-credential-magic/docker-credential-magic/releases/download/v${version}/docker-credential-magic_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker-credential-magic/docker-credential-magic" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "docker-credential-magic/docker-credential-magic" "v${version}" "docker-credential-magic_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/docker-credential-magic/docker-credential-magic/releases/download/v${version}/docker-credential-magic_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     docker-credential-magic \
     docker-credential-magician
 EOF
\ No newline at end of file
diff --git a/tools/docker-debug/Dockerfile.template b/tools/docker-debug/Dockerfile.template
index cdcd59af38..e614ab8e2f 100644
--- a/tools/docker-debug/Dockerfile.template
+++ b/tools/docker-debug/Dockerfile.template
@@ -8,7 +8,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY --chmod=0755 install-docker-debug.sh "/uniget_bootstrap/bin/"
-RUN <<EOF
+RUN <<EOF # no download cache
 BODY="$(
     curl --silent --show-error --location --fail \
         "https://api.github.com/repos/uniget-org/renovate-custom/releases/tags/docker-debug%2F${version}" \
diff --git a/tools/docker-desktop/Dockerfile.template b/tools/docker-desktop/Dockerfile.template
index 4c57723cf6..530ad31e2b 100644
--- a/tools/docker-desktop/Dockerfile.template
+++ b/tools/docker-desktop/Dockerfile.template
@@ -8,6 +8,6 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY --chmod=0755 install-docker-desktop.sh "/uniget_bootstrap/bin/"
-RUN <<EOF
+RUN <<EOF # no download cache
 sed -i "s/version:=VERSION/version:=${version}/" "/uniget_bootstrap/bin/install-docker-desktop.sh"
 EOF
\ No newline at end of file
diff --git a/tools/docker-gen/Dockerfile.template b/tools/docker-gen/Dockerfile.template
index f8297ceeaa..fb40a99114 100644
--- a/tools/docker-gen/Dockerfile.template
+++ b/tools/docker-gen/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "nginx-proxy/docker-gen" "${version}" "docker-gen-alpine-linux-${alt_arch}-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/nginx-proxy/docker-gen/releases/download/${version}/docker-gen-alpine-linux-${alt_arch}-${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/nginx-proxy/docker-gen/releases/download/${version}/docker-gen-alpine-linux-${alt_arch}-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "nginx-proxy/docker-gen" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/docker-index/Dockerfile.template b/tools/docker-index/Dockerfile.template
index 4403002e76..6500db0ebc 100644
--- a/tools/docker-index/Dockerfile.template
+++ b/tools/docker-index/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/index-cli-plugin" "v${version}" "docker-index_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/docker/index-cli-plugin/releases/download/v${version}/docker-index_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/index-cli-plugin/releases/download/v${version}/docker-index_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/index-cli-plugin" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins" --no-same-owner \
     docker-index
 "${prefix}/libexec/docker/cli-plugins/docker-index" completion bash | sed "s|${prefix}||g" >"${prefix}/share/bash-completion/completions/docker-index"
 "${prefix}/libexec/docker/cli-plugins/docker-index" completion fish | sed "s|${prefix}||g" >"${prefix}/share/fish/vendor_completions.d/docker-index.fish"
diff --git a/tools/docker-init/Dockerfile.template b/tools/docker-init/Dockerfile.template
index 7efbced8ba..8fb1e14456 100644
--- a/tools/docker-init/Dockerfile.template
+++ b/tools/docker-init/Dockerfile.template
@@ -8,7 +8,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY --chmod=0755 install-docker-init.sh "/uniget_bootstrap/bin/"
-RUN <<EOF
+RUN <<EOF # no download cache
 BODY="$(
     curl --silent --show-error --location --fail \
         "https://api.github.com/repos/uniget-org/renovate-custom/releases/tags/docker-init%2F${version}" \
diff --git a/tools/docker-lock/Dockerfile.template b/tools/docker-lock/Dockerfile.template
index 4887a6baeb..86267f1961 100644
--- a/tools/docker-lock/Dockerfile.template
+++ b/tools/docker-lock/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "safe-waters/docker-lock" "v${version}" "docker-lock_${version}_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/safe-waters/docker-lock/releases/download/v${version}/docker-lock_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading docker-lock ${version}"
-curl --silent --show-error --location --fail "https://github.com/safe-waters/docker-lock/releases/download/v${version}/docker-lock_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "safe-waters/docker-lock" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     docker-lock
 EOF
\ No newline at end of file
diff --git a/tools/docker-machine/Dockerfile.template b/tools/docker-machine/Dockerfile.template
index e1040e5903..48123c8d46 100644
--- a/tools/docker-machine/Dockerfile.template
+++ b/tools/docker-machine/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/machine/releases/download/v${version}/docker-machine-Linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/machine" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/docker-machine"
 
-RUN <<EOF
-check-github-release-asset "docker/machine" "v${version}" "docker-machine-Linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/docker-machine" \
-    "https://github.com/docker/machine/releases/download/v${version}/docker-machine-Linux-${arch}"
-chmod +x "${prefix}/bin/docker-machine"
 EOF
\ No newline at end of file
diff --git a/tools/docker-manpages/Dockerfile.template b/tools/docker-manpages/Dockerfile.template
index 9ffb7fa7a0..75f87c44ab 100644
--- a/tools/docker-manpages/Dockerfile.template
+++ b/tools/docker-manpages/Dockerfile.template
@@ -15,7 +15,7 @@ COPY --link --from=go-md2man / /usr/local/
 WORKDIR /go/src/github.com/docker/cli
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://github.com/docker/cli" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/docker/cli .
 EOF
diff --git a/tools/docker-preview/Dockerfile.template b/tools/docker-preview/Dockerfile.template
index a987b086e1..acacf5726e 100644
--- a/tools/docker-preview/Dockerfile.template
+++ b/tools/docker-preview/Dockerfile.template
@@ -5,11 +5,9 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
-
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p "${prefix}/libexec/${name}/bin"
 EOF
 
@@ -21,17 +19,31 @@ export DOCKER_HOST=unix:///var/run/docker-preview.sock
 exec /libexec/${name}/bin/docker "\$@"
 EOF
 
-RUN <<EOF
-check-download "https://download.docker.com/linux/static/test/${arch}/docker-${version}.tgz"
-curl --silent --show-error --location --fail "https://download.docker.com/linux/static/test/${arch}/docker-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://download.docker.com/linux/static/test/${arch}/docker-${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
+EOF
+
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://download.docker.com/linux/static/test/${arch}/docker-rootless-extras-${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-check-download "https://download.docker.com/linux/static/test/${arch}/docker-rootless-extras-${version}.tgz"
-curl --silent --show-error --location --fail "https://download.docker.com/linux/static/stable/${arch}/docker-rootless-extras-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
 EOF
 
-RUN <<EOF
+RUN <<EOF # no download cache
 check-download "https://github.com/moby/moby/raw/v${version}/contrib/init/systemd/docker.service"
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/${name}.service.go-template" \
     "https://github.com/moby/moby/raw/v${version}/contrib/init/systemd/docker.service"
diff --git a/tools/docker-sbom/Dockerfile.template b/tools/docker-sbom/Dockerfile.template
index ea834544c2..1ae26aa10c 100644
--- a/tools/docker-sbom/Dockerfile.template
+++ b/tools/docker-sbom/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/sbom-cli-plugin" "v${version}" "sbom-cli-plugin_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/docker/sbom-cli-plugin/releases/download/v${version}/sbom-cli-plugin_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/sbom-cli-plugin/releases/download/v${version}/sbom-cli-plugin_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/sbom-cli-plugin" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins" --no-same-owner \
     docker-sbom
 EOF
\ No newline at end of file
diff --git a/tools/docker-scout/Dockerfile.template b/tools/docker-scout/Dockerfile.template
index 55bc771a80..db9db748cc 100644
--- a/tools/docker-scout/Dockerfile.template
+++ b/tools/docker-scout/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/scout-cli" "v${version}" "docker-scout_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/docker/scout-cli/releases/download/v${version}/docker-scout_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/scout-cli/releases/download/v${version}/docker-scout_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/scout-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/docker/cli-plugins/" --no-same-owner \
     docker-scout
 
 "${prefix}/libexec/docker/cli-plugins/docker-scout" completion bash >"${prefix}/share/bash-completion/completions/docker-scout"
diff --git a/tools/docker/Dockerfile.template b/tools/docker/Dockerfile.template
index 42619fe1fd..755eb6a084 100644
--- a/tools/docker/Dockerfile.template
+++ b/tools/docker/Dockerfile.template
@@ -5,36 +5,48 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
-
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p "${prefix}/libexec/${name}/bin"
 EOF
 
-RUN <<EOF
-check-download "https://download.docker.com/linux/static/stable/${arch}/docker-${version}.tgz"
-curl --silent --show-error --location --fail "https://download.docker.com/linux/static/stable/${arch}/docker-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://download.docker.com/linux/static/stable/${arch}/docker-${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
 mv "${prefix}/libexec/${name}/bin/dockerd"      "${prefix}/bin/"
 mv "${prefix}/libexec/${name}/bin/docker"       "${prefix}/bin/"
 mv "${prefix}/libexec/${name}/bin/docker-proxy" "${prefix}/bin/"
+EOF
+
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://download.docker.com/linux/static/stable/${arch}/docker-rootless-extras-${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-check-download "https://download.docker.com/linux/static/stable/${arch}/docker-rootless-extras-${version}.tgz"
-curl --silent --show-error --location --fail "https://download.docker.com/linux/static/stable/${arch}/docker-rootless-extras-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/${name}/bin" --no-same-owner --strip-components=1
 mv "${prefix}/libexec/${name}/bin/dockerd-rootless.sh"           "${prefix}/bin/"
 mv "${prefix}/libexec/${name}/bin/dockerd-rootless-setuptool.sh" "${prefix}/bin/"
 EOF
 
-RUN <<EOF
+RUN <<EOF # no download cache
 "${prefix}/bin/docker" completion bash >"${prefix}/share/bash-completion/completions/docker"
 "${prefix}/bin/docker" completion fish >"${prefix}/share/fish/vendor_completions.d/docker.fish"
 "${prefix}/bin/docker" completion zsh >"${prefix}/share/zsh/vendor-completions/_docker"
 EOF
 
-RUN <<EOF
+RUN <<EOF # no download cache
 check-download "https://github.com/moby/moby/raw/v${version}/contrib/init/systemd/docker.service"
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/${name}.service.go-template" \
     "https://github.com/moby/moby/raw/v${version}/contrib/init/systemd/docker.service"
diff --git a/tools/dockerfilegraph/Dockerfile.template b/tools/dockerfilegraph/Dockerfile.template
index efb84beec3..fb1fa3e43d 100644
--- a/tools/dockerfilegraph/Dockerfile.template
+++ b/tools/dockerfilegraph/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "patrickhoefler/dockerfilegraph" "v${version}" "dockerfilegraph_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/patrickhoefler/dockerfilegraph/releases/download/v${version}/dockerfilegraph_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/patrickhoefler/dockerfilegraph/releases/download/v${version}/dockerfilegraph_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "patrickhoefler/dockerfilegraph" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     dockerfilegraph
 EOF
\ No newline at end of file
diff --git a/tools/dockle/Dockerfile.template b/tools/dockle/Dockerfile.template
index 44dcf53c5e..844fdeb1e8 100644
--- a/tools/dockle/Dockerfile.template
+++ b/tools/dockle/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "goodwithtech/dockle" "v${version}" "dockle_${version}_Linux-64bit.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/goodwithtech/dockle/releases/download/v${version}/dockle_${version}_Linux-64bit.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/goodwithtech/dockle/releases/download/v${version}/dockle_${version}_Linux-64bit.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "goodwithtech/dockle" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     dockle
 EOF
\ No newline at end of file
diff --git a/tools/docuum/Dockerfile.template b/tools/docuum/Dockerfile.template
index c3d7a875fb..c14b8c795a 100644
--- a/tools/docuum/Dockerfile.template
+++ b/tools/docuum/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/stepchowfun/docuum
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/stepchowfun/docuum .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/doggo/Dockerfile.template b/tools/doggo/Dockerfile.template
index 0506086833..c020c9576f 100644
--- a/tools/doggo/Dockerfile.template
+++ b/tools/doggo/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "mr-karan/doggo" "v${version}" "doggo_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mr-karan/doggo/releases/download/v${version}/doggo_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/mr-karan/doggo/releases/download/v${version}/doggo_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mr-karan/doggo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "doggo_${version}_Linux_${arch_suffix}/doggo"
 EOF
diff --git a/tools/dot/Dockerfile.template b/tools/dot/Dockerfile.template
index 788fd99452..8993132ad1 100644
--- a/tools/dot/Dockerfile.template
+++ b/tools/dot/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/goccy/go-graphviz
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone https://github.com/goccy/go-graphviz "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/goccy/go-graphviz .
 go build -ldflags '-extldflags "-static"' -o "${prefix}/bin/dot" ./cmd/dot
diff --git a/tools/dotenvx/Dockerfile.template b/tools/dotenvx/Dockerfile.template
index 5fe9efa2f6..c6b0e3895d 100644
--- a/tools/dotenvx/Dockerfile.template
+++ b/tools/dotenvx/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dotenvx/dotenvx" "v${version}" "dotenvx-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/dotenvx/dotenvx/releases/download/v${version}/dotenvx-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dotenvx/dotenvx/releases/download/v${version}/dotenvx-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dotenvx/dotenvx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/dotnet/Dockerfile.template b/tools/dotnet/Dockerfile.template
index fcc49bd397..565b553b71 100644
--- a/tools/dotnet/Dockerfile.template
+++ b/tools/dotnet/Dockerfile.template
@@ -10,7 +10,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --from=curl / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --remote-name https://dot.net/v1/dotnet-install.sh
 bash dotnet-install.sh --channel STS --version ${version} --install-dir "${prefix}/opt/dotnet"
 ln --symbolic --relative --force "${prefix}/opt/dotnet/dotnet" "${prefix}/bin/dotnet"
diff --git a/tools/dragonfly/Dockerfile.template b/tools/dragonfly/Dockerfile.template
index 9e5b72a09f..e39a301048 100644
--- a/tools/dragonfly/Dockerfile.template
+++ b/tools/dragonfly/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dragonflyoss/Dragonfly2" "v${version}" "dragonfly-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/dragonflyoss/Dragonfly2/releases/download/v${version}/dragonfly-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dragonflyoss/Dragonfly2/releases/download/v${version}/dragonfly-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dragonflyoss/Dragonfly2" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     dfget \
     dfcache \
     dfstore \
diff --git a/tools/dry/Dockerfile.template b/tools/dry/Dockerfile.template
index 99541d83fe..e9f3892b14 100644
--- a/tools/dry/Dockerfile.template
+++ b/tools/dry/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "moncho/dry" "v${version}" "dry-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/dry" \
-    "https://github.com/moncho/dry/releases/download/v${version}/dry-linux-${alt_arch}"
-chmod +x "${prefix}/bin/dry"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/moncho/dry/releases/download/v${version}/dry-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "moncho/dry" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/dry"
+
 EOF
\ No newline at end of file
diff --git a/tools/dua/Dockerfile.template b/tools/dua/Dockerfile.template
index e539126088..145251d631 100644
--- a/tools/dua/Dockerfile.template
+++ b/tools/dua/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Byron/dua-cli" "v${version}" "dua-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Byron/dua-cli/releases/download/v${version}/dua-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Byron/dua-cli/releases/download/v${version}/dua-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Byron/dua-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     dua-v${version}-${arch}-unknown-linux-musl/dua
 EOF
\ No newline at end of file
diff --git a/tools/duf/Dockerfile.template b/tools/duf/Dockerfile.template
index a990f66646..a551323733 100644
--- a/tools/duf/Dockerfile.template
+++ b/tools/duf/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "muesli/duf" "v${version}" "duf_${version}_linux_${arch_suffix}.tar.gz"
+url="https://github.com/muesli/duf/releases/download/v${version}/duf_${version}_linux_${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading duf ${version}"
-curl --silent --verbose --location --fail "https://github.com/muesli/duf/releases/download/v${version}/duf_${version}_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "muesli/duf" "v${version}" "${filename}"
+curl --silent --verbose --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     duf
 EOF
\ No newline at end of file
diff --git a/tools/duffle/Dockerfile.template b/tools/duffle/Dockerfile.template
index d00622181d..0ce4c2d4cc 100644
--- a/tools/duffle/Dockerfile.template
+++ b/tools/duffle/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cnabio/duffle/releases/download/${version}/duffle-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cnabio/duffle" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/duffle"
 
-RUN <<EOF
-check-github-release-asset "cnabio/duffle" "${version}" "duffle-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/duffle" \
-    "https://github.com/cnabio/duffle/releases/download/${version}/duffle-linux-${alt_arch}"
-chmod +x "${prefix}/bin/duffle"
 EOF
\ No newline at end of file
diff --git a/tools/dumb-init/Dockerfile.template b/tools/dumb-init/Dockerfile.template
index b081ff0779..3adb244487 100644
--- a/tools/dumb-init/Dockerfile.template
+++ b/tools/dumb-init/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Yelp/dumb-init" "v${version}" "dumb-init_${version}_${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/dumb-init" \
-    "https://github.com/Yelp/dumb-init/releases/download/v${version}/dumb-init_${version}_${arch}"
-chmod +x "${prefix}/bin/dumb-init"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Yelp/dumb-init/releases/download/v${version}/dumb-init_${version}_${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Yelp/dumb-init" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/dumb-init"
+
 EOF
\ No newline at end of file
diff --git a/tools/dummy-broken-dep/Dockerfile.template b/tools/dummy-broken-dep/Dockerfile.template
index 9aea994f37..975420f47b 100644
--- a/tools/dummy-broken-dep/Dockerfile.template
+++ b/tools/dummy-broken-dep/Dockerfile.template
@@ -8,7 +8,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 touch \
     "${prefix}/dummy-broken-dep"
 EOF
\ No newline at end of file
diff --git a/tools/dummy/Dockerfile.template b/tools/dummy/Dockerfile.template
index 6095e00941..634a8bce7e 100644
--- a/tools/dummy/Dockerfile.template
+++ b/tools/dummy/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 touch \
     "${prefix}/dummy"
 EOF
diff --git a/tools/dyff/Dockerfile.template b/tools/dyff/Dockerfile.template
index 82a8c01ca5..90c7f70949 100644
--- a/tools/dyff/Dockerfile.template
+++ b/tools/dyff/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/homeport/dyff/releases/download/v${version}/dyff_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "homeport/dyff" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "homeport/dyff" "v${version}" "dyff_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/homeport/dyff/releases/download/v${version}/dyff_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     dyff
 "${prefix}/bin/dyff" completion bash >"${prefix}/share/bash-completion/completions/dyff"
 "${prefix}/bin/dyff" completion fish >"${prefix}/share/fish/vendor_completions.d/dyff.fish"
diff --git a/tools/earthly/Dockerfile.template b/tools/earthly/Dockerfile.template
index f2d40a3293..28d7298e7a 100644
--- a/tools/earthly/Dockerfile.template
+++ b/tools/earthly/Dockerfile.template
@@ -5,18 +5,25 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     zsh
 EOF
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "earthly/earthly" "v${version}" "earthly-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/earthly" \
-    "https://github.com/earthly/earthly/releases/download/v${version}/earthly-linux-${alt_arch}"
-chmod +x "${prefix}/bin/earthly"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/earthly/earthly/releases/download/v${version}/earthly-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "earthly/earthly" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/earthly"
+
 "${prefix}/bin/earthly" bootstrap --with-autocomplete --no-buildkit
 cp /usr/share/bash-completion/completions/earthly "${prefix}/share/bash-completion/completions/earthly"
 sed -i "s|${prefix}||" "${prefix}/share/bash-completion/completions/earthly"
diff --git a/tools/ecapture/Dockerfile.template b/tools/ecapture/Dockerfile.template
index e58487653e..ea48053556 100644
--- a/tools/ecapture/Dockerfile.template
+++ b/tools/ecapture/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gojue/ecapture" "v${version}" "ecapture-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gojue/ecapture/releases/download/v${version}/ecapture-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gojue/ecapture/releases/download/v${version}/ecapture-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gojue/ecapture" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "ecapture-v${version}-linux-${alt_arch}/ecapture"
 EOF
diff --git a/tools/eksctl/Dockerfile.template b/tools/eksctl/Dockerfile.template
index e78fef0712..26ab3b514b 100644
--- a/tools/eksctl/Dockerfile.template
+++ b/tools/eksctl/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "eksctl-io/eksctl" "v${version}" "eksctl_Linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/eksctl-io/eksctl/releases/download/v${version}/eksctl_Linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/eksctl-io/eksctl/releases/download/v${version}/eksctl_Linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "eksctl-io/eksctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/eksctl" completion bash >"${prefix}/share/bash-completion/completions/eksctl"
 "${prefix}/bin/eksctl" completion fish >"${prefix}/share/fish/vendor_completions.d/eksctl.fish"
diff --git a/tools/ekz/Dockerfile.template b/tools/ekz/Dockerfile.template
index 1327af78c3..b1fcd922e8 100644
--- a/tools/ekz/Dockerfile.template
+++ b/tools/ekz/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "chanwit/ekz" "v${version}" "ekz_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/chanwit/ekz/releases/download/v${version}/ekz_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/chanwit/ekz/releases/download/v${version}/ekz_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "chanwit/ekz" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     ekz
 EOF
\ No newline at end of file
diff --git a/tools/emoj/Dockerfile.template b/tools/emoj/Dockerfile.template
index f990e28803..2e43b872c2 100644
--- a/tools/emoj/Dockerfile.template
+++ b/tools/emoj/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/emoj
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "emoj@${version}"
diff --git a/tools/emojisum/Dockerfile.template b/tools/emojisum/Dockerfile.template
index b4ad91c62c..9301ae039c 100644
--- a/tools/emojisum/Dockerfile.template
+++ b/tools/emojisum/Dockerfile.template
@@ -11,8 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/emojisum/emojisum
 ARG name
 ARG version
-RUN <<EOF
-set -x
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone https://github.com/emojisum/emojisum "draft+${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "draft+${version}" https://github.com/emojisum/emojisum .
 export CGO_ENABLED=0
diff --git a/tools/envcli/Dockerfile.template b/tools/envcli/Dockerfile.template
index 857aaf97e3..437e747ba5 100644
--- a/tools/envcli/Dockerfile.template
+++ b/tools/envcli/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "EnvCLI/EnvCLI" "v${version}" "linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/envcli" \
-    "https://github.com/EnvCLI/EnvCLI/releases/download/v${version}/linux_${alt_arch}"
-chmod +x "${prefix}/bin/envcli"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/EnvCLI/EnvCLI/releases/download/v${version}/linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "EnvCLI/EnvCLI" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/envcli"
+
 EOF
\ No newline at end of file
diff --git a/tools/envsub/Dockerfile.template b/tools/envsub/Dockerfile.template
index e0f716fe44..3545ee09b1 100644
--- a/tools/envsub/Dockerfile.template
+++ b/tools/envsub/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/stephenc/envsub
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/stephenc/envsub .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/esbuild/Dockerfile.template b/tools/esbuild/Dockerfile.template
index a865b69716..9cd4bad49f 100644
--- a/tools/esbuild/Dockerfile.template
+++ b/tools/esbuild/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-download "https://registry.npmjs.org/@esbuild/linux-${arch_suffix}/-/linux-${arch_suffix}-${version}.tgz"
-curl --silent --show-error --location --fail "https://registry.npmjs.org/@esbuild/linux-${arch_suffix}/-/linux-${arch_suffix}-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner \
+url="https://registry.npmjs.org/@esbuild/linux-${arch_suffix}/-/linux-${arch_suffix}-${version}.tgz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner \
     package/bin/esbuild
 EOF
\ No newline at end of file
diff --git a/tools/etcd/Dockerfile.template b/tools/etcd/Dockerfile.template
index baeeb66dde..729a55dff7 100644
--- a/tools/etcd/Dockerfile.template
+++ b/tools/etcd/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "etcd-io/etcd" "v${version}" "etcd-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/etcd-io/etcd/releases/download/v${version}/etcd-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/etcd-io/etcd/releases/download/v${version}/etcd-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "etcd-io/etcd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     etcd-v${version}-linux-${alt_arch}/etcd \
     etcd-v${version}-linux-${alt_arch}/etcdctl
 EOF
\ No newline at end of file
diff --git a/tools/etcdadm/Dockerfile.template b/tools/etcdadm/Dockerfile.template
index 9c4a67012c..69731493d1 100644
--- a/tools/etcdadm/Dockerfile.template
+++ b/tools/etcdadm/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/etcdadm" "v${version}" "etcdadm-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/etcdadm" \
-    "https://github.com/kubernetes-sigs/etcdadm/releases/download/v${version}/etcdadm-linux-${alt_arch}"
-chmod +x "${prefix}/bin/etcdadm"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/etcdadm/releases/download/v${version}/etcdadm-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/etcdadm" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/etcdadm"
+
 EOF
\ No newline at end of file
diff --git a/tools/exa/Dockerfile.template b/tools/exa/Dockerfile.template
index dac8ceb664..a1c5b6cb7a 100644
--- a/tools/exa/Dockerfile.template
+++ b/tools/exa/Dockerfile.template
@@ -7,12 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ogham/exa" "v${version}" "exa-linux-${arch}-v${version}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/ogham/exa/releases/download/v${version}/exa-linux-${arch}-v${version}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "/tmp" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ogham/exa" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "/tmp" "${uniget_cache_download}/${filename}"
 
 mv /tmp/bin/exa "${prefix}/bin/"
 mv /tmp/man/exa.1 "${prefix}/share/man/man1/"
diff --git a/tools/ezghsa/Dockerfile.template b/tools/ezghsa/Dockerfile.template
index 664e3ef23d..b9ce3f02de 100644
--- a/tools/ezghsa/Dockerfile.template
+++ b/tools/ezghsa/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "csdev/ezghsa" "v${version}" "ezghsa-${version}-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ezghsa" \
-    "https://github.com/csdev/ezghsa/releases/download/v${version}/ezghsa-${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/ezghsa"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/csdev/ezghsa/releases/download/v${version}/ezghsa-${version}-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "csdev/ezghsa" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ezghsa"
+
 EOF
\ No newline at end of file
diff --git a/tools/faas-cli/Dockerfile.template b/tools/faas-cli/Dockerfile.template
index 8150a1bb06..256e5bdf51 100644
--- a/tools/faas-cli/Dockerfile.template
+++ b/tools/faas-cli/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/openfaas/faas-cli/releases/download/${version}/faas-cli"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "openfaas/faas-cli" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/faas-cli"
 
-RUN <<EOF
-check-github-release-asset "openfaas/faas-cli" "${version}" "faas-cli"
-curl --silent --show-error --location --fail --output "${prefix}/bin/faas-cli" \
-    "https://github.com/openfaas/faas-cli/releases/download/${version}/faas-cli"
-chmod +x "${prefix}/bin/faas-cli"
 EOF
\ No newline at end of file
diff --git a/tools/faasd/Dockerfile.template b/tools/faasd/Dockerfile.template
index 242a262e3b..922cbde636 100644
--- a/tools/faasd/Dockerfile.template
+++ b/tools/faasd/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/openfaas/faasd/releases/download/${version}/faasd"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "openfaas/faasd" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/faasd"
 
-RUN <<EOF
-check-github-release-asset "openfaas/faasd" "${version}" "faasd"
-curl --silent --show-error --location --fail --output "${prefix}/bin/faasd" \
-    "https://github.com/openfaas/faasd/releases/download/${version}/faasd"
-chmod +x "${prefix}/bin/faasd"
 
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/faasd.service.go-template" \
     "https://github.com/openfaas/faasd/raw/${version}/hack/faasd.service"
diff --git a/tools/falco/Dockerfile.template b/tools/falco/Dockerfile.template
index 7d8912b52b..f920d812a0 100644
--- a/tools/falco/Dockerfile.template
+++ b/tools/falco/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://download.falco.org/packages/bin/${arch}/falco-${version}-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://download.falco.org/packages/bin/${arch}/falco-${version}-${arch}.tar.gz"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
 
 mv "${prefix}/usr/bin/" "${prefix}/"
 mv "${prefix}/usr/src/" "${prefix}/"
diff --git a/tools/falcosidekick/Dockerfile.template b/tools/falcosidekick/Dockerfile.template
index b0fc242a7e..2d29e2f230 100644
--- a/tools/falcosidekick/Dockerfile.template
+++ b/tools/falcosidekick/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "falcosecurity/falcosidekick" "${version}" "falcosidekick_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/falcosecurity/falcosidekick/releases/download/${version}/falcosidekick_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/falcosecurity/falcosidekick/releases/download/${version}/falcosidekick_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "falcosecurity/falcosidekick" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     falcosidekick
 EOF
diff --git a/tools/fastgron/Dockerfile.template b/tools/fastgron/Dockerfile.template
index ec6d4ad43f..ad3ac4061c 100644
--- a/tools/fastgron/Dockerfile.template
+++ b/tools/fastgron/Dockerfile.template
@@ -5,16 +5,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
 apk update
-apk add \
+apk add --update-cache \
     cmake \
     clang
 EOF
 WORKDIR /tmp/fastgron
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/adamritter/fastgron .
 cmake -B build \
     -DCMAKE_CXX_COMPILER=/usr/bin/clang++ \
diff --git a/tools/fd/Dockerfile.template b/tools/fd/Dockerfile.template
index 2d8496fd30..89dc7170d8 100644
--- a/tools/fd/Dockerfile.template
+++ b/tools/fd/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="musl"
@@ -22,11 +22,15 @@ case "${alt_arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "sharkdp/fd" "v${version}" "fd-v${version}-${arch}-unknown-linux-${arch_suffix}.tar.gz"
+url="https://github.com/sharkdp/fd/releases/download/v${version}/fd-v${version}-${arch}-unknown-linux-${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading fd ${version}"
-curl --silent --show-error --location --fail "https://github.com/sharkdp/fd/releases/download/v${version}/fd-v${version}-${arch}-unknown-linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+check-github-release-asset "sharkdp/fd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "fd-v${version}-${arch}-unknown-linux-${arch_suffix}/fd" \
     "fd-v${version}-${arch}-unknown-linux-${arch_suffix}/fd.1" \
     "fd-v${version}-${arch}-unknown-linux-${arch_suffix}/autocomplete"
diff --git a/tools/figlet/Dockerfile.template b/tools/figlet/Dockerfile.template
index a413187a70..53d20eea32 100644
--- a/tools/figlet/Dockerfile.template
+++ b/tools/figlet/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     zlib1g-dev
@@ -16,10 +16,17 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/figlet
 ARG name
 ARG version
-RUN <<EOF
-check-download "http://ftp.figlet.org/pub/figlet/program/unix/figlet-${version}.tar.gz"
-curl --silent --show-error --location --fail "http://ftp.figlet.org/pub/figlet/program/unix/figlet-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="http://ftp.figlet.org/pub/figlet/program/unix/figlet-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 make -j$(nproc) figlet LDFLAGS=-static DEFAULTFONTDIR=/share/figlet
 make install prefix="${prefix}" MANDIR="${prefix}/share/man"
 EOF
\ No newline at end of file
diff --git a/tools/firecracker/Dockerfile.template b/tools/firecracker/Dockerfile.template
index d4cf2fc4ca..cb9b116737 100644
--- a/tools/firecracker/Dockerfile.template
+++ b/tools/firecracker/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/firecracker-microvm/firecracker/releases/download/v${version}/firecracker-v${version}-${arch}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "firecracker-microvm/firecracker" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "firecracker-microvm/firecracker" "v${version}" "firecracker-v${version}-${arch}.tgz"
-curl --silent --show-error --location --fail "https://github.com/firecracker-microvm/firecracker/releases/download/v${version}/firecracker-v${version}-${arch}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     release-v${version}-${arch}/firecracker-v${version}-${arch} \
     release-v${version}-${arch}/jailer-v${version}-${arch} \
     release-v${version}-${arch}/seccompiler-bin-v${version}-${arch}
diff --git a/tools/firectl/Dockerfile.template b/tools/firectl/Dockerfile.template
index 2ece5c0e3b..45013f089a 100644
--- a/tools/firectl/Dockerfile.template
+++ b/tools/firectl/Dockerfile.template
@@ -5,13 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/firecracker-microvm/firectl/releases/download/v${version}/firectl-v${version}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "firecracker-microvm/firectl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/firectl"
 
-RUN <<EOF
-check-github-release-asset "firecracker-microvm/firectl" "v${version}" "firectl-v${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/firectl" \
-    "https://github.com/firecracker-microvm/firectl/releases/download/v${version}/firectl-v${version}"
-chmod +x "${prefix}/bin/firectl"
 EOF
\ No newline at end of file
diff --git a/tools/firejail/Dockerfile.template b/tools/firejail/Dockerfile.template
index 087137ff77..2f45e8141b 100644
--- a/tools/firejail/Dockerfile.template
+++ b/tools/firejail/Dockerfile.template
@@ -5,8 +5,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     gawk \
     libseccomp-dev \
     libseccomp-static
@@ -14,7 +14,7 @@ EOF
 WORKDIR /tmp/github.com/netblue30/firejail
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/netblue30/firejail .
 ./configure --prefix="${prefix}"
 make -j$(nproc)
diff --git a/tools/flameshow/Dockerfile.template b/tools/flameshow/Dockerfile.template
index a409ce0ecf..b471fcc877 100644
--- a/tools/flameshow/Dockerfile.template
+++ b/tools/flameshow/Dockerfile.template
@@ -8,10 +8,10 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/flameshow" --console-script flameshow "flameshow==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/flarectl/Dockerfile.template b/tools/flarectl/Dockerfile.template
index 8aa0deb329..cbb5cb1866 100644
--- a/tools/flarectl/Dockerfile.template
+++ b/tools/flarectl/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cloudflare/cloudflare-go" "v${version}" "flarectl_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cloudflare/cloudflare-go/releases/download/v${version}/flarectl_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cloudflare/cloudflare-go/releases/download/v${version}/flarectl_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cloudflare/cloudflare-go" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     flarectl
 EOF
\ No newline at end of file
diff --git a/tools/fleet/Dockerfile.template b/tools/fleet/Dockerfile.template
index 4d13dea674..c35812c13e 100644
--- a/tools/fleet/Dockerfile.template
+++ b/tools/fleet/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rancher/fleet" "v${version}" "fleet-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/fleet" \
-    "https://github.com/rancher/fleet/releases/download/v${version}/fleet-linux-${alt_arch}"
-chmod +x "${prefix}/bin/fleet"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rancher/fleet/releases/download/v${version}/fleet-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rancher/fleet" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/fleet"
+
 
 check-github-release-asset "rancher/fleet" "v${version}" "fleetagent-linux-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/fleetagent" \
diff --git a/tools/flux/Dockerfile.template b/tools/flux/Dockerfile.template
index 0c4c76a7b5..6221fcb8d8 100644
--- a/tools/flux/Dockerfile.template
+++ b/tools/flux/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "influxdata/flux" "v${version}" "flux_${version}_linux_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/influxdata/flux/releases/download/v${version}/flux_${version}_linux_amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-component=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/influxdata/flux/releases/download/v${version}/flux_${version}_linux_amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "influxdata/flux" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-component=1 --no-same-owner \
     "flux_${version}_linux_amd64/flux"
 EOF
\ No newline at end of file
diff --git a/tools/flux2/Dockerfile.template b/tools/flux2/Dockerfile.template
index 555d13b6ae..53ec5d8eb2 100644
--- a/tools/flux2/Dockerfile.template
+++ b/tools/flux2/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "fluxcd/flux2" "v${version}" "flux_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/fluxcd/flux2/releases/download/v${version}/flux_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/fluxcd/flux2/releases/download/v${version}/flux_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "fluxcd/flux2" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 "${prefix}/bin/flux" completion bash >"${prefix}/share/bash-completion/completions/flux"
 "${prefix}/bin/flux" completion fish >"${prefix}/share/fish/vendor_completions.d/flux.fish"
 "${prefix}/bin/flux" completion zsh >"${prefix}/share/zsh/vendor-completions/_flux"
diff --git a/tools/flyctl/Dockerfile.template b/tools/flyctl/Dockerfile.template
index 6172f415d6..3f5f298887 100644
--- a/tools/flyctl/Dockerfile.template
+++ b/tools/flyctl/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${arch}" in
     x86_64)
         export arch_suffix="${arch}"
@@ -22,9 +22,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "superfly/flyctl" "v${version}" "flyctl_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/superfly/flyctl/releases/download/v${version}/flyctl_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+url="https://github.com/superfly/flyctl/releases/download/v${version}/flyctl_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "superfly/flyctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/flyctl" completion bash >"${prefix}/share/bash-completion/completions/flyctl"
 "${prefix}/bin/flyctl" completion fish >"${prefix}/share/fish/vendor_completions.d/flyctl.fish"
diff --git a/tools/fontawesome-free/Dockerfile.template b/tools/fontawesome-free/Dockerfile.template
index 27d5eec7ce..b75095658c 100644
--- a/tools/fontawesome-free/Dockerfile.template
+++ b/tools/fontawesome-free/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "FortAwesome/Font-Awesome" "${version}" "fontawesome-free-${version}-web.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/FortAwesome/Font-Awesome/releases/download/${version}/fontawesome-free-${version}-web.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/share/" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "FortAwesome/Font-Awesome" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/share/" "${uniget_cache_download}/${filename}"
 mv "${prefix}/share/fontawesome-free-${version}-web" "${prefix}/share/fontawesome-free"
 EOF
\ No newline at end of file
diff --git a/tools/footloose/Dockerfile.template b/tools/footloose/Dockerfile.template
index 5b3216af86..74a60d6937 100644
--- a/tools/footloose/Dockerfile.template
+++ b/tools/footloose/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "weaveworks/footloose" "${version}" "footloose-${version}-linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/footloose" \
-    "https://github.com/weaveworks/footloose/releases/download/${version}/footloose-${version}-linux-${arch}"
-chmod +x "${prefix}/bin/footloose"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/weaveworks/footloose/releases/download/${version}/footloose-${version}-linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "weaveworks/footloose" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/footloose"
+
 EOF
\ No newline at end of file
diff --git a/tools/forgejo/Dockerfile.template b/tools/forgejo/Dockerfile.template
index 0c768d6f25..ee6be04f43 100644
--- a/tools/forgejo/Dockerfile.template
+++ b/tools/forgejo/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="$(
     curl --silent --show-error --location --fail "https://codeberg.org/api/v1/repos/forgejo/forgejo/releases" \
     | jq --raw-output --arg version "${version}" --arg alt_arch "${alt_arch}" '
@@ -19,8 +19,12 @@ url="$(
     '
 )"
 test -n "${url}"
+filename="$(basename "${url}")"
+
 check-download "${url}"
-curl --silent --show-error --location --fail "${url}" \
-| xz --decompress >"${prefix}/bin/forgejo"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+xz --decompress "${uniget_cache_download}/${filename}" >"${prefix}/bin/forgejo"
 chmod +x "${prefix}/bin/forgejo"
 EOF
\ No newline at end of file
diff --git a/tools/forgit/Dockerfile.template b/tools/forgit/Dockerfile.template
index 19859f5ed7..334fbe5349 100644
--- a/tools/forgit/Dockerfile.template
+++ b/tools/forgit/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/etc/profile.d/forgit.sh" \
     "https://github.com/wfxr/forgit/raw/${version}/forgit.plugin.zsh"
 EOF
\ No newline at end of file
diff --git a/tools/fq/Dockerfile.template b/tools/fq/Dockerfile.template
index 4c7bfbc3a3..58299c4da7 100644
--- a/tools/fq/Dockerfile.template
+++ b/tools/fq/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "wader/fq" "v${version}" "fq_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/wader/fq/releases/download/v${version}/fq_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/wader/fq/releases/download/v${version}/fq_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "wader/fq" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/frankenphp/Dockerfile.template b/tools/frankenphp/Dockerfile.template
index 532e12347d..9f6cf94516 100644
--- a/tools/frankenphp/Dockerfile.template
+++ b/tools/frankenphp/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dunglas/frankenphp" "v${version}" "frankenphp-linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/frankenphp" \
-    "https://github.com/dunglas/frankenphp/releases/download/v${version}/frankenphp-linux-${arch}"
-chmod +x "${prefix}/bin/frankenphp"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dunglas/frankenphp/releases/download/v${version}/frankenphp-linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dunglas/frankenphp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/frankenphp"
+
 
 "${prefix}/bin/frankenphp" completion bash >"${prefix}/share/bash-completion/completions/frankenphp"
 "${prefix}/bin/frankenphp" completion fish >"${prefix}/share/fish/vendor_completions.d/frankenphp.fish"
diff --git a/tools/freeze/Dockerfile.template b/tools/freeze/Dockerfile.template
index 1fce8d99c5..e6af5429e6 100644
--- a/tools/freeze/Dockerfile.template
+++ b/tools/freeze/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/freeze" "v${version}" "freeze_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/freeze/releases/download/v${version}/freeze_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/freeze/releases/download/v${version}/freeze_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/freeze" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "freeze_${version}_Linux_${arch_suffix}/freeze"
 EOF
diff --git a/tools/fregot/Dockerfile.template b/tools/fregot/Dockerfile.template
index 49c08e6b3d..7a674b9140 100644
--- a/tools/fregot/Dockerfile.template
+++ b/tools/fregot/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "fugue/fregot" "v${version}" "fregot-v${version}-linux.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/fugue/fregot/releases/download/v${version}/fregot-v${version}-linux.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/fugue/fregot/releases/download/v${version}/fregot-v${version}-linux.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "fugue/fregot" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/furyctl/Dockerfile.template b/tools/furyctl/Dockerfile.template
index c1730d1c28..68a830048f 100644
--- a/tools/furyctl/Dockerfile.template
+++ b/tools/furyctl/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "sighupio/furyctl" "v${version}" "furyctl-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/sighupio/furyctl/releases/download/v${version}/furyctl-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sighupio/furyctl/releases/download/v${version}/furyctl-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sighupio/furyctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     furyctl
 "${prefix}/bin/furyctl" completion bash >"${prefix}/share/bash-completion/completions/furyctl"
 "${prefix}/bin/furyctl" completion fish >"${prefix}/share/fish/vendor_completions.d/furyctl.fish"
diff --git a/tools/fuse-overlayfs-snapshotter/Dockerfile.template b/tools/fuse-overlayfs-snapshotter/Dockerfile.template
index 06d565931a..e54128344a 100644
--- a/tools/fuse-overlayfs-snapshotter/Dockerfile.template
+++ b/tools/fuse-overlayfs-snapshotter/Dockerfile.template
@@ -8,8 +8,14 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY fuse-overlayfs-snapshotter.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-check-github-release-asset "containerd/fuse-overlayfs-snapshotter" "v${version}" "containerd-fuse-overlayfs-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containerd/fuse-overlayfs-snapshotter/releases/download/v${version}/containerd-fuse-overlayfs-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containerd/fuse-overlayfs-snapshotter/releases/download/v${version}/containerd-fuse-overlayfs-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containerd/fuse-overlayfs-snapshotter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/fuse-overlayfs/Dockerfile.template b/tools/fuse-overlayfs/Dockerfile.template
index 7af8f98112..ae8401f0e8 100644
--- a/tools/fuse-overlayfs/Dockerfile.template
+++ b/tools/fuse-overlayfs/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "containers/fuse-overlayfs" "v${version}" "fuse-overlayfs-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/${name}" \
-    "https://github.com/containers/fuse-overlayfs/releases/download/v${version}/fuse-overlayfs-${arch}"
-chmod +x "${prefix}/bin/${name}"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containers/fuse-overlayfs/releases/download/v${version}/fuse-overlayfs-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containers/fuse-overlayfs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/${name}"
+
 EOF
\ No newline at end of file
diff --git a/tools/fx/Dockerfile.template b/tools/fx/Dockerfile.template
index b586a5208b..e19ec75f25 100644
--- a/tools/fx/Dockerfile.template
+++ b/tools/fx/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "antonmedv/fx" "${version}" "fx_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/fx" \
-    "https://github.com/antonmedv/fx/releases/download/${version}/fx_linux_${alt_arch}"
-chmod +x "${prefix}/bin/fx"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/antonmedv/fx/releases/download/${version}/fx_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "antonmedv/fx" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/fx"
+
 EOF
\ No newline at end of file
diff --git a/tools/fzf/Dockerfile.template b/tools/fzf/Dockerfile.template
index 8613c0062c..66424a4e0f 100644
--- a/tools/fzf/Dockerfile.template
+++ b/tools/fzf/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "junegunn/fzf" "v${version}" "fzf-${version}-linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/junegunn/fzf/releases/download/v${version}/fzf-${version}-linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/junegunn/fzf/releases/download/v${version}/fzf-${version}-linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "junegunn/fzf" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/gatekeeper/Dockerfile.template b/tools/gatekeeper/Dockerfile.template
index ef311179e6..dc83af1bba 100644
--- a/tools/gatekeeper/Dockerfile.template
+++ b/tools/gatekeeper/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "open-policy-agent/gatekeeper" "v${version}" "gator-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/open-policy-agent/gatekeeper/releases/download/v${version}/gator-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/open-policy-agent/gatekeeper/releases/download/v${version}/gator-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "open-policy-agent/gatekeeper" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 "${prefix}/bin/gator" completion bash >"${prefix}/share/bash-completion/completions/gatekeeper"
 "${prefix}/bin/gator" completion fish >"${prefix}/share/fish/vendor_completions.d/gatekeeper.fish"
 "${prefix}/bin/gator" completion zsh >"${prefix}/share/zsh/vendor-completions/_gatekeeper"
diff --git a/tools/gcloud/Dockerfile.template b/tools/gcloud/Dockerfile.template
index a972681f89..f6bc5ef713 100644
--- a/tools/gcloud/Dockerfile.template
+++ b/tools/gcloud/Dockerfile.template
@@ -8,10 +8,17 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 WORKDIR /uniget_bootstrap/opt/gcloud
-RUN <<EOF
-check-download "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${version}-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${version}-linux-${arch}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${version}-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 ln --symbolic --relative --force "${prefix}/opt/gcloud/bin/gcloud" "${prefix}/bin/gcloud"
 ln --symbolic --relative --force "${prefix}/opt/gcloud/bin/bq" "${prefix}/bin/bq"
 
diff --git a/tools/geist-font/Dockerfile.template b/tools/geist-font/Dockerfile.template
index 394e32d522..06901e432c 100644
--- a/tools/geist-font/Dockerfile.template
+++ b/tools/geist-font/Dockerfile.template
@@ -8,18 +8,22 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/geist-font
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vercel/geist-font" "${version}" "Geist-${version}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/vercel/geist-font/releases/download/${version}/Geist-${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o "${filename}"
+check-github-release-asset "vercel/geist-font" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o "${uniget_cache_download}/${filename}"
 
-check-github-release-asset "vercel/geist-font" "${version}" "GeistMono-${version}.zip"
 url="https://github.com/vercel/geist-font/releases/download/${version}/GeistMono-${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o "${filename}"
+check-github-release-asset "vercel/geist-font" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o "${uniget_cache_download}/${filename}"
 
 mkdir -p \
     "${prefix}/share/geist-font" \
diff --git a/tools/gh-copilot/Dockerfile.template b/tools/gh-copilot/Dockerfile.template
index 60bab37833..5b036bc0c2 100644
--- a/tools/gh-copilot/Dockerfile.template
+++ b/tools/gh-copilot/Dockerfile.template
@@ -10,7 +10,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=gh / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "github/gh-copilot" "v${version}" "linux-${alt_arch}"
 mkdir -p "${prefix}/share/gh/extensions/gh-copilot"
 curl --silent --show-error --location --fail --output "${prefix}/share/gh/extensions/gh-copilot/gh-copilot" \
diff --git a/tools/gh/Dockerfile.template b/tools/gh/Dockerfile.template
index 5834dbe963..4e9b72d200 100644
--- a/tools/gh/Dockerfile.template
+++ b/tools/gh/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cli/cli" "v${version}" "gh_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cli/cli/releases/download/v${version}/gh_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cli/cli/releases/download/v${version}/gh_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cli/cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
 rm "${prefix}/LICENSE"
 "${prefix}/bin/gh" completion -s bash >"${prefix}/share/bash-completion/completions/gh"
 "${prefix}/bin/gh" completion -s fish >"${prefix}/share/fish/vendor_completions.d/gh.fish"
diff --git a/tools/ghostunnel/Dockerfile.template b/tools/ghostunnel/Dockerfile.template
index f3308c249f..aab3e06583 100644
--- a/tools/ghostunnel/Dockerfile.template
+++ b/tools/ghostunnel/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ghostunnel/ghostunnel" "v${version}" "ghostunnel-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ghostunnel" \
-    "https://github.com/ghostunnel/ghostunnel/releases/download/v${version}/ghostunnel-linux-${alt_arch}"
-chmod +x "${prefix}/bin/ghostunnel"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ghostunnel/ghostunnel/releases/download/v${version}/ghostunnel-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ghostunnel/ghostunnel" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ghostunnel"
+
 EOF
\ No newline at end of file
diff --git a/tools/git-credential-gopass/Dockerfile.template b/tools/git-credential-gopass/Dockerfile.template
index 6a998fc9c2..f9337d833e 100644
--- a/tools/git-credential-gopass/Dockerfile.template
+++ b/tools/git-credential-gopass/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gopasspw/git-credential-gopass" "v${version}" "git-credential-gopass-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gopasspw/git-credential-gopass/releases/download/v${version}/git-credential-gopass-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gopasspw/git-credential-gopass/releases/download/v${version}/git-credential-gopass-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gopasspw/git-credential-gopass" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     git-credential-gopass
 EOF
\ No newline at end of file
diff --git a/tools/git-credential-oauth/Dockerfile.template b/tools/git-credential-oauth/Dockerfile.template
index 291271d586..a294c9b9fb 100644
--- a/tools/git-credential-oauth/Dockerfile.template
+++ b/tools/git-credential-oauth/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "hickford/git-credential-oauth" "v${version}" "git-credential-oauth_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/hickford/git-credential-oauth/releases/download/v${version}/git-credential-oauth_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/hickford/git-credential-oauth/releases/download/v${version}/git-credential-oauth_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "hickford/git-credential-oauth" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     git-credential-oauth
 EOF
\ No newline at end of file
diff --git a/tools/git-filter-repo/Dockerfile.template b/tools/git-filter-repo/Dockerfile.template
index 17a78dcf34..3919b94aad 100644
--- a/tools/git-filter-repo/Dockerfile.template
+++ b/tools/git-filter-repo/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "newren/git-filter-repo" "v${version}" "git-filter-repo-${version}.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/newren/git-filter-repo/releases/download/v${version}/git-filter-repo-${version}.tar.xz" \
-| tar --extract --xz --directory="/tmp/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/newren/git-filter-repo/releases/download/v${version}/git-filter-repo-${version}.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "newren/git-filter-repo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="/tmp/" --strip-components=1 --no-same-owner \
     "git-filter-repo-${version}/git-filter-repo" \
     "git-filter-repo-${version}/Documentation/man1/git-filter-repo.1" \
     "git-filter-repo-${version}/Documentation/html/git-filter-repo.html"
diff --git a/tools/git-graph/Dockerfile.template b/tools/git-graph/Dockerfile.template
index f5b69df02f..edbfc6659b 100644
--- a/tools/git-graph/Dockerfile.template
+++ b/tools/git-graph/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mlange-42/git-graph" "${version}" "git-graph-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mlange-42/git-graph/releases/download/${version}/git-graph-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mlange-42/git-graph/releases/download/${version}/git-graph-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mlange-42/git-graph" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/git-igitt/Dockerfile.template b/tools/git-igitt/Dockerfile.template
index d77a786f85..48190248c1 100644
--- a/tools/git-igitt/Dockerfile.template
+++ b/tools/git-igitt/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mlange-42/git-igitt" "${version}" "git-igitt-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mlange-42/git-igitt/releases/download/${version}/git-igitt-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mlange-42/git-igitt/releases/download/${version}/git-igitt-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mlange-42/git-igitt" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/git-lfs/Dockerfile.template b/tools/git-lfs/Dockerfile.template
index dc757e4ff7..744346c0f7 100644
--- a/tools/git-lfs/Dockerfile.template
+++ b/tools/git-lfs/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "git-lfs/git-lfs" "v${version}" "git-lfs-linux-${alt_arch}-v${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/git-lfs/git-lfs/releases/download/v${version}/git-lfs-linux-${alt_arch}-v${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/git-lfs/git-lfs/releases/download/v${version}/git-lfs-linux-${alt_arch}-v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "git-lfs/git-lfs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/share/" --strip-components=1 --no-same-owner \
     git-lfs-${version}/git-lfs \
     git-lfs-${version}/man
 mv "${prefix}/share/git-lfs" "${prefix}/bin/"
diff --git a/tools/git/Dockerfile.template b/tools/git/Dockerfile.template
index f14639b687..78952e91e5 100644
--- a/tools/git/Dockerfile.template
+++ b/tools/git/Dockerfile.template
@@ -5,8 +5,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     curl-static \
     expat-static \
     gettext-static \
@@ -22,7 +22,7 @@ EOF
 WORKDIR /tmp/git
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/git/git .
 export CFLAGS="${CFLAGS} -static"
 make configure
diff --git a/tools/gita/Dockerfile.template b/tools/gita/Dockerfile.template
index d37fb9199d..db6d399572 100644
--- a/tools/gita/Dockerfile.template
+++ b/tools/gita/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/gita" --console-script gita "gita==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/gitea/Dockerfile.template b/tools/gitea/Dockerfile.template
index 129c99196e..feba8086ea 100644
--- a/tools/gitea/Dockerfile.template
+++ b/tools/gitea/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "go-gitea/gitea" "v${version}" "gitea-${version}-linux-${alt_arch}.xz"
 curl --silent --show-error --location --fail "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-${version}-linux-${alt_arch}.xz" \
 | xz --decompress >"${prefix}/bin/gitea"
diff --git a/tools/gitjob/Dockerfile.template b/tools/gitjob/Dockerfile.template
index eb3a76f951..75fae057e3 100644
--- a/tools/gitjob/Dockerfile.template
+++ b/tools/gitjob/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rancher/gitjob" "v${version}" "gitjob-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/gitjob" \
-    "https://github.com/rancher/gitjob/releases/download/v${version}/gitjob-linux-${alt_arch}"
-chmod +x "${prefix}/bin/gitjob"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rancher/gitjob/releases/download/v${version}/gitjob-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rancher/gitjob" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/gitjob"
+
 EOF
\ No newline at end of file
diff --git a/tools/gitlab-ci-pipelines-exporter/Dockerfile.template b/tools/gitlab-ci-pipelines-exporter/Dockerfile.template
index 914dc07d5c..f705b58426 100644
--- a/tools/gitlab-ci-pipelines-exporter/Dockerfile.template
+++ b/tools/gitlab-ci-pipelines-exporter/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mvisonneau/gitlab-ci-pipelines-exporter" "v${version}" "gitlab-ci-pipelines-exporter_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mvisonneau/gitlab-ci-pipelines-exporter/releases/download/v${version}/gitlab-ci-pipelines-exporter_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mvisonneau/gitlab-ci-pipelines-exporter/releases/download/v${version}/gitlab-ci-pipelines-exporter_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mvisonneau/gitlab-ci-pipelines-exporter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     gitlab-ci-pipelines-exporter \
     helpers
 
diff --git a/tools/gitlab-release/Dockerfile.template b/tools/gitlab-release/Dockerfile.template
index b6d63fc2d1..3e35e34adf 100644
--- a/tools/gitlab-release/Dockerfile.template
+++ b/tools/gitlab-release/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/gitlab-release" --console-script gitlab-release "gitlab-release==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/gitlab-runner/Dockerfile.template b/tools/gitlab-runner/Dockerfile.template
index b2de04c21f..697d5c8df3 100644
--- a/tools/gitlab-runner/Dockerfile.template
+++ b/tools/gitlab-runner/Dockerfile.template
@@ -9,8 +9,14 @@ ARG name
 ARG version
 COPY gitlab-runner.service.go-template /uniget_bootstrap/etc/systemd/system/
 COPY config.toml /uniget_bootstrap/etc/gitlab-runner/
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/gitlab-runner" \
-    "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/binaries/gitlab-runner-linux-${alt_arch}"
-chmod +x "${prefix}/bin/gitlab-runner"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/binaries/gitlab-runner-linux-${alt_arch}"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+    
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/gitlab-runner"
 EOF
\ No newline at end of file
diff --git a/tools/gitlabci-local/Dockerfile.template b/tools/gitlabci-local/Dockerfile.template
index ad32e2487b..092dd57549 100644
--- a/tools/gitlabci-local/Dockerfile.template
+++ b/tools/gitlabci-local/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/gitlabci-local" --console-script gitlabci-local "gitlabci-local==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/gitleaks/Dockerfile.template b/tools/gitleaks/Dockerfile.template
index 8f42cf6530..39d1b71f2d 100644
--- a/tools/gitleaks/Dockerfile.template
+++ b/tools/gitleaks/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "zricethezav/gitleaks" "v${version}" "gitleaks_${version}_linux_x64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/zricethezav/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_x64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/zricethezav/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_x64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "zricethezav/gitleaks" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     gitleaks
 "${prefix}/bin/gitleaks" completion bash >"${prefix}/share/bash-completion/completions/gitleaks"
 "${prefix}/bin/gitleaks" completion fish >"${prefix}/share/fish/vendor_completions.d/gitleaks.fish"
diff --git a/tools/gitoxide/Dockerfile.template b/tools/gitoxide/Dockerfile.template
index 77e1ceebb0..a20c62e872 100644
--- a/tools/gitoxide/Dockerfile.template
+++ b/tools/gitoxide/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Byron/gitoxide" "v${version}" "gitoxide-max-pure-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Byron/gitoxide/releases/download/v${version}/gitoxide-max-pure-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Byron/gitoxide/releases/download/v${version}/gitoxide-max-pure-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Byron/gitoxide" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "gitoxide-max-pure-v${version}-${arch}-unknown-linux-musl/gix" \
     "gitoxide-max-pure-v${version}-${arch}-unknown-linux-musl/ein"
     
diff --git a/tools/gitsign/Dockerfile.template b/tools/gitsign/Dockerfile.template
index 97748890e8..1d9e58ef1e 100644
--- a/tools/gitsign/Dockerfile.template
+++ b/tools/gitsign/Dockerfile.template
@@ -11,26 +11,25 @@ COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
 COPY gitsign-credential-cache.sh /uniget_bootstrap/etc/profile.d/
-RUN <<EOF
-check-github-release-asset "sigstore/gitsign" "v${version}" "gitsign_${version}_linux_${alt_arch}"
-
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign_${version}_linux_${alt_arch}"
+check-github-release-asset "sigstore/gitsign" "v${version}" "${filename}"
 echo "### Installing gitsign ${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/gitsign" \
-    "https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign_${version}_linux_${alt_arch}"
-chmod +x "${prefix}/bin/gitsign"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking keyless signature for gitsign ${version}"
-curl --silent --show-error --location --fail --output "gitsign_${version}_linux_${alt_arch}.pem" \
-    "https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign_${version}_linux_${alt_arch}.pem"
-curl --silent --show-error --location --fail --output "gitsign_${version}_linux_${alt_arch}.sig" \
-    "https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign_${version}_linux_${alt_arch}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.pem" \
+    "${url}.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
 SHA="$(
     git ls-remote --tags https://github.com/sigstore/gitsign "v${version}^{}" \
     | cut -f1
 )"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "gitsign_${version}_linux_${alt_arch}.pem" \
-    --signature "gitsign_${version}_linux_${alt_arch}.sig" \
+    --cert "${filename}.pem" \
+    --signature "${filename}.sig" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity "https://github.com/sigstore/gitsign/.github/workflows/release.yml@refs/tags/v${version}" \
     --certificate-github-workflow-name release \
@@ -39,24 +38,29 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob \
     --certificate-github-workflow-sha "${SHA}" \
     --certificate-github-workflow-trigger push \
     "${prefix}/bin/gitsign"
-rm -f "gitsign_${version}_linux_${alt_arch}.pem" "gitsign_${version}_linux_${alt_arch}.sig"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/gitsign"
 EOF
-RUN <<EOF
-check-github-release-asset "sigstore/gitsign" "v${version}" "gitsign-credential-cache_${version}_linux_${alt_arch}"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign-credential-cache_${version}_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sigstore/gitsign" "v${version}" "${filename}"
 
 echo "### Installing gitsign-credential-cache ${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/gitsign-credential-cache" \
-    "https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign-credential-cache_${version}_linux_${alt_arch}"
-chmod +x "${prefix}/bin/gitsign-credential-cache"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking keyless signature for gitsign-credential-cache ${version}"
-curl --silent --show-error --location --fail --output "gitsign-credential-cache_${version}_linux_${alt_arch}.pem" \
-    "https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign-credential-cache_${version}_linux_${alt_arch}.pem"
-curl --silent --show-error --location --fail --output "gitsign-credential-cache_${version}_linux_${alt_arch}.sig" \
-    "https://github.com/sigstore/gitsign/releases/download/v${version}/gitsign-credential-cache_${version}_linux_${alt_arch}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.pem" \
+    "${url}.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "gitsign-credential-cache_${version}_linux_${alt_arch}.pem" \
-    --signature "gitsign-credential-cache_${version}_linux_${alt_arch}.sig" \
+    --cert "${uniget_cache_download}/${filename}.pem" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity "https://github.com/sigstore/gitsign/.github/workflows/release.yml@refs/tags/v${version}" \
     --certificate-github-workflow-name release \
@@ -64,10 +68,13 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob \
     --certificate-github-workflow-repository "sigstore/gitsign" \
     --certificate-github-workflow-sha "${SHA}" \
     --certificate-github-workflow-trigger push \
+    "${uniget_cache_download}/${filename}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
     "${prefix}/bin/gitsign-credential-cache"
-rm -f "gitsign-credential-cache_${version}_linux_${alt_arch}.pem" "gitsign-credential-cache_${version}_linux_${alt_arch}.sig"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 "${prefix}/bin/gitsign" completion bash >"${prefix}/share/bash-completion/completions/gitsign"
 "${prefix}/bin/gitsign" completion fish >"${prefix}/share/fish/vendor_completions.d/gitsign.fish"
 "${prefix}/bin/gitsign" completion zsh >"${prefix}/share/zsh/vendor-completions/_gitsign"
diff --git a/tools/gittuf/Dockerfile.template b/tools/gittuf/Dockerfile.template
index 9225a2b678..37f2e9028c 100644
--- a/tools/gittuf/Dockerfile.template
+++ b/tools/gittuf/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gittuf/gittuf" "v${version}" "gittuf_${version}_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/gittuf" \
-    "https://github.com/gittuf/gittuf/releases/download/v${version}/gittuf_${version}_linux_${alt_arch}"
-chmod +x "${prefix}/bin/gittuf"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gittuf/gittuf/releases/download/v${version}/gittuf_${version}_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gittuf/gittuf" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/gittuf"
+
 
 "${prefix}/bin/gittuf" completion bash >"${prefix}/share/bash-completion/completions/gittuf"
 "${prefix}/bin/gittuf" completion fish >"${prefix}/share/fish/vendor_completions.d/gittuf.fish"
diff --git a/tools/gitui/Dockerfile.template b/tools/gitui/Dockerfile.template
index afa7b56c85..d16f1b3e55 100644
--- a/tools/gitui/Dockerfile.template
+++ b/tools/gitui/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "extrawurst/gitui" "v${version}" "gitui-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/extrawurst/gitui/releases/download/v${version}/gitui-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/extrawurst/gitui/releases/download/v${version}/gitui-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "extrawurst/gitui" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/glab/Dockerfile.template b/tools/glab/Dockerfile.template
index af2369e3fb..1955aec526 100644
--- a/tools/glab/Dockerfile.template
+++ b/tools/glab/Dockerfile.template
@@ -5,14 +5,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.com/gitlab-org/cli/-/releases/v${version}/downloads/glab_${version}_Linux_x86_64.tar.gz"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-curl --silent --show-error --location --fail "https://gitlab.com/gitlab-org/cli/-/releases/v${version}/downloads/glab_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     bin/glab
+
 "${prefix}/bin/glab" completion -s bash >"${prefix}/share/bash-completion/completions/glab"
 "${prefix}/bin/glab" completion -s fish >"${prefix}/share/fish/vendor_completions.d/glab.fish"
 "${prefix}/bin/glab" completion -s zsh >"${prefix}/share/zsh/vendor-completions/_glab"
diff --git a/tools/glow/Dockerfile.template b/tools/glow/Dockerfile.template
index bdc333e2cb..4faffc2684 100644
--- a/tools/glow/Dockerfile.template
+++ b/tools/glow/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/glow" "v${version}" "glow_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/glow/releases/download/v${version}/glow_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/glow/releases/download/v${version}/glow_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/glow" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     "glow_${version}_Linux_${arch_suffix}/glow" \
     "glow_${version}_Linux_${arch_suffix}/manpages" \
     "glow_${version}_Linux_${arch_suffix}/completions"
diff --git a/tools/gnuplot/Dockerfile.template b/tools/gnuplot/Dockerfile.template
index 43f0634d60..ec609f98ac 100644
--- a/tools/gnuplot/Dockerfile.template
+++ b/tools/gnuplot/Dockerfile.template
@@ -8,10 +8,17 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/gnuplot
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://downloads.sourceforge.net/project/gnuplot/gnuplot/${version}/gnuplot-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://downloads.sourceforge.net/project/gnuplot/gnuplot/${version}/gnuplot-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://downloads.sourceforge.net/project/gnuplot/gnuplot/${version}/gnuplot-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 ./configure --prefix="${prefix}" \
     --disable-dependency-tracking \
     --disable-silent-rules \
diff --git a/tools/go-mod-upgrade/Dockerfile.template b/tools/go-mod-upgrade/Dockerfile.template
index b520442fc5..fab2929019 100644
--- a/tools/go-mod-upgrade/Dockerfile.template
+++ b/tools/go-mod-upgrade/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "oligot/go-mod-upgrade" "v${version}" "go-mod-upgrade_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/oligot/go-mod-upgrade/releases/download/v${version}/go-mod-upgrade_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/oligot/go-mod-upgrade/releases/download/v${version}/go-mod-upgrade_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "oligot/go-mod-upgrade" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     go-mod-upgrade
 EOF
\ No newline at end of file
diff --git a/tools/go-modiff/Dockerfile.template b/tools/go-modiff/Dockerfile.template
index 361fdd7073..15660cad3b 100644
--- a/tools/go-modiff/Dockerfile.template
+++ b/tools/go-modiff/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/saschagrunert/go-modiff
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/saschagrunert/go-modiff" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/saschagrunert/go-modiff .
 sed -E -i "s/^(\s+app\.Version\s=\s)\"\d+\.\d+\.\d+\"$/\1\"${version}\"/" cmd/go-modiff/main.go
diff --git a/tools/go/Dockerfile.template b/tools/go/Dockerfile.template
index e150a9fb75..cdddb05767 100644
--- a/tools/go/Dockerfile.template
+++ b/tools/go/Dockerfile.template
@@ -5,13 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
+WORKDIR /uniget_bootstrap/opt/go
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://go.dev/dl/go${version}.linux-${alt_arch}.tar.gz"
-mkdir -p "${prefix}/opt/go"
-curl --silent --show-error --location --fail "https://go.dev/dl/go${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/opt/go" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://go.dev/dl/go${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/opt/go" --strip-components=1 --no-same-owner
+
 ln --symbolic --relative --force "${prefix}/opt/go/bin/go" "${prefix}/bin/go"
 ln --symbolic --relative --force "${prefix}/opt/go/bin/gofmt" "${prefix}/bin/gofmt"
 EOF
\ No newline at end of file
diff --git a/tools/gobump/Dockerfile.template b/tools/gobump/Dockerfile.template
index d175d27c7f..d2b4a2ce51 100644
--- a/tools/gobump/Dockerfile.template
+++ b/tools/gobump/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/chainguard-dev/gobump
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 check-clone "https://github.com/chainguard-dev/gobump" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/chainguard-dev/gobump .
 make gobump
diff --git a/tools/gocryptfs/Dockerfile.template b/tools/gocryptfs/Dockerfile.template
index 5997e5786b..22a676af5b 100644
--- a/tools/gocryptfs/Dockerfile.template
+++ b/tools/gocryptfs/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rfjakob/gocryptfs" "v${version}" "gocryptfs_v${version}_linux-static_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/rfjakob/gocryptfs/releases/download/v${version}/gocryptfs_v${version}_linux-static_amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rfjakob/gocryptfs/releases/download/v${version}/gocryptfs_v${version}_linux-static_amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rfjakob/gocryptfs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 mv \
     "${prefix}/bin/gocryptfs.1" \
     "${prefix}/bin/gocryptfs-xray.1" \
diff --git a/tools/godotenv/Dockerfile.template b/tools/godotenv/Dockerfile.template
index 60ac570c0b..91c891c54a 100644
--- a/tools/godotenv/Dockerfile.template
+++ b/tools/godotenv/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "joho/godotenv" "v${version}" "godotenv-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/joho/godotenv/releases/download/v${version}/godotenv-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/joho/godotenv/releases/download/v${version}/godotenv-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "joho/godotenv" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     godotenv
 EOF
\ No newline at end of file
diff --git a/tools/gojq/Dockerfile.template b/tools/gojq/Dockerfile.template
index d42e38ae00..63b06c9491 100644
--- a/tools/gojq/Dockerfile.template
+++ b/tools/gojq/Dockerfile.template
@@ -7,10 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "itchyny/gojq" "v${version}" "gojq_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/itchyny/gojq/releases/download/v${version}/gojq_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/itchyny/gojq/releases/download/v${version}/gojq_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "itchyny/gojq" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip \
+    --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "gojq_v${version}_linux_${alt_arch}/gojq"
 
 ln --symbolic --relative --force "${prefix}/bin/gojq" "${prefix}/bin/jq"
diff --git a/tools/golangci-lint/Dockerfile.template b/tools/golangci-lint/Dockerfile.template
index 774693026c..300a6a18ae 100644
--- a/tools/golangci-lint/Dockerfile.template
+++ b/tools/golangci-lint/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "golangci/golangci-lint" "v${version}" "golangci-lint-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/golangci/golangci-lint/releases/download/v${version}/golangci-lint-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/golangci/golangci-lint/releases/download/v${version}/golangci-lint-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "golangci/golangci-lint" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "golangci-lint-${version}-linux-${alt_arch}/golangci-lint"
 
 "${prefix}/bin/golangci-lint" completion bash >"${prefix}/share/bash-completion/completions/golangci-lint"
diff --git a/tools/gomplate/Dockerfile.template b/tools/gomplate/Dockerfile.template
index c97e0d9376..38a3be5441 100644
--- a/tools/gomplate/Dockerfile.template
+++ b/tools/gomplate/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "hairyhenderson/gomplate" "v${version}" "gomplate_linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/gomplate" \
-    "https://github.com/hairyhenderson/gomplate/releases/download/v${version}/gomplate_linux-${alt_arch}"
-chmod +x "${prefix}/bin/gomplate"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/hairyhenderson/gomplate/releases/download/v${version}/gomplate_linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "hairyhenderson/gomplate" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/gomplate"
+
 EOF
\ No newline at end of file
diff --git a/tools/gopass/Dockerfile.template b/tools/gopass/Dockerfile.template
index 9850bcd827..60006fb95d 100644
--- a/tools/gopass/Dockerfile.template
+++ b/tools/gopass/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gopasspw/gopass" "v${version}" "gopass-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gopasspw/gopass/releases/download/v${version}/gopass-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gopasspw/gopass/releases/download/v${version}/gopass-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gopasspw/gopass" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     gopass
 
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/gopass.1" \
diff --git a/tools/goreleaser/Dockerfile.template b/tools/goreleaser/Dockerfile.template
index d9fabfdaad..1a1e0bfed6 100644
--- a/tools/goreleaser/Dockerfile.template
+++ b/tools/goreleaser/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=cosign / /usr/local/
 WORKDIR /tmp/goreleaser
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -27,27 +27,36 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "goreleaser/goreleaser" "v${version}" "goreleaser_Linux_${arch_suffix}.tar.gz"
-
+url="https://github.com/goreleaser/goreleaser/releases/download/v${version}/goreleaser_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+check-github-release-asset "goreleaser/goreleaser" "v${version}" "${filename}"
 echo "### Downloading goreleaser ${version}"
-curl --silent --show-error --location --fail --remote-name "https://github.com/goreleaser/goreleaser/releases/download/v${version}/goreleaser_Linux_${arch_suffix}.tar.gz"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
+url="https://github.com/goreleaser/goreleaser/releases/download/v${version}/checksums.txt"
+checksum_filename="$( basename "${url}" )"
 echo "### Downloading checksums"
-curl --silent --show-error --location --fail --remote-name "https://github.com/goreleaser/goreleaser/releases/download/v${version}/checksums.txt"
-sha256sum --check --ignore-missing checksums.txt
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${checksum_filename}" \
+    "https://github.com/goreleaser/goreleaser/releases/download/v${version}/checksums.txt"
+pushd "${uniget_cache_download}"
+sha256sum --check --ignore-missing "${uniget_cache_download}/${checksum_filename}"
+popd
 
 echo "### Downloading signature and certificate"
-curl --silent --show-error --location --fail --remote-name "https://github.com/goreleaser/goreleaser/releases/download/v${version}/checksums.txt.sig"
-curl --silent --show-error --location --fail --remote-name "https://github.com/goreleaser/goreleaser/releases/download/v${version}/checksums.txt.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${checksum_filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${checksum_filename}.pem" \
+    "${url}.pem"
 
 echo "### Verifying keyless signature"
 SHA="$(
     git ls-remote --tags https://github.com/goreleaser/goreleaser "v${version}^{}" \
     | cut -f1
 )"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob checksums.txt \
-    --signature checksums.txt.sig \
-    --certificate checksums.txt.pem \
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${checksum_filename}" \
+    --signature "${uniget_cache_download}/${checksum_filename}.sig" \
+    --certificate "${uniget_cache_download}/${checksum_filename}.pem" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity "https://github.com/goreleaser/goreleaser/.github/workflows/release.yml@refs/tags/v${version}" \
     --certificate-github-workflow-name release \
@@ -56,7 +65,8 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob checksums.txt \
     --certificate-github-workflow-sha "${SHA}"
 
 echo "### Unpacking"
-tar --extract --gzip --file="goreleaser_Linux_${arch_suffix}.tar.gz" --directory="${prefix}/bin/" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     goreleaser \
     manpages \
     completions
diff --git a/tools/gosec/Dockerfile.template b/tools/gosec/Dockerfile.template
index 9d374ec2e1..992728ae39 100644
--- a/tools/gosec/Dockerfile.template
+++ b/tools/gosec/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "securego/gosec" "v${version}" "gosec_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/securego/gosec/releases/download/v${version}/gosec_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/securego/gosec/releases/download/v${version}/gosec_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "securego/gosec" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     gosec
 EOF
\ No newline at end of file
diff --git a/tools/gosu/Dockerfile.template b/tools/gosu/Dockerfile.template
index de8525dec4..6a092e0ac4 100644
--- a/tools/gosu/Dockerfile.template
+++ b/tools/gosu/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tianon/gosu" "${version}" "gosu-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/gosu" \
-    "https://github.com/tianon/gosu/releases/download/${version}/gosu-${alt_arch}"
-chmod +x "${prefix}/bin/gosu"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tianon/gosu/releases/download/${version}/gosu-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tianon/gosu" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/gosu"
+
 EOF
\ No newline at end of file
diff --git a/tools/gotestsum/Dockerfile.template b/tools/gotestsum/Dockerfile.template
index 0f5d0f3070..6255eeb0d1 100644
--- a/tools/gotestsum/Dockerfile.template
+++ b/tools/gotestsum/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gotestyourself/gotestsum" "v${version}" "gotestsum_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gotestyourself/gotestsum/releases/download/v${version}/gotestsum_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gotestyourself/gotestsum/releases/download/v${version}/gotestsum_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gotestyourself/gotestsum" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     gotestsum
 EOF
\ No newline at end of file
diff --git a/tools/govc/Dockerfile.template b/tools/govc/Dockerfile.template
index cedbb31267..1144485dbd 100644
--- a/tools/govc/Dockerfile.template
+++ b/tools/govc/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vmware/govmomi" "v${version}" "govc_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/vmware/govmomi/releases/download/v${version}/govc_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/vmware/govmomi/releases/download/v${version}/govc_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "vmware/govmomi" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     govc
 curl --silent --show-error --location --fail --output "${prefix}/share/bash-completion/completions/govc" \
     "https://github.com/vmware/govmomi/raw/v${version}/scripts/govc_bash_completion"
diff --git a/tools/gox/Dockerfile.template b/tools/gox/Dockerfile.template
index 2d1389d7d7..fc2af3a2c2 100644
--- a/tools/gox/Dockerfile.template
+++ b/tools/gox/Dockerfile.template
@@ -12,7 +12,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/authelia/gox
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/authelia/gox" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/authelia/gox .
 go build -o "${prefix}/bin/gox" .
diff --git a/tools/goyacc/Dockerfile.template b/tools/goyacc/Dockerfile.template
index d579bf297e..113e7e4499 100644
--- a/tools/goyacc/Dockerfile.template
+++ b/tools/goyacc/Dockerfile.template
@@ -12,7 +12,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/golang/tools
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/golang/tools" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/golang/tools .
 go build -o "${prefix}/bin/goyacc" ./cmd/goyacc
diff --git a/tools/gptscript/Dockerfile.template b/tools/gptscript/Dockerfile.template
index 7d738147b7..68d9feb7e1 100644
--- a/tools/gptscript/Dockerfile.template
+++ b/tools/gptscript/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gptscript-ai/gptscript" "v${version}" "gptscript-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gptscript-ai/gptscript/releases/download/v${version}/gptscript-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gptscript-ai/gptscript/releases/download/v${version}/gptscript-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gptscript-ai/gptscript" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     gptscript
 EOF
\ No newline at end of file
diff --git a/tools/gradle/Dockerfile.template b/tools/gradle/Dockerfile.template
index db165d186a..20cf214403 100644
--- a/tools/gradle/Dockerfile.template
+++ b/tools/gradle/Dockerfile.template
@@ -7,13 +7,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 fixed_version="${version}"
 test "${version:0-2}" == ".0" && fixed_version="${version:0:-2}"
 url="https://services.gradle.org/distributions/gradle-${fixed_version}-bin.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/opt" "${filename}"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt" "${uniget_cache_download}/${filename}"
+
 mv "${prefix}/opt/gradle-${fixed_version}" "${prefix}/opt/gradle"
 ln --symbolic --relative --force "${prefix}/opt/gradle/bin/gradle" "${prefix}/bin/gradle"
 EOF
\ No newline at end of file
diff --git a/tools/grafana-agent/Dockerfile.template b/tools/grafana-agent/Dockerfile.template
index 2424783d34..b5471e51e9 100644
--- a/tools/grafana-agent/Dockerfile.template
+++ b/tools/grafana-agent/Dockerfile.template
@@ -7,21 +7,25 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/agent" "v${version}" "grafana-agent-linux-${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/grafana/agent/releases/download/v${version}/grafana-agent-linux-${alt_arch}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
-ls -l "${prefix}/bin"
+check-github-release-asset "grafana/agent" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 mv "${prefix}/bin/grafana-agent-linux-${alt_arch}" "${prefix}/bin/grafana-agent"
 
-check-github-release-asset "grafana/agent" "v${version}" "grafana-agentctl-linux-${alt_arch}.zip"
 url="https://github.com/grafana/agent/releases/download/v${version}/grafana-agentctl-linux-${alt_arch}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+check-github-release-asset "grafana/agent" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 mv "${prefix}/bin/grafana-agentctl-linux-${alt_arch}" "${prefix}/bin/grafana-agentctl"
+
 "${prefix}/bin/grafana-agentctl" completion bash >"${prefix}/share/bash-completion/completions/grafana-agentctl"
 "${prefix}/bin/grafana-agentctl" completion fish >"${prefix}/share/fish/vendor_completions.d/grafana-agentctl.fish"
 "${prefix}/bin/grafana-agentctl" completion zsh >"${prefix}/share/zsh/vendor-completions/_grafana-agentctl"
diff --git a/tools/grafana/Dockerfile.template b/tools/grafana/Dockerfile.template
index db26da62d9..6af7cf05e3 100644
--- a/tools/grafana/Dockerfile.template
+++ b/tools/grafana/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://dl.grafana.com/oss/release/grafana-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://dl.grafana.com/oss/release/grafana-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=2 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.grafana.com/oss/release/grafana-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=2 --no-same-owner \
     "grafana-v${version}/bin/grafana"
 EOF
diff --git a/tools/graphviz/Dockerfile.template b/tools/graphviz/Dockerfile.template
index 57562d24ba..71052a8e78 100644
--- a/tools/graphviz/Dockerfile.template
+++ b/tools/graphviz/Dockerfile.template
@@ -6,8 +6,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
 ARG DEBIAN_FRONTEND=noninteractive
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     python3 \
     libltdl \
     libltdl-static \
@@ -18,10 +18,17 @@ EOF
 WORKDIR /tmp/graphviz
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://gitlab.com/graphviz/graphviz/-/archive/${version}/graphviz-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://gitlab.com/graphviz/graphviz/-/archive/${version}/graphviz-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.com/graphviz/graphviz/-/archive/${version}/graphviz-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 ./autogen.sh
 ./configure \
     --prefix="${prefix}" \
diff --git a/tools/gron/Dockerfile.template b/tools/gron/Dockerfile.template
index d7dac58358..7e9c0d5727 100644
--- a/tools/gron/Dockerfile.template
+++ b/tools/gron/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tomnomnom/gron" "v${version}" "gron-linux-${alt_arch}-${version}.tgz"
-curl --silent --show-error --location --fail "https://github.com/tomnomnom/gron/releases/download/v${version}/gron-linux-${alt_arch}-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tomnomnom/gron/releases/download/v${version}/gron-linux-${alt_arch}-${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tomnomnom/gron" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/grpcurl/Dockerfile.template b/tools/grpcurl/Dockerfile.template
index 441deef848..87ec7b3051 100644
--- a/tools/grpcurl/Dockerfile.template
+++ b/tools/grpcurl/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "fullstorydev/grpcurl" "v${version}" "grpcurl_${version}_linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/fullstorydev/grpcurl/releases/download/v${version}/grpcurl_${version}_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/fullstorydev/grpcurl/releases/download/v${version}/grpcurl_${version}_linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "fullstorydev/grpcurl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     grpcurl
 EOF
\ No newline at end of file
diff --git a/tools/grunt/Dockerfile.template b/tools/grunt/Dockerfile.template
index 211c1613c6..0850802a3b 100644
--- a/tools/grunt/Dockerfile.template
+++ b/tools/grunt/Dockerfile.template
@@ -15,7 +15,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/grunt
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "grunt@${version}"
diff --git a/tools/grype/Dockerfile.template b/tools/grype/Dockerfile.template
index efa42dc8d7..32afc3d879 100644
--- a/tools/grype/Dockerfile.template
+++ b/tools/grype/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "anchore/grype" "v${version}" "grype_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/anchore/grype/releases/download/v${version}/grype_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/anchore/grype/releases/download/v${version}/grype_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "anchore/grype" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     grype
 "${prefix}/bin/grype" completion bash >"${prefix}/share/bash-completion/completions/grype"
 "${prefix}/bin/grype" completion fish >"${prefix}/share/fish/vendor_completions.d/grype.fish"
diff --git a/tools/gsutil/Dockerfile.template b/tools/gsutil/Dockerfile.template
index 073001b9c8..6f42580386 100644
--- a/tools/gsutil/Dockerfile.template
+++ b/tools/gsutil/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/gsutil" --console-script gsutil "gsutil==${version}"
 EOF
diff --git a/tools/guac/Dockerfile.template b/tools/guac/Dockerfile.template
index 22be564170..0c07da0820 100644
--- a/tools/guac/Dockerfile.template
+++ b/tools/guac/Dockerfile.template
@@ -8,11 +8,18 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /go/src/github.com/guacsec/guac
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "guacsec/guac" "v${version}" "guaccollect-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/guaccollect" \
-    "https://github.com/guacsec/guac/releases/download/v${version}/guaccollect-linux-${alt_arch}"
-chmod +x "${prefix}/bin/guaccollect"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/guacsec/guac/releases/download/v${version}/guaccollect-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "guacsec/guac" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/guaccollect"
+
 
 check-github-release-asset "guacsec/guac" "v${version}" "guaccsub-linux-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/guaccsub" \
@@ -39,7 +46,7 @@ curl --silent --show-error --location --fail --output "${prefix}/bin/guacrest" \
     "https://github.com/guacsec/guac/releases/download/v${version}/guacrest-linux-${alt_arch}"
 chmod +x "${prefix}/bin/guacrest"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 "${prefix}/bin/guaccollect" completion bash >"${prefix}/share/bash-completion/completions/guaccollect"
 "${prefix}/bin/guaccollect" completion fish >"${prefix}/share/fish/vendor_completions.d/guaccollect.fish"
 "${prefix}/bin/guaccollect" completion zsh >"${prefix}/share/zsh/vendor-completions/_guaccollect"
diff --git a/tools/gum/Dockerfile.template b/tools/gum/Dockerfile.template
index 5fe6e4d5e6..8a7dd12ef1 100644
--- a/tools/gum/Dockerfile.template
+++ b/tools/gum/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/gum" "v${version}" "gum_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/gum/releases/download/v${version}/gum_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/gum/releases/download/v${version}/gum_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/gum" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "gum_${version}_Linux_${arch_suffix}/gum" \
     "gum_${version}_Linux_${arch_suffix}/manpages/gum.1.gz"
 mv "${prefix}/bin/manpages/gum.1.gz" "${prefix}/share/man/man1/"
diff --git a/tools/gvisor/Dockerfile.template b/tools/gvisor/Dockerfile.template
index 4af5c8286d..058cdbeb9f 100644
--- a/tools/gvisor/Dockerfile.template
+++ b/tools/gvisor/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://storage.googleapis.com/gvisor/releases/release/${version}/${arch}/runsc"
-curl --silent --show-error --location --fail --output "${prefix}/bin/runsc" \
-    "https://storage.googleapis.com/gvisor/releases/release/${version}/${arch}/runsc"
-chmod +x "${prefix}/bin/runsc"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://storage.googleapis.com/gvisor/releases/release/${version}/${arch}/runsc"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/runsc"
+
 
 check-download "https://storage.googleapis.com/gvisor/releases/release/${version}/${arch}/containerd-shim-runsc-v1"
 curl --silent --show-error --location --fail --output "${prefix}/bin/containerd-shim-runsc-v1" \
diff --git a/tools/hadolint/Dockerfile.template b/tools/hadolint/Dockerfile.template
index 0ef2a8371b..8828d221a2 100644
--- a/tools/hadolint/Dockerfile.template
+++ b/tools/hadolint/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "hadolint/hadolint" "v${version}" "hadolint-Linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/hadolint" \
-    "https://github.com/hadolint/hadolint/releases/download/v${version}/hadolint-Linux-${arch}"
-chmod +x "${prefix}/bin/hadolint"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/hadolint/hadolint/releases/download/v${version}/hadolint-Linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "hadolint/hadolint" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/hadolint"
+
 EOF
\ No newline at end of file
diff --git a/tools/has/Dockerfile.template b/tools/has/Dockerfile.template
index 3f8946596b..37c96eff00 100644
--- a/tools/has/Dockerfile.template
+++ b/tools/has/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/bin/has" \
     "https://github.com/kdabir/has/raw/v${version}/has"
 chmod +x "${prefix}/bin/has"
diff --git a/tools/havener/Dockerfile.template b/tools/havener/Dockerfile.template
index 739b3de938..75b3289984 100644
--- a/tools/havener/Dockerfile.template
+++ b/tools/havener/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "homeport/havener" "v${version}" "havener_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/homeport/havener/releases/download/v${version}/havener_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/homeport/havener/releases/download/v${version}/havener_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "homeport/havener" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     havener
 "${prefix}/bin/havener" completion bash >"${prefix}/share/bash-completion/completions/havener"
 "${prefix}/bin/havener" completion fish >"${prefix}/share/fish/vendor_completions.d/havener.fish"
diff --git a/tools/hcloud/Dockerfile.template b/tools/hcloud/Dockerfile.template
index 5ec46592f5..1ec68c37c4 100644
--- a/tools/hcloud/Dockerfile.template
+++ b/tools/hcloud/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "hetznercloud/cli" "v${version}" "hcloud-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/hetznercloud/cli/releases/download/v${version}/hcloud-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/hetznercloud/cli/releases/download/v${version}/hcloud-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "hetznercloud/cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     hcloud
 "${prefix}/bin/hcloud" completion bash >"${prefix}/share/bash-completion/completions/hcloud"
 "${prefix}/bin/hcloud" completion fish >"${prefix}/share/fish/vendor_completions.d/hcloud.fish"
diff --git a/tools/helm-plugins/Dockerfile.template b/tools/helm-plugins/Dockerfile.template
index d799206f54..22d7971c0b 100644
--- a/tools/helm-plugins/Dockerfile.template
+++ b/tools/helm-plugins/Dockerfile.template
@@ -10,7 +10,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY --link --from=helm / /usr/local/
-RUN <<EOF
+RUN <<EOF # no download cache
 echo "export HELM_PLUGINS=/share/helm/plugins" >"${prefix}/etc/profile.d/helm-plugins.sh"
 
 export HELM_PLUGINS=${prefix}/share/helm/plugins
diff --git a/tools/helm/Dockerfile.template b/tools/helm/Dockerfile.template
index 7d9e7e04f3..e8acb91e76 100644
--- a/tools/helm/Dockerfile.template
+++ b/tools/helm/Dockerfile.template
@@ -7,10 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://get.helm.sh/helm-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
-    linux-${alt_arch}/helm
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://get.helm.sh/helm-v${version}-linux-${alt_arch}.tar.gz"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+    "linux-${alt_arch}/helm"
+
 "${prefix}/bin/helm" completion bash >"${prefix}/share/bash-completion/completions/helm"
 "${prefix}/bin/helm" completion fish >"${prefix}/share/fish/vendor_completions.d/helm.fish"
 "${prefix}/bin/helm" completion zsh >"${prefix}/share/zsh/vendor-completions/_helm"
diff --git a/tools/helmfile/Dockerfile.template b/tools/helmfile/Dockerfile.template
index 6f63a57a46..a158ef90f7 100644
--- a/tools/helmfile/Dockerfile.template
+++ b/tools/helmfile/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/roboll/helmfile/releases/download/v${version}/helmfile_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "roboll/helmfile" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/helmfile"
 
-RUN <<EOF
-check-github-release-asset "roboll/helmfile" "v${version}" "helmfile_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/helmfile" \
-    "https://github.com/roboll/helmfile/releases/download/v${version}/helmfile_linux_${alt_arch}"
-chmod +x "${prefix}/bin/helmfile"
 curl --silent --show-error --location --fail --output "${prefix}/share/bash-completion/completions/helmfile" \
     "https://github.com/roboll/helmfile/raw/v${version}/autocomplete/helmfile_bash_autocomplete"
 curl --silent --show-error --location --fail --output "${prefix}/share/zsh/vendor-completions/_helmfile" \
diff --git a/tools/helmify/Dockerfile.template b/tools/helmify/Dockerfile.template
index b0fd4d7282..e493d4cbfd 100644
--- a/tools/helmify/Dockerfile.template
+++ b/tools/helmify/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,13 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "arttor/helmify" "v${version}" "helmify_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/arttor/helmify/releases/download/v${version}/helmify_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading helmify ${version}"
-curl --silent --show-error --location --fail "https://github.com/arttor/helmify/releases/download/v${version}/helmify_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+check-github-release-asset "arttor/helmify" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/hetzner-k3s/Dockerfile.template b/tools/hetzner-k3s/Dockerfile.template
index 175efe3767..57e8629b58 100644
--- a/tools/hetzner-k3s/Dockerfile.template
+++ b/tools/hetzner-k3s/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vitobotta/hetzner-k3s" "v${version}" "hetzner-k3s-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/hetzner-k3s" \
-    "https://github.com/vitobotta/hetzner-k3s/releases/download/v${version}/hetzner-k3s-linux-${alt_arch}"
-chmod +x "${prefix}/bin/hetzner-k3s"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/vitobotta/hetzner-k3s/releases/download/v${version}/hetzner-k3s-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "vitobotta/hetzner-k3s" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/hetzner-k3s"
+
 EOF
\ No newline at end of file
diff --git a/tools/hexyl/Dockerfile.template b/tools/hexyl/Dockerfile.template
index d45f643f22..8003234120 100644
--- a/tools/hexyl/Dockerfile.template
+++ b/tools/hexyl/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export suffix="musl"
@@ -21,11 +21,15 @@ case "${alt_arch}" in
         ;;
 esac
 
-check-github-release-asset "sharkdp/hexyl" "v${version}" "hexyl-v${version}-${arch}-unknown-linux-${suffix}.tar.gz"
+url="https://github.com/sharkdp/hexyl/releases/download/v${version}/hexyl-v${version}-${arch}-unknown-linux-${suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading hexyl ${version}"
-curl --silent --show-error --location --fail "https://github.com/sharkdp/hexyl/releases/download/v${version}/hexyl-v${version}-${arch}-unknown-linux-${suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+check-github-release-asset "sharkdp/hexyl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "hexyl-v${version}-${arch}-unknown-linux-${suffix}/hexyl" \
     "hexyl-v${version}-${arch}-unknown-linux-${suffix}/hexyl.1"
 
diff --git a/tools/hishtory/Dockerfile.template b/tools/hishtory/Dockerfile.template
index 88f70a0647..5bde3be748 100644
--- a/tools/hishtory/Dockerfile.template
+++ b/tools/hishtory/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ddworken/hishtory" "v${version}" "hishtory-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/hishtory" \
-    "https://github.com/ddworken/hishtory/releases/download/v${version}/hishtory-linux-${alt_arch}"
-chmod +x "${prefix}/bin/hishtory"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ddworken/hishtory/releases/download/v${version}/hishtory-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ddworken/hishtory" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/hishtory"
+
 
 check-github-release-asset "ddworken/hishtory" "v${version}" "hishtory-server-linux-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/hishtory-server" \
diff --git a/tools/ht/Dockerfile.template b/tools/ht/Dockerfile.template
index b8b0df22ef..d73c22b9c1 100644
--- a/tools/ht/Dockerfile.template
+++ b/tools/ht/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "andyk/ht" "v${version}" "ht-${arch}-unknown-linux-${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ht" \
-    "https://github.com/andyk/ht/releases/download/v${version}/ht-${arch}-unknown-linux-${arch_suffix}"
-chmod +x "${prefix}/bin/ht"
+url="https://github.com/andyk/ht/releases/download/v${version}/ht-${arch}-unknown-linux-${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "andyk/ht" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ht"
+
 EOF
\ No newline at end of file
diff --git a/tools/htmx/Dockerfile.template b/tools/htmx/Dockerfile.template
index 03e24be27a..5b93518d60 100644
--- a/tools/htmx/Dockerfile.template
+++ b/tools/htmx/Dockerfile.template
@@ -5,11 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
+WORKDIR /uniget_bootstrap/share/htmx
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://github.com/bigskysoftware/htmx/blob/v${version}/dist/htmx.min.js"
-mkdir -p "${prefix}/share/htmx"
-curl --silent --show-error --location --fail --output "${prefix}/share/htmx/htmx.min.js" \
-    "https://github.com/bigskysoftware/htmx/blob/v${version}/dist/htmx.min.js"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/bigskysoftware/htmx/blob/v${version}/dist/htmx.min.js"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0644 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/share/htmx/htmx.min.js"
 EOF
\ No newline at end of file
diff --git a/tools/httpie/Dockerfile.template b/tools/httpie/Dockerfile.template
index d92c2f5078..0538672693 100644
--- a/tools/httpie/Dockerfile.template
+++ b/tools/httpie/Dockerfile.template
@@ -12,7 +12,7 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/http" --console-script http "httpie==${version}"
 
 curl --silent --show-error --location --fail --output "${prefix}/share/bash-completion/completions/http" \
diff --git a/tools/httpx/Dockerfile.template b/tools/httpx/Dockerfile.template
index 618aee12bc..594e46a444 100644
--- a/tools/httpx/Dockerfile.template
+++ b/tools/httpx/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/httpx" "v${version}" "httpx_${version}_linux_${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/httpx/releases/download/v${version}/httpx_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/httpx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     httpx
 EOF
\ No newline at end of file
diff --git a/tools/hub-tool/Dockerfile.template b/tools/hub-tool/Dockerfile.template
index 3879c1a7fa..974f4302a1 100644
--- a/tools/hub-tool/Dockerfile.template
+++ b/tools/hub-tool/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "docker/hub-tool" "v${version}" "hub-tool-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/docker/hub-tool/releases/download/v${version}/hub-tool-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/docker/hub-tool/releases/download/v${version}/hub-tool-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "docker/hub-tool" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     hub-tool/hub-tool
 EOF
\ No newline at end of file
diff --git a/tools/hub/Dockerfile.template b/tools/hub/Dockerfile.template
index 863968d21f..11a0205145 100644
--- a/tools/hub/Dockerfile.template
+++ b/tools/hub/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/GrantBirki/hub/releases/download/v${version}/hub-linux-${alt_arch}-${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "github/hub" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "github/hub" "v${version}" "hub-linux-${alt_arch}-${version}.tgz"
-curl --silent --show-error --location --fail "https://github.com/GrantBirki/hub/releases/download/v${version}/hub-linux-${alt_arch}-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
 rm -f \
     "${prefix}/LICENSE" \
     "${prefix}/install" \
diff --git a/tools/hubble/Dockerfile.template b/tools/hubble/Dockerfile.template
index 3cc3fe3082..ad48101173 100644
--- a/tools/hubble/Dockerfile.template
+++ b/tools/hubble/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cilium/hubble" "v${version}" "hubble-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cilium/hubble/releases/download/v${version}/hubble-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cilium/hubble/releases/download/v${version}/hubble-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cilium/hubble" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 "${prefix}/bin/hubble" completion bash >"${prefix}/share/bash-completion/completions/hubble"
 "${prefix}/bin/hubble" completion fish >"${prefix}/share/fish/vendor_completions.d/hubble.fish"
 "${prefix}/bin/hubble" completion zsh >"${prefix}/share/zsh/vendor-completions/_hubble"
diff --git a/tools/huber/Dockerfile.template b/tools/huber/Dockerfile.template
index 4f1a47b51c..8dabe5f2a5 100644
--- a/tools/huber/Dockerfile.template
+++ b/tools/huber/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "innobead/huber" "v${version}" "huber-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/huber" \
-    "https://github.com/innobead/huber/releases/download/v${version}/huber-linux-${alt_arch}"
-chmod +x "${prefix}/bin/huber"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/innobead/huber/releases/download/v${version}/huber-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "innobead/huber" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/huber"
+
 EOF
diff --git a/tools/hugo/Dockerfile.template b/tools/hugo/Dockerfile.template
index 6ac4b6c9a1..cd71a5a458 100644
--- a/tools/hugo/Dockerfile.template
+++ b/tools/hugo/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gohugoio/hugo" "v${version}" "hugo_extended_${version}_Linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/gohugoio/hugo/releases/download/v${version}/hugo_extended_${version}_Linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gohugoio/hugo/releases/download/v${version}/hugo_extended_${version}_Linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gohugoio/hugo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     hugo
 "${prefix}/bin/hugo" gen man --dir "${prefix}/share/man/man1"
 "${prefix}/bin/hugo" completion bash >"${prefix}/share/bash-completion/completions/hugo"
diff --git a/tools/hurl/Dockerfile.template b/tools/hurl/Dockerfile.template
index 2252c00e4a..f2bf2b2a9d 100644
--- a/tools/hurl/Dockerfile.template
+++ b/tools/hurl/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Orange-OpenSource/hurl" "${version}" "hurl-${version}-${arch}-unknown-linux-gnu.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Orange-OpenSource/hurl/releases/download/${version}/hurl-${version}-${arch}-unknown-linux-gnu.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Orange-OpenSource/hurl/releases/download/${version}/hurl-${version}-${arch}-unknown-linux-gnu.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Orange-OpenSource/hurl" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
 mv \
     "${prefix}/man/man1/hurl.1.gz" \
     "${prefix}/man/man1/hurlfmt.1.gz" \
diff --git a/tools/hyperfine/Dockerfile.template b/tools/hyperfine/Dockerfile.template
index e5432f2bbe..faa833575e 100644
--- a/tools/hyperfine/Dockerfile.template
+++ b/tools/hyperfine/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export suffix="musl"
@@ -21,15 +21,18 @@ case "${alt_arch}" in
         ;;
 esac
 
-check-github-release-asset "sharkdp/hyperfine" "v${version}" "hyperfine-v${version}-${arch}-unknown-linux-${suffix}.tar.gz"
+url="https://github.com/sharkdp/hyperfine/releases/download/v${version}/hyperfine-v${version}-${arch}-unknown-linux-${suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading hyperfine ${version}"
-curl --silent --show-error --location --fail "https://github.com/sharkdp/hyperfine/releases/download/v${version}/hyperfine-v${version}-${arch}-unknown-linux-${suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+check-github-release-asset "sharkdp/hyperfine" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "hyperfine-v${version}-${arch}-unknown-linux-${suffix}/hyperfine" \
     "hyperfine-v${version}-${arch}-unknown-linux-${suffix}/autocomplete"
 
-echo "### Installing completion"
 cp "${prefix}/bin/autocomplete/hyperfine.bash" "${prefix}/share/bash-completion/completions/hyperfine"
 cp "${prefix}/bin/autocomplete/hyperfine.fish" "${prefix}/share/fish/vendor_completions.d/hyperfine.fish"
 cp "${prefix}/bin/autocomplete/_hyperfine" "${prefix}/share/zsh/vendor-completions/_hyperfine"
diff --git a/tools/ignite/Dockerfile.template b/tools/ignite/Dockerfile.template
index a79d9fa0ce..7666302194 100644
--- a/tools/ignite/Dockerfile.template
+++ b/tools/ignite/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "weaveworks/ignite" "v${version}" "ignite-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ignite" \
-    "https://github.com/weaveworks/ignite/releases/download/v${version}/ignite-${alt_arch}"
-chmod +x "${prefix}/bin/ignite"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/weaveworks/ignite/releases/download/v${version}/ignite-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "weaveworks/ignite" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ignite"
+
 
 check-github-release-asset "weaveworks/ignite" "v${version}" "ignited-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/ignited" \
diff --git a/tools/img/Dockerfile.template b/tools/img/Dockerfile.template
index 8d3200ce36..1f7799cf80 100644
--- a/tools/img/Dockerfile.template
+++ b/tools/img/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "genuinetools/img" "v${version}" "img-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/img" \
-    "https://github.com/genuinetools/img/releases/download/v${version}/img-linux-${alt_arch}"
-chmod +x "${prefix}/bin/img"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/genuinetools/img/releases/download/v${version}/img-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "genuinetools/img" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/img"
+
 EOF
\ No newline at end of file
diff --git a/tools/imgcrypt/Dockerfile.template b/tools/imgcrypt/Dockerfile.template
index f9e830f1e2..95aaf97cac 100644
--- a/tools/imgcrypt/Dockerfile.template
+++ b/tools/imgcrypt/Dockerfile.template
@@ -14,7 +14,7 @@ WORKDIR /go/src/github.com/containerd/imgcrypt
 ARG name
 ARG version
 ENV CGO_ENABLED=0
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containerd/imgcrypt .
 sed -i -E 's/ -v / /' Makefile
 sed -i -E "s/ --dirty='.m' / /" Makefile
diff --git a/tools/imgpkg/Dockerfile.template b/tools/imgpkg/Dockerfile.template
index 679797f577..686854a980 100644
--- a/tools/imgpkg/Dockerfile.template
+++ b/tools/imgpkg/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "carvel-dev/imgpkg" "v${version}" "imgpkg-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/imgpkg" \
-    "https://github.com/carvel-dev/imgpkg/releases/download/v${version}/imgpkg-linux-${alt_arch}"
-chmod +x "${prefix}/bin/imgpkg"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/carvel-dev/imgpkg/releases/download/v${version}/imgpkg-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "carvel-dev/imgpkg" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/imgpkg"
+
 EOF
\ No newline at end of file
diff --git a/tools/in-toto/Dockerfile.template b/tools/in-toto/Dockerfile.template
index d1b3a4c28c..95be2cd531 100644
--- a/tools/in-toto/Dockerfile.template
+++ b/tools/in-toto/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/in-toto/in-toto-golang
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/in-toto/in-toto-golang "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/in-toto/in-toto-golang .
 make -j$(nproc) build
diff --git a/tools/incus/Dockerfile.template b/tools/incus/Dockerfile.template
index d7f46d0372..9f0eb87f3a 100644
--- a/tools/incus/Dockerfile.template
+++ b/tools/incus/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "lxc/incus" "v${version}" "bin.linux.incus.${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/incus" \
-    "https://github.com/lxc/incus/releases/download/v${version}/bin.linux.incus.${arch}"
-chmod +x "${prefix}/bin/incus"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/lxc/incus/releases/download/v${version}/bin.linux.incus.${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "lxc/incus" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/incus"
+
 EOF
\ No newline at end of file
diff --git a/tools/influx-cli/Dockerfile.template b/tools/influx-cli/Dockerfile.template
index 4bef0ddb75..9d0a4ec877 100644
--- a/tools/influx-cli/Dockerfile.template
+++ b/tools/influx-cli/Dockerfile.template
@@ -7,10 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://dl.influxdata.com/influxdb/releases/influxdb2-client-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-component=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.influxdata.com/influxdb/releases/influxdb2-client-${version}-linux-${alt_arch}.tar.gz"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-component=1 --no-same-owner \
     "./influx"
+
 "${prefix}/bin/influx" completion bash >"${prefix}/share/bash-completion/completions/influx"
 "${prefix}/bin/influx" completion zsh >"${prefix}/share/zsh/vendor-completions/_influx"
 EOF
\ No newline at end of file
diff --git a/tools/influxdb/Dockerfile.template b/tools/influxdb/Dockerfile.template
index ad346df363..ccdfce49c9 100644
--- a/tools/influxdb/Dockerfile.template
+++ b/tools/influxdb/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://dl.influxdata.com/influxdb/releases/influxdb2-${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://dl.influxdata.com/influxdb/releases/influxdb2-${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=3 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.influxdata.com/influxdb/releases/influxdb2-${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=3 --no-same-owner \
     "influxdb2-${version}/usr/bin/influxd"
 EOF
\ No newline at end of file
diff --git a/tools/ingress2gateway/Dockerfile.template b/tools/ingress2gateway/Dockerfile.template
index 46efd8fe65..e3dfa7fb6c 100644
--- a/tools/ingress2gateway/Dockerfile.template
+++ b/tools/ingress2gateway/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "kubernetes-sigs/ingress2gateway" "v${version}" "ingress2gateway_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kubernetes-sigs/ingress2gateway/releases/download/v${version}/ingress2gateway_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/kubernetes-sigs/ingress2gateway/releases/download/v${version}/ingress2gateway_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/ingress2gateway" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ingress2gateway
 
 "${prefix}/bin/ingress2gateway" completion bash >"${prefix}/share/bash-completion/completions/ingress2gateway"
diff --git a/tools/inotify-tools/Dockerfile.template b/tools/inotify-tools/Dockerfile.template
index 3c109bde87..2e2bc0ee12 100644
--- a/tools/inotify-tools/Dockerfile.template
+++ b/tools/inotify-tools/Dockerfile.template
@@ -7,8 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     gettext \
     bison
 EOF
@@ -16,7 +16,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/inotify-tools
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/inotify-tools/inotify-tools .
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-static-binary --enable-fanotify
diff --git a/tools/inshellisense/Dockerfile.template b/tools/inshellisense/Dockerfile.template
index cc97b4b260..5a2a76e4f4 100644
--- a/tools/inshellisense/Dockerfile.template
+++ b/tools/inshellisense/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /
 WORKDIR /uniget_bootstrap/libexec/inshellisense
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "@microsoft/inshellisense@${version}"
diff --git a/tools/iptables/Dockerfile.template b/tools/iptables/Dockerfile.template
index add2515e00..be97266956 100644
--- a/tools/iptables/Dockerfile.template
+++ b/tools/iptables/Dockerfile.template
@@ -9,8 +9,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     libnfnetlink-dev \
     libnfnetlink-static \
     linux-headers
@@ -21,11 +21,11 @@ COPY --link --from=libnftnl / /usr/local/
 WORKDIR /tmp/iptables
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://git.netfilter.org/iptables/" "v${version}"
 git clone --config advice.detachedHead=false --depth 1 --branch "v${version}" git://git.netfilter.org/iptables .
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 ./autogen.sh
 ./configure --prefix="${prefix}"
 make -j$(nproc)
diff --git a/tools/it-depends/Dockerfile.template b/tools/it-depends/Dockerfile.template
index 27c710f0f0..8419eadb72 100644
--- a/tools/it-depends/Dockerfile.template
+++ b/tools/it-depends/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/it-depends" --console-script it-depends "it-depends==${version}"
 EOF
diff --git a/tools/jabba/Dockerfile.template b/tools/jabba/Dockerfile.template
index 4abfd6cacb..281db7a3ae 100644
--- a/tools/jabba/Dockerfile.template
+++ b/tools/jabba/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Jabba-Team/jabba" "${version}" "jabba-${version}-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/jabba" \
-    "https://github.com/Jabba-Team/jabba/releases/download/${version}/jabba-${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/jabba"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Jabba-Team/jabba/releases/download/${version}/jabba-${version}-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Jabba-Team/jabba" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/jabba"
+
 EOF
\ No newline at end of file
diff --git a/tools/jaq/Dockerfile.template b/tools/jaq/Dockerfile.template
index 60804df3f2..ad11f60b46 100644
--- a/tools/jaq/Dockerfile.template
+++ b/tools/jaq/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/01mf02/jaq
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/01mf02/jaq .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/jaxb/Dockerfile.template b/tools/jaxb/Dockerfile.template
index edbbf02fff..866b07c6a2 100644
--- a/tools/jaxb/Dockerfile.template
+++ b/tools/jaxb/Dockerfile.template
@@ -7,11 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://repo1.maven.org/maven2/com/sun/xml/bind/jaxb-ri/${version}/jaxb-ri-${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/opt/" "${filename}"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt/" "${uniget_cache_download}/${filename}"
+
 rm -rf \
     "${prefix}/opt/jaxb-ri/docs" \
     "${prefix}/opt/jaxb-ri/samples"
diff --git a/tools/jb/Dockerfile.template b/tools/jb/Dockerfile.template
index f4c29f7dbc..69eee8cea9 100644
--- a/tools/jb/Dockerfile.template
+++ b/tools/jb/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jsonnet-bundler/jsonnet-bundler" "v${version}" "jb-linux-amd64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/jb" \
-    "https://github.com/jsonnet-bundler/jsonnet-bundler/releases/download/v${version}/jb-linux-amd64"
-chmod +x "${prefix}/bin/jb"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jsonnet-bundler/jsonnet-bundler/releases/download/v${version}/jb-linux-amd64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jsonnet-bundler/jsonnet-bundler" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/jb"
+
 EOF
\ No newline at end of file
diff --git a/tools/jc/Dockerfile.template b/tools/jc/Dockerfile.template
index f7ab2dc971..0dc3fd5ca8 100644
--- a/tools/jc/Dockerfile.template
+++ b/tools/jc/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/jc" --console-script jc "jc==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/jenkins-remoting/Dockerfile.template b/tools/jenkins-remoting/Dockerfile.template
index ee534c2093..aecee2d168 100644
--- a/tools/jenkins-remoting/Dockerfile.template
+++ b/tools/jenkins-remoting/Dockerfile.template
@@ -5,10 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
+WORKDIR /uniget_bootstrap/opt/jenkins
 ARG name
 ARG version
-RUN <<EOF
-mkdir -p "${prefix}/opt/jenkins"
-curl --silent --show-error --location --fail --output "${prefix}/opt/jenkins/remoting.jar" \
-    "https://repo.jenkins-ci.org/public/org/jenkins-ci/main/remoting/${version}/remoting-${version}.jar"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://repo.jenkins-ci.org/public/org/jenkins-ci/main/remoting/${version}/remoting-${version}.jar"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0644 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/opt/jenkins/${filename}"
 EOF
\ No newline at end of file
diff --git a/tools/jetbrainsmono/Dockerfile.template b/tools/jetbrainsmono/Dockerfile.template
index 48318c2b07..7288f0cd02 100644
--- a/tools/jetbrainsmono/Dockerfile.template
+++ b/tools/jetbrainsmono/Dockerfile.template
@@ -8,12 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/jetbrainsmono
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "JetBrains/JetBrainsMono" "v${version}" "JetBrainsMono-2.304.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/JetBrains/JetBrainsMono/releases/download/v2.304/JetBrainsMono-2.304.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o "${filename}"
+
+check-github-release-asset "JetBrains/JetBrainsMono" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o "${uniget_cache_download}/${filename}"
 
 mkdir -p \
     "${prefix}/share/jetbrainsmono" \
diff --git a/tools/jf/Dockerfile.template b/tools/jf/Dockerfile.template
index 8297272716..a68166a6be 100644
--- a/tools/jf/Dockerfile.template
+++ b/tools/jf/Dockerfile.template
@@ -5,14 +5,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/${version}/jfrog-cli-linux-${alt_arch}/jf"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/jf"
 
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/jf" \
-    "https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/${version}/jfrog-cli-linux-${alt_arch}/jf"
-chmod +x "${prefix}/bin/jf"
 "${prefix}/bin/jf" completion bash >"${prefix}/share/bash-completion/completions/jf"
 "${prefix}/bin/jf" completion fish >"${prefix}/share/fish/vendor_completions.d/jf.fish"
 "${prefix}/bin/jf" completion zsh >"${prefix}/share/zsh/vendor-completions/_jf"
diff --git a/tools/jfq/Dockerfile.template b/tools/jfq/Dockerfile.template
index 78ad43a857..53df13e2c1 100644
--- a/tools/jfq/Dockerfile.template
+++ b/tools/jfq/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/jfq
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "jfq@${version}"
diff --git a/tools/jj/Dockerfile.template b/tools/jj/Dockerfile.template
index 7a22967127..d5c898fa56 100644
--- a/tools/jj/Dockerfile.template
+++ b/tools/jj/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "martinvonz/jj" "v${version}" "jj-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/martinvonz/jj/releases/download/v${version}/jj-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/martinvonz/jj/releases/download/v${version}/jj-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "martinvonz/jj" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ./jj
 EOF
\ No newline at end of file
diff --git a/tools/jless/Dockerfile.template b/tools/jless/Dockerfile.template
index f044b79be9..8f5025fe65 100644
--- a/tools/jless/Dockerfile.template
+++ b/tools/jless/Dockerfile.template
@@ -7,10 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "PaulJuliusMartinez/jless" "v${version}" "jless-v${version}-x86_64-unknown-linux-gnu.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/PaulJuliusMartinez/jless/releases/download/v${version}/jless-v${version}-x86_64-unknown-linux-gnu.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "PaulJuliusMartinez/jless" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 EOF
\ No newline at end of file
diff --git a/tools/jnv/Dockerfile.template b/tools/jnv/Dockerfile.template
index 436a3d17d0..e986120948 100644
--- a/tools/jnv/Dockerfile.template
+++ b/tools/jnv/Dockerfile.template
@@ -7,8 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=rust / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     python3-pip \
@@ -17,10 +16,11 @@ apt-get -y install --no-install-recommends \
     valgrind \
     libclang-dev
 EOF
+COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/ynqa/jnv
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/ynqa/jnv .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/jp/Dockerfile.template b/tools/jp/Dockerfile.template
index 0af4b7dd98..414bcbf4f0 100644
--- a/tools/jp/Dockerfile.template
+++ b/tools/jp/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jmespath/jp" "${version}" "jp-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/jp" \
-    "https://github.com/jmespath/jp/releases/download/${version}/jp-linux-${alt_arch}"
-chmod +x "${prefix}/bin/jp"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jmespath/jp/releases/download/${version}/jp-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jmespath/jp" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/jp"
+
 EOF
\ No newline at end of file
diff --git a/tools/jq/Dockerfile.template b/tools/jq/Dockerfile.template
index 65ba659813..9b92d53ab2 100644
--- a/tools/jq/Dockerfile.template
+++ b/tools/jq/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jqlang/jq" "jq-${version}" "jq-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/jq" \
-    "https://github.com/jqlang/jq/releases/download/jq-${version}/jq-linux-${alt_arch}"
-chmod +x "${prefix}/bin/jq"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jqlang/jq/releases/download/jq-${version}/jq-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jqlang/jq" "jq-${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/jq"
+
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/jq.1" \
     "https://raw.githubusercontent.com/jqlang/jq/jq-${version}/jq.1.prebuilt"
 EOF
diff --git a/tools/jqp/Dockerfile.template b/tools/jqp/Dockerfile.template
index 7486c77461..04743a78ba 100644
--- a/tools/jqp/Dockerfile.template
+++ b/tools/jqp/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "noahgorstein/jqp" "v${version}" "jqp_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/noahgorstein/jqp/releases/download/v${version}/jqp_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading jqp ${version}"
-curl --silent --show-error --location --fail "https://github.com/noahgorstein/jqp/releases/download/v${version}/jqp_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "noahgorstein/jqp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     jqp
 EOF
\ No newline at end of file
diff --git a/tools/json-exporter/Dockerfile.template b/tools/json-exporter/Dockerfile.template
index 5f93853df5..878b54b98e 100644
--- a/tools/json-exporter/Dockerfile.template
+++ b/tools/json-exporter/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus-community/json_exporter" "v${version}" "json_exporter-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus-community/json_exporter/releases/download/v${version}/json_exporter-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus-community/json_exporter/releases/download/v${version}/json_exporter-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus-community/json_exporter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "json_exporter-${version}.linux-${alt_arch}/json_exporter"
 EOF
\ No newline at end of file
diff --git a/tools/jsonata-cli/Dockerfile.template b/tools/jsonata-cli/Dockerfile.template
index b5822a095f..95b4cd5d19 100644
--- a/tools/jsonata-cli/Dockerfile.template
+++ b/tools/jsonata-cli/Dockerfile.template
@@ -15,7 +15,7 @@ ARG version
 WORKDIR /uniget_bootstrap/libexec/jsonata-cli
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "jsonata-cli@${version}"
diff --git a/tools/jsonata-cli/manifest.yaml b/tools/jsonata-cli/manifest.yaml
index a4a4900374..d08c43dcc7 100644
--- a/tools/jsonata-cli/manifest.yaml
+++ b/tools/jsonata-cli/manifest.yaml
@@ -4,10 +4,10 @@ name: jsonata-cli
 version: "2.0.3"
 check: ${binary} --version
 build_dependencies:
-- node
+- nodejs
 - npm
 runtime_dependencies:
-- node
+- nodejs
 platforms:
 - linux/amd64
 - linux/arm64
diff --git a/tools/jsonnet/Dockerfile.template b/tools/jsonnet/Dockerfile.template
index b379c07316..e6c11ea012 100644
--- a/tools/jsonnet/Dockerfile.template
+++ b/tools/jsonnet/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "google/go-jsonnet" "v${version}" "go-jsonnet_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/google/go-jsonnet/releases/download/v${version}/go-jsonnet_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/google/go-jsonnet/releases/download/v${version}/go-jsonnet_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "google/go-jsonnet" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     jsonnet \
     jsonnetfmt
 EOF
\ No newline at end of file
diff --git a/tools/jsonplot/Dockerfile.template b/tools/jsonplot/Dockerfile.template
index fac8897766..81a14fac7b 100644
--- a/tools/jsonplot/Dockerfile.template
+++ b/tools/jsonplot/Dockerfile.template
@@ -13,7 +13,7 @@ ARG name
 ARG version
 ENV GOPATH=/go \
     GO111MODULE=auto
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/sgreben/jp .
 rm -rf vendor
 go mod init github.com/sgreben/jp
diff --git a/tools/just/Dockerfile.template b/tools/just/Dockerfile.template
index 7631cc2e47..adf2d3dd7d 100644
--- a/tools/just/Dockerfile.template
+++ b/tools/just/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "casey/just" "${version}" "just-${version}-x86_64-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/casey/just/releases/download/${version}/just-${version}-x86_64-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/casey/just/releases/download/${version}/just-${version}-x86_64-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "casey/just" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     just \
     just.1
 mv "${prefix}/bin/just.1" "${prefix}/share/man/man1/"
diff --git a/tools/jwt/Dockerfile.template b/tools/jwt/Dockerfile.template
index c568a6939e..78b1e66390 100644
--- a/tools/jwt/Dockerfile.template
+++ b/tools/jwt/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/mike-engel/jwt-cli
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/mike-engel/jwt-cli .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/jx/Dockerfile.template b/tools/jx/Dockerfile.template
index c91486956c..643a17fbee 100644
--- a/tools/jx/Dockerfile.template
+++ b/tools/jx/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jenkins-x/jx" "v${version}" "jx-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jenkins-x/jx/releases/download/v${version}/jx-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jenkins-x/jx/releases/download/v${version}/jx-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jenkins-x/jx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     jx
 
 curl --silent --show-error --location --fail "https://github.com/jenkins-x/jx/archive/refs/tags/v${version}.tar.gz" \
diff --git a/tools/k0s/Dockerfile.template b/tools/k0s/Dockerfile.template
index 200d9733f0..c5280da98b 100644
--- a/tools/k0s/Dockerfile.template
+++ b/tools/k0s/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "k0sproject/k0s" "v${version}" "k0s-v${version}-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k0s" \
-    "https://github.com/k0sproject/k0s/releases/download/v${version}/k0s-v${version}-${alt_arch}"
-chmod +x "${prefix}/bin/k0s"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/k0sproject/k0s/releases/download/v${version}/k0s-v${version}-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "k0sproject/k0s" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k0s"
+
 
 "${prefix}/bin/k0s" completion bash >"${prefix}/share/bash-completion/completions/k0s"
 "${prefix}/bin/k0s" completion fish >"${prefix}/share/fish/vendor_completions.d/k0s.fish"
diff --git a/tools/k0sctl/Dockerfile.template b/tools/k0sctl/Dockerfile.template
index a9573f166c..6a252ec0a0 100644
--- a/tools/k0sctl/Dockerfile.template
+++ b/tools/k0sctl/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "k0sproject/k0sctl" "v${version}" "k0sctl-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k0sctl" \
-    "https://github.com/k0sproject/k0sctl/releases/download/v${version}/k0sctl-linux-${alt_arch}"
-chmod +x "${prefix}/bin/k0sctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/k0sproject/k0sctl/releases/download/v${version}/k0sctl-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "k0sproject/k0sctl" "v${version}" "${filename}"
+check-github-release-asset "k0sproject/k0sctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k0sctl"
 
 "${prefix}/bin/k0sctl" completion bash >"${prefix}/share/bash-completion/completions/k0sctl"
 "${prefix}/bin/k0sctl" completion fish >"${prefix}/share/fish/vendor_completions.d/k0sctl.fish"
diff --git a/tools/k2d/Dockerfile.template b/tools/k2d/Dockerfile.template
index cd6edc422d..73d3ce79fe 100644
--- a/tools/k2d/Dockerfile.template
+++ b/tools/k2d/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/portainer/k2d
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/portainer/k2d .
 make -j$(nproc) release
 cp dist/k2d "${prefix}/bin/"
diff --git a/tools/k3d/Dockerfile.template b/tools/k3d/Dockerfile.template
index c6205a075d..c5ff8bdbb2 100644
--- a/tools/k3d/Dockerfile.template
+++ b/tools/k3d/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rancher/k3d" "v${version}" "k3d-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k3d" \
-    "https://github.com/rancher/k3d/releases/download/v${version}/k3d-linux-${alt_arch}"
-chmod +x "${prefix}/bin/k3d"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rancher/k3d/releases/download/v${version}/k3d-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rancher/k3d" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k3d"
+
 "${prefix}/bin/k3d" completion bash >"${prefix}/share/bash-completion/completions/k3d"
 "${prefix}/bin/k3d" completion fish >"${prefix}/share/fish/vendor_completions.d/k3d.fish"
 "${prefix}/bin/k3d" completion zsh >"${prefix}/share/zsh/vendor-completions/_k3d"
diff --git a/tools/k3s/Dockerfile.template b/tools/k3s/Dockerfile.template
index 6e726c7b78..389ef1fe99 100644
--- a/tools/k3s/Dockerfile.template
+++ b/tools/k3s/Dockerfile.template
@@ -8,7 +8,7 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY k3s.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -29,12 +29,17 @@ real_version="$(
     | sed -E 's/^([[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+)\.([[:digit:]]+)$/\1+k3s\2/'
 )"
 
-check-github-release-asset "k3s-io/k3s" "v${real_version}" "k3s${arch_suffix}"
+url="https://github.com/k3s-io/k3s/releases/download/v${real_version}/k3s${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "k3s-io/k3s" "v${real_version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k3s"
 
-echo "### Downloading ${name} ${real_version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k3s" \
-    "https://github.com/k3s-io/k3s/releases/download/v${real_version}/k3s${arch_suffix}"
-chmod +x "${prefix}/bin/k3s"
 "${prefix}/bin/k3s" completion bash >"${prefix}/share/bash-completion/completions/k3s"
 "${prefix}/bin/k3s" completion zsh >"${prefix}/share/zsh/vendor-completions/_k3s"
 EOF
\ No newline at end of file
diff --git a/tools/k3sup/Dockerfile.template b/tools/k3sup/Dockerfile.template
index e53eccd8f7..e6916dd3fb 100644
--- a/tools/k3sup/Dockerfile.template
+++ b/tools/k3sup/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "alexellis/k3sup" "${version}" "k3sup"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k3sup" \
-    "https://github.com/alexellis/k3sup/releases/download/${version}/k3sup"
-chmod +x "${prefix}/bin/k3sup"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/alexellis/k3sup/releases/download/${version}/k3sup"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "alexellis/k3sup" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k3sup"
+
 "${prefix}/bin/k3sup" completion bash >"${prefix}/share/bash-completion/completions/k3sup"
 "${prefix}/bin/k3sup" completion fish >"${prefix}/share/fish/vendor_completions.d/k3sup.fish"
 "${prefix}/bin/k3sup" completion zsh >"${prefix}/share/zsh/vendor-completions/_k3sup"
diff --git a/tools/k6/Dockerfile.template b/tools/k6/Dockerfile.template
index 1b034b483c..3c49a9f066 100644
--- a/tools/k6/Dockerfile.template
+++ b/tools/k6/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/k6" "v${version}" "k6-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/grafana/k6/releases/download/v${version}/k6-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/grafana/k6/releases/download/v${version}/k6-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/k6" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
 "${prefix}/bin/k6" completion bash >"${prefix}/share/bash-completion/completions/k6"
 "${prefix}/bin/k6" completion fish >"${prefix}/share/fish/vendor_completions.d/k6.fish"
 "${prefix}/bin/k6" completion zsh >"${prefix}/share/zsh/vendor-completions/_k6"
diff --git a/tools/k8s-tew/Dockerfile.template b/tools/k8s-tew/Dockerfile.template
index 4dc751f791..a3009f2ca5 100644
--- a/tools/k8s-tew/Dockerfile.template
+++ b/tools/k8s-tew/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "darxkies/k8s-tew" "${version}" "k8s-tew"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k8s-tew" \
-    "https://github.com/darxkies/k8s-tew/releases/download/${version}/k8s-tew"
-chmod +x "${prefix}/bin/k8s-tew"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/darxkies/k8s-tew/releases/download/${version}/k8s-tew"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "darxkies/k8s-tew" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k8s-tew"
+
 
 "${prefix}/bin/k8s-tew" completion bash >"${prefix}/share/bash-completion/completions/k8s-tew"
 "${prefix}/bin/k8s-tew" completion zsh >"${prefix}/share/zsh/vendor-completions/_k8s-tew"
diff --git a/tools/k8senv/Dockerfile.template b/tools/k8senv/Dockerfile.template
index c542e02b18..30333984b1 100644
--- a/tools/k8senv/Dockerfile.template
+++ b/tools/k8senv/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "navilg/k8senv" "v${version}" "k8senv-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/k8senv" \
-    "https://github.com/navilg/k8senv/releases/download/v${version}/k8senv-linux-${alt_arch}"
-chmod +x "${prefix}/bin/k8senv"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/navilg/k8senv/releases/download/v${version}/k8senv-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "navilg/k8senv" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/k8senv"
+
 
 "${prefix}/bin/k8senv" completion bash >"${prefix}/share/bash-completion/completions/k8senv"
 "${prefix}/bin/k8senv" completion fish >"${prefix}/share/fish/vendor_completions.d/k8senv.fish"
diff --git a/tools/k8spacket/Dockerfile.template b/tools/k8spacket/Dockerfile.template
index d47502f2a2..adb6aa51a0 100644
--- a/tools/k8spacket/Dockerfile.template
+++ b/tools/k8spacket/Dockerfile.template
@@ -8,8 +8,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     clang \
     llvm
 EOF
diff --git a/tools/k9s/Dockerfile.template b/tools/k9s/Dockerfile.template
index a542525233..7f623c61b0 100644
--- a/tools/k9s/Dockerfile.template
+++ b/tools/k9s/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "derailed/k9s" "v${version}" "k9s_Linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/derailed/k9s/releases/download/v${version}/k9s_Linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/derailed/k9s/releases/download/v${version}/k9s_Linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "derailed/k9s" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     k9s
 "${prefix}/bin/k9s" completion bash >"${prefix}/share/bash-completion/completions/k9s"
 "${prefix}/bin/k9s" completion fish >"${prefix}/share/fish/vendor_completions.d/k9s.fish"
diff --git a/tools/kapp/Dockerfile.template b/tools/kapp/Dockerfile.template
index 3ffb165130..cdc6f4c43e 100644
--- a/tools/kapp/Dockerfile.template
+++ b/tools/kapp/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "carvel-dev/kapp" "v${version}" "kapp-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kapp" \
-    "https://github.com/carvel-dev/kapp/releases/download/v${version}/kapp-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kapp"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/carvel-dev/kapp/releases/download/v${version}/kapp-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "carvel-dev/kapp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kapp"
+
 "${prefix}/bin/kapp" completion bash >"${prefix}/share/bash-completion/completions/kapp"
 "${prefix}/bin/kapp" completion fish >"${prefix}/share/fish/vendor_completions.d/kapp.fish"
 "${prefix}/bin/kapp" completion zsh >"${prefix}/share/zsh/vendor-completions/_kapp"
diff --git a/tools/katana/Dockerfile.template b/tools/katana/Dockerfile.template
index 952e42cab7..98b5e9909f 100644
--- a/tools/katana/Dockerfile.template
+++ b/tools/katana/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/katana" "v${version}" "katana_${version}_linux_${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/katana/releases/download/v${version}/katana_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/katana" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     katana
 EOF
\ No newline at end of file
diff --git a/tools/kbld/Dockerfile.template b/tools/kbld/Dockerfile.template
index 6a900c7156..5c1e4c5016 100644
--- a/tools/kbld/Dockerfile.template
+++ b/tools/kbld/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "carvel-dev/kbld" "v${version}" "kbld-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kbld" \
-    "https://github.com/carvel-dev/kbld/releases/download/v${version}/kbld-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kbld"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/carvel-dev/kbld/releases/download/v${version}/kbld-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "carvel-dev/kbld" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kbld"
+
 EOF
\ No newline at end of file
diff --git a/tools/kbom/Dockerfile.template b/tools/kbom/Dockerfile.template
index 1bd1defb4f..8b288f1014 100644
--- a/tools/kbom/Dockerfile.template
+++ b/tools/kbom/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rad-security/kbom" "v${version}" "kbom_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/rad-security/kbom/releases/download/v${version}/kbom_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rad-security/kbom/releases/download/v${version}/kbom_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rad-security/kbom" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kbom
 
 "${prefix}/bin/kbom" completion bash >"${prefix}/share/bash-completion/completions/kbom"
diff --git a/tools/kbrew/Dockerfile.template b/tools/kbrew/Dockerfile.template
index 2461daf401..e63ed8ad6b 100644
--- a/tools/kbrew/Dockerfile.template
+++ b/tools/kbrew/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kbrew-dev/kbrew" "v${version}" "kbrew_${version}_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kbrew-dev/kbrew/releases/download/v${version}/kbrew_${version}_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kbrew-dev/kbrew/releases/download/v${version}/kbrew_${version}_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kbrew-dev/kbrew" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kbrew
 "${prefix}/bin/kbrew" completion bash >"${prefix}/share/bash-completion/completions/kbrew"
 "${prefix}/bin/kbrew" completion fish >"${prefix}/share/fish/vendor_completions.d/kbrew.fish"
diff --git a/tools/kcount/Dockerfile.template b/tools/kcount/Dockerfile.template
index 1b0d7b4be5..0aeb5df60d 100644
--- a/tools/kcount/Dockerfile.template
+++ b/tools/kcount/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "pan-net-security/kcount" "v${version}" "kcount_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/pan-net-security/kcount/releases/download/v${version}/kcount_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/pan-net-security/kcount/releases/download/v${version}/kcount_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "pan-net-security/kcount" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kcount
 EOF
\ No newline at end of file
diff --git a/tools/kcp/Dockerfile.template b/tools/kcp/Dockerfile.template
index b89c36ad7d..869bd19fd1 100644
--- a/tools/kcp/Dockerfile.template
+++ b/tools/kcp/Dockerfile.template
@@ -8,24 +8,35 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 
-RUN <<EOF
-check-github-release-asset "kcp-dev/kcp" "v${version}" "kcp_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kcp-dev/kcp/releases/download/v${version}/kcp_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kcp-dev/kcp/releases/download/v${version}/kcp_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kcp-dev/kcp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     bin/kcp
 EOF
 
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 for plugin in kcp ws create-workspace; do
     echo "Installing plugin ${plugin}"
-    check-github-release-asset "kcp-dev/kcp" "v${version}" "kubectl-${plugin}-plugin_${version}_linux_${alt_arch}.tar.gz"
-    curl --silent --show-error --location --fail "https://github.com/kcp-dev/kcp/releases/download/v${version}/kubectl-${plugin}-plugin_${version}_linux_${alt_arch}.tar.gz" \
-    | tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+    url="https://github.com/kcp-dev/kcp/releases/download/v${version}/kubectl-${plugin}-plugin_${version}_linux_${alt_arch}.tar.gz"
+    filename="$(basename "${url}")"
+
+    check-github-release-asset "kcp-dev/kcp" "v${version}" "${filename}"
+    curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+        "${url}"
+    tar --file="${uniget_cache_download}/${filename}" --list
+    tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
         "bin/kubectl-${plugin}"
 done
 EOF
 
-RUN <<EOF
+RUN <<EOF # no download cache
 for plugin in kcp ws; do
     echo "Installing completion for plugin ${plugin}"
     "${prefix}/bin/kubectl-${plugin}" completion bash >"${prefix}/share/bash-completion/completions/kubectl-${plugin}"
diff --git a/tools/kd/Dockerfile.template b/tools/kd/Dockerfile.template
index b953226f9a..c957e28ae0 100644
--- a/tools/kd/Dockerfile.template
+++ b/tools/kd/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "UKHomeOffice/kd" "v${version}" "kd_linux_amd64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kd" \
-    "https://github.com/UKHomeOffice/kd/releases/download/v${version}/kd_linux_amd64"
-chmod +x "${prefix}/bin/kd"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/UKHomeOffice/kd/releases/download/v${version}/kd_linux_amd64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "UKHomeOffice/kd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kd"
+
 EOF
\ No newline at end of file
diff --git a/tools/kdo/Dockerfile.template b/tools/kdo/Dockerfile.template
index 2eddc3b2cd..681e10f734 100644
--- a/tools/kdo/Dockerfile.template
+++ b/tools/kdo/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stepro/kdo" "v${version}" "kdo-v${version}-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/stepro/kdo/releases/download/v${version}/kdo-v${version}-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stepro/kdo/releases/download/v${version}/kdo-v${version}-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stepro/kdo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/ketch/Dockerfile.template b/tools/ketch/Dockerfile.template
index ebaec8fd9e..833f85d213 100644
--- a/tools/ketch/Dockerfile.template
+++ b/tools/ketch/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "theketchio/ketch" "v${version}" "ketch-linux-amd64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ketch" \
-    "https://github.com/theketchio/ketch/releases/download/v${version}/ketch-linux-amd64"
-chmod +x "${prefix}/bin/ketch"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/theketchio/ketch/releases/download/v${version}/ketch-linux-amd64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "theketchio/ketch" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ketch"
+
 EOF
\ No newline at end of file
diff --git a/tools/kexp/Dockerfile.template b/tools/kexp/Dockerfile.template
index 4014c1e7a9..52bb58bea9 100644
--- a/tools/kexp/Dockerfile.template
+++ b/tools/kexp/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "iximiuz/kexp" "v${version}" "kexp_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/iximiuz/kexp/releases/download/v${version}/kexp_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/iximiuz/kexp/releases/download/v${version}/kexp_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "iximiuz/kexp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kexp
 EOF
diff --git a/tools/keybase/Dockerfile.template b/tools/keybase/Dockerfile.template
index 7691edcda6..4e335024f2 100644
--- a/tools/keybase/Dockerfile.template
+++ b/tools/keybase/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/keybase/client
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/keybase/client .
 cd go
 go build -tags production -ldflags '-linkmode external -extldflags "-static"' -o "${prefix}/bin/keybase" github.com/keybase/client/go/keybase
diff --git a/tools/keyoxide/Dockerfile.template b/tools/keyoxide/Dockerfile.template
index 1e05cc44c5..517083b3a0 100644
--- a/tools/keyoxide/Dockerfile.template
+++ b/tools/keyoxide/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/keyoxide
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "keyoxide@${version}"
diff --git a/tools/kgctl/Dockerfile.template b/tools/kgctl/Dockerfile.template
index d663b813ed..5efbc6510e 100644
--- a/tools/kgctl/Dockerfile.template
+++ b/tools/kgctl/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "squat/kilo" "${version}" "kgctl-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kgctl" \
-    "https://github.com/squat/kilo/releases/download/${version}/kgctl-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kgctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/squat/kilo/releases/download/${version}/kgctl-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "squat/kilo" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kgctl"
+
 EOF
\ No newline at end of file
diff --git a/tools/kind/Dockerfile.template b/tools/kind/Dockerfile.template
index 02eb1d3f83..a69e0f1d94 100644
--- a/tools/kind/Dockerfile.template
+++ b/tools/kind/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/kind" "v${version}" "kind-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kind" \
-    "https://github.com/kubernetes-sigs/kind/releases/download/v${version}/kind-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kind"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/kind/releases/download/v${version}/kind-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/kind" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kind"
+
 "${prefix}/bin/kind" completion bash >"${prefix}/share/bash-completion/completions/kind"
 "${prefix}/bin/kind" completion fish >"${prefix}/share/fish/vendor_completions.d/kind.fish"
 "${prefix}/bin/kind" completion zsh >"${prefix}/share/zsh/vendor-completions/_kind"
diff --git a/tools/kine/Dockerfile.template b/tools/kine/Dockerfile.template
index 0c0de0d597..b561ddb0aa 100644
--- a/tools/kine/Dockerfile.template
+++ b/tools/kine/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/k3s-io/kine
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/k3s-io/kine" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/k3s-io/kine .
 
diff --git a/tools/kink/Dockerfile.template b/tools/kink/Dockerfile.template
index 449c571b52..322d72cd55 100644
--- a/tools/kink/Dockerfile.template
+++ b/tools/kink/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Trendyol/kink" "v${version}" "kink_${version}_Linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Trendyol/kink/releases/download/v${version}/kink_${version}_Linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Trendyol/kink/releases/download/v${version}/kink_${version}_Linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Trendyol/kink" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kink
 "${prefix}/bin/kink" completion bash >"${prefix}/share/bash-completion/completions/kink"
 "${prefix}/bin/kink" completion fish >"${prefix}/share/fish/vendor_completions.d/kink.fish"
diff --git a/tools/kitt/Dockerfile.template b/tools/kitt/Dockerfile.template
index 6f0cd006c2..9f695e44a1 100644
--- a/tools/kitt/Dockerfile.template
+++ b/tools/kitt/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/kitt" --console-script kitt "kitt-shell==${version}" cryptography
 EOF
diff --git a/tools/kitty/Dockerfile.template b/tools/kitty/Dockerfile.template
index be24b7041b..0d8a9854ba 100644
--- a/tools/kitty/Dockerfile.template
+++ b/tools/kitty/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,7 +23,13 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "kovidgoyal/kitty" "v${version}" "kitty-${version}-${arch_suffix}.txz"
-curl --silent --show-error --location --fail "https://github.com/kovidgoyal/kitty/releases/download/v${version}/kitty-${version}-${arch_suffix}.txz" \
-| tar --extract --xz --directory="${prefix}/" --no-same-owner
+url="https://github.com/kovidgoyal/kitty/releases/download/v${version}/kitty-${version}-${arch_suffix}.txz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kovidgoyal/kitty" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/kluctl/Dockerfile.template b/tools/kluctl/Dockerfile.template
index 1a02ccfe64..e7f04b4c69 100644
--- a/tools/kluctl/Dockerfile.template
+++ b/tools/kluctl/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kluctl/kluctl" "v${version}" "kluctl_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kluctl/kluctl/releases/download/v${version}/kluctl_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kluctl/kluctl/releases/download/v${version}/kluctl_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kluctl/kluctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 "${prefix}/bin/kluctl" completion bash >"${prefix}/share/bash-completion/completions/kluctl"
 "${prefix}/bin/kluctl" completion fish >"${prefix}/share/fish/vendor_completions.d/kluctl.fish"
 "${prefix}/bin/kluctl" completion zsh >"${prefix}/share/zsh/vendor-completions/_kluctl"
diff --git a/tools/kmon/Dockerfile.template b/tools/kmon/Dockerfile.template
index 36fc8bd47d..8f6a1d3943 100644
--- a/tools/kmon/Dockerfile.template
+++ b/tools/kmon/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "orhun/kmon" "v${version}" "kmon-${version}-x86_64-unknown-linux-gnu.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/orhun/kmon/releases/download/v${version}/kmon-${version}-x86_64-unknown-linux-gnu.tar.gz" \
-| tar --extract --gzip --directory="/tmp" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/orhun/kmon/releases/download/v${version}/kmon-${version}-x86_64-unknown-linux-gnu.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "orhun/kmon" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="/tmp" --no-same-owner
 find /tmp
 mv "/tmp/kmon-${version}/kmon" "${prefix}/bin/"
 mv "/tmp/kmon-${version}/man/kmon.8" "${prefix}/share/man/man8/"
diff --git a/tools/kn/Dockerfile.template b/tools/kn/Dockerfile.template
index 77db416420..199a1befcc 100644
--- a/tools/kn/Dockerfile.template
+++ b/tools/kn/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "knative/client" "knative-v${version}" "kn-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kn" \
-    "https://github.com/knative/client/releases/download/knative-v${version}/kn-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kn"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/knative/client/releases/download/knative-v${version}/kn-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "knative/client" "knative-v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kn"
+
 "${prefix}/bin/kn" completion bash >"${prefix}/share/bash-completion/completions/kn"
 "${prefix}/bin/kn" completion zsh >"${prefix}/share/zsh/vendor-completions/_kn"
 EOF
\ No newline at end of file
diff --git a/tools/ko/Dockerfile.template b/tools/ko/Dockerfile.template
index 2462119413..c72b049c73 100644
--- a/tools/ko/Dockerfile.template
+++ b/tools/ko/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "ko-build/ko" "v${version}" "ko_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ko-build/ko/releases/download/v${version}/ko_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/ko-build/ko/releases/download/v${version}/ko_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ko-build/ko" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ko
 
 "${prefix}/bin/ko" completion bash >"${prefix}/share/bash-completion/completions/ko"
diff --git a/tools/kompose/Dockerfile.template b/tools/kompose/Dockerfile.template
index 2f871094e7..f5282331f9 100644
--- a/tools/kompose/Dockerfile.template
+++ b/tools/kompose/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes/kompose" "v${version}" "kompose-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kompose" \
-    "https://github.com/kubernetes/kompose/releases/download/v${version}/kompose-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kompose"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes/kompose/releases/download/v${version}/kompose-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes/kompose" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kompose"
+
 "${prefix}/bin/kompose" completion bash >"${prefix}/share/bash-completion/completions/kompose"
 "${prefix}/bin/kompose" completion fish >"${prefix}/share/fish/vendor_completions.d/kompose.fish"
 "${prefix}/bin/kompose" completion zsh >"${prefix}/share/zsh/vendor-completions/_kompose"
diff --git a/tools/konf/Dockerfile.template b/tools/konf/Dockerfile.template
index d7c866a5c0..427a343d10 100644
--- a/tools/konf/Dockerfile.template
+++ b/tools/konf/Dockerfile.template
@@ -17,10 +17,16 @@ case "\$(basename "\${SHELL}")" in
         ;;
 esac
 EOF
-RUN <<EOF
-check-github-release-asset "SimonTheLeg/konf-go" "v${version}" "konf-go_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/SimonTheLeg/konf-go/releases/download/v${version}/konf-go_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/SimonTheLeg/konf-go/releases/download/v${version}/konf-go_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "SimonTheLeg/konf-go" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     konf-go
 "${prefix}/bin/konf-go" completion bash >"${prefix}/share/bash-completion/completions/konf"
 "${prefix}/bin/konf-go" completion zsh >"${prefix}/share/zsh/vendor-completions/_konf"
diff --git a/tools/kots/Dockerfile.template b/tools/kots/Dockerfile.template
index ed16bc47bd..5e735ad9f6 100644
--- a/tools/kots/Dockerfile.template
+++ b/tools/kots/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "replicatedhq/kots" "v${version}" "kots_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/replicatedhq/kots/releases/download/v${version}/kots_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/replicatedhq/kots/releases/download/v${version}/kots_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "replicatedhq/kots" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kots
 mv "${prefix}/bin/kots" "${prefix}/bin/kubectl-kots"
 "${prefix}/bin/kubectl-kots" completion bash >"${prefix}/share/bash-completion/completions/kubectl-kots"
diff --git a/tools/kp/Dockerfile.template b/tools/kp/Dockerfile.template
index cfe7a0cf8e..2c53f9dcb4 100644
--- a/tools/kp/Dockerfile.template
+++ b/tools/kp/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "buildpacks-community/kpack-cli" "v${version}" "kp-linux-amd64-${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kp" \
-    "https://github.com/buildpacks-community/kpack-cli/releases/download/v${version}/kp-linux-amd64-${version}"
-chmod +x "${prefix}/bin/kp"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/buildpacks-community/kpack-cli/releases/download/v${version}/kp-linux-amd64-${version}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "buildpacks-community/kpack-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kp"
+
 "${prefix}/bin/kp" completion bash >"${prefix}/share/bash-completion/completions/kp"
 "${prefix}/bin/kp" completion fish >"${prefix}/share/fish/vendor_completions.d/kp.fish"
 "${prefix}/bin/kp" completion zsh >"${prefix}/share/zsh/vendor-completions/_kp"
diff --git a/tools/kpt/Dockerfile.template b/tools/kpt/Dockerfile.template
index 92cc0d9c08..5a0b0a3a85 100644
--- a/tools/kpt/Dockerfile.template
+++ b/tools/kpt/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kptdev/kpt" "v${version}" "kpt_linux_${alt_arch}-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kptdev/kpt/releases/download/v${version}/kpt_linux_${alt_arch}-${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kptdev/kpt/releases/download/v${version}/kpt_linux_${alt_arch}-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kptdev/kpt" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kpt
     
 "${prefix}/bin/kpt" completion bash >"${prefix}/share/bash-completion/completions/kpt"
diff --git a/tools/kpxhs/Dockerfile.template b/tools/kpxhs/Dockerfile.template
index 23f129f358..103cbffa43 100644
--- a/tools/kpxhs/Dockerfile.template
+++ b/tools/kpxhs/Dockerfile.template
@@ -7,22 +7,29 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     python3-pip \
     python3-venv \
     python-is-python3
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/kpxhs
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "akazukin5151/kpxhs" "v${version}" "kpxhs-linux"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kpxhs" \
-    "https://github.com/akazukin5151/kpxhs/releases/download/v${version}/kpxhs-linux"
-chmod +x "${prefix}/bin/kpxhs"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/akazukin5151/kpxhs/releases/download/v${version}/kpxhs-linux"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "akazukin5151/kpxhs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kpxhs"
+
 
 check-github-release-asset "akazukin5151/kpxhs" "v${version}" "kpxhs.1"
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/kpxhs.1" \
diff --git a/tools/krew/Dockerfile.template b/tools/krew/Dockerfile.template
index 9c126fefd2..88b60774a4 100644
--- a/tools/krew/Dockerfile.template
+++ b/tools/krew/Dockerfile.template
@@ -10,10 +10,16 @@ ARG version
 COPY <<"EOF" /uniget_bootstrap/etc/profile.d/krew.sh
 export PATH="${HOME}/.krew/bin:${PATH}"
 EOF
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/krew" "v${version}" "krew-linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kubernetes-sigs/krew/releases/download/v${version}/krew-linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/krew/releases/download/v${version}/krew-linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/krew" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     ./krew-linux_${alt_arch}
 mv "${prefix}/bin/krew-linux_${alt_arch}" "${prefix}/bin/krew"
 EOF
\ No newline at end of file
diff --git a/tools/kroki-cli/Dockerfile.template b/tools/kroki-cli/Dockerfile.template
index 4cb549e204..3eeeb3db77 100644
--- a/tools/kroki-cli/Dockerfile.template
+++ b/tools/kroki-cli/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "yuzutech/kroki-cli" "v${version}" "kroki-cli_${version}_linux_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/yuzutech/kroki-cli/releases/download/v${version}/kroki-cli_${version}_linux_amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/yuzutech/kroki-cli/releases/download/v${version}/kroki-cli_${version}_linux_amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "yuzutech/kroki-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kroki
 
 "${prefix}/bin/kroki" completion bash >"${prefix}/share/bash-completion/completions/kroki-cli"
diff --git a/tools/ksort/Dockerfile.template b/tools/ksort/Dockerfile.template
index a1c7d86bd9..847a3d333b 100644
--- a/tools/ksort/Dockerfile.template
+++ b/tools/ksort/Dockerfile.template
@@ -7,11 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "superbrothers/ksort" "v${version}" "ksort-linux-${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/superbrothers/ksort/releases/download/v${version}/ksort-linux-${alt_arch}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d /tmp "${filename}"
+
+check-github-release-asset "superbrothers/ksort" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d /tmp "${uniget_cache_download}/${filename}"
+
 mv /tmp/ksort "${prefix}/bin/"
 EOF
\ No newline at end of file
diff --git a/tools/ktop/Dockerfile.template b/tools/ktop/Dockerfile.template
index 1f3c0ad0e0..adb39a96f7 100644
--- a/tools/ktop/Dockerfile.template
+++ b/tools/ktop/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vladimirvivien/ktop" "v${version}" "ktop_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/vladimirvivien/ktop/releases/download/v${version}/ktop_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/vladimirvivien/ktop/releases/download/v${version}/ktop_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "vladimirvivien/ktop" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     ktop
 EOF
\ No newline at end of file
diff --git a/tools/ktunnel/Dockerfile.template b/tools/ktunnel/Dockerfile.template
index 6a303b51e8..c663ec02dc 100644
--- a/tools/ktunnel/Dockerfile.template
+++ b/tools/ktunnel/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "omrikiei/ktunnel" "v${version}" "ktunnel_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/omrikiei/ktunnel/releases/download/v${version}/ktunnel_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/omrikiei/ktunnel/releases/download/v${version}/ktunnel_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "omrikiei/ktunnel" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ktunnel
 EOF
\ No newline at end of file
diff --git a/tools/kube-apiserver/Dockerfile.template b/tools/kube-apiserver/Dockerfile.template
index 113a7af3d4..d13071b3ab 100644
--- a/tools/kube-apiserver/Dockerfile.template
+++ b/tools/kube-apiserver/Dockerfile.template
@@ -7,25 +7,30 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kube-apiserver" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-apiserver"
-chmod +x "${prefix}/bin/kube-apiserver"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-apiserver"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "Verifying keyless signature for kube-apiserver"
-curl --silent --show-error --location --fail --output "/tmp/kube-apiserver.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-apiserver.sig"
-curl --silent --show-error --location --fail --output "/tmp/kube-apiserver.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-apiserver.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kube-apiserver" \
-    --signature "/tmp/kube-apiserver.sig" \
-    --certificate "/tmp/kube-apiserver.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kube-apiserver.sig" \
-    "/tmp/kube-apiserver.cert"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kube-apiserver"
 EOF
\ No newline at end of file
diff --git a/tools/kube-bench/Dockerfile.template b/tools/kube-bench/Dockerfile.template
index 3f70f73644..4bfdde757f 100644
--- a/tools/kube-bench/Dockerfile.template
+++ b/tools/kube-bench/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "aquasecurity/kube-bench" "v${version}" "kube-bench_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/aquasecurity/kube-bench/releases/download/v${version}/kube-bench_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/aquasecurity/kube-bench/releases/download/v${version}/kube-bench_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "aquasecurity/kube-bench" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 "${prefix}/bin/kube-bench" completion bash | sed "s|${prefix}||g" >"${prefix}/share/bash-completion/completions/kube-bench"
 "${prefix}/bin/kube-bench" completion fish | sed "s|${prefix}||g" >"${prefix}/share/fish/vendor_completions.d/kube-bench.fish"
 "${prefix}/bin/kube-bench" completion zsh  | sed "s|${prefix}||g" >"${prefix}/share/zsh/vendor-completions/_kube-bench"
diff --git a/tools/kube-burner/Dockerfile.template b/tools/kube-burner/Dockerfile.template
index afd5fbdb03..14ac74bfb9 100644
--- a/tools/kube-burner/Dockerfile.template
+++ b/tools/kube-burner/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "kube-burner/kube-burner" "v${version}" "kube-burner-V${version}-linux-${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kube-burner/kube-burner/releases/download/v${version}/kube-burner-V${version}-linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/kube-burner/kube-burner/releases/download/v${version}/kube-burner-V${version}-linux-${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kube-burner/kube-burner" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kube-burner
     
 "${prefix}/bin/kube-burner" completion >"${prefix}/share/bash-completion/completions/kube-burner"
diff --git a/tools/kube-controller-manager/Dockerfile.template b/tools/kube-controller-manager/Dockerfile.template
index 50371f474f..ce50fb225c 100644
--- a/tools/kube-controller-manager/Dockerfile.template
+++ b/tools/kube-controller-manager/Dockerfile.template
@@ -7,25 +7,30 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kube-controller-manager" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-controller-manager"
-chmod +x "${prefix}/bin/kube-controller-manager"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-controller-manager"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "Verifying keyless signature for kube-controller-manager"
-curl --silent --show-error --location --fail --output "/tmp/kube-controller-manager.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-controller-manager.sig"
-curl --silent --show-error --location --fail --output "/tmp/kube-controller-manager.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-controller-manager.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kube-controller-manager" \
-    --signature "/tmp/kube-controller-manager.sig" \
-    --certificate "/tmp/kube-controller-manager.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kube-controller-manager.sig" \
-    "/tmp/kube-controller-manager.cert"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kube-controller-manager"
 EOF
\ No newline at end of file
diff --git a/tools/kube-linter/Dockerfile.template b/tools/kube-linter/Dockerfile.template
index 6fdaa9e5ae..d705d5994b 100644
--- a/tools/kube-linter/Dockerfile.template
+++ b/tools/kube-linter/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stackrox/kube-linter" "v${version}" "kube-linter-linux"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kube-linter" \
-    "https://github.com/stackrox/kube-linter/releases/download/v${version}/kube-linter-linux"
-chmod +x "${prefix}/bin/kube-linter"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stackrox/kube-linter/releases/download/v${version}/kube-linter-linux"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stackrox/kube-linter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kube-linter"
+
 
 "${prefix}/bin/kube-linter" completion bash >"${prefix}/share/bash-completion/completions/kube-linter"
 "${prefix}/bin/kube-linter" completion fish >"${prefix}/share/fish/vendor_completions.d/kube-linter.fish"
diff --git a/tools/kube-proxy/Dockerfile.template b/tools/kube-proxy/Dockerfile.template
index 6d357564e9..7ab91937d7 100644
--- a/tools/kube-proxy/Dockerfile.template
+++ b/tools/kube-proxy/Dockerfile.template
@@ -7,25 +7,30 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kube-proxy" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-proxy"
-chmod +x "${prefix}/bin/kube-proxy"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-proxy"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "Verifying keyless signature for kube-proxy"
-curl --silent --show-error --location --fail --output "/tmp/kube-proxy.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-proxy.sig"
-curl --silent --show-error --location --fail --output "/tmp/kube-proxy.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-proxy.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kube-proxy" \
-    --signature "/tmp/kube-proxy.sig" \
-    --certificate "/tmp/kube-proxy.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kube-proxy.sig" \
-    "/tmp/kube-proxy.cert"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kube-proxy"
 EOF
\ No newline at end of file
diff --git a/tools/kube-psp-advisor/Dockerfile.template b/tools/kube-psp-advisor/Dockerfile.template
index b146ac1655..572930c955 100644
--- a/tools/kube-psp-advisor/Dockerfile.template
+++ b/tools/kube-psp-advisor/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "sysdiglabs/kube-psp-advisor" "v${version}" "kube-psp-advisor_v${version}_linux_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/sysdiglabs/kube-psp-advisor/releases/download/v${version}/kube-psp-advisor_v${version}_linux_amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sysdiglabs/kube-psp-advisor/releases/download/v${version}/kube-psp-advisor_v${version}_linux_amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sysdiglabs/kube-psp-advisor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubectl-advise-psp
 EOF
\ No newline at end of file
diff --git a/tools/kube-scheduler/Dockerfile.template b/tools/kube-scheduler/Dockerfile.template
index 1581729222..b30c6c9d3a 100644
--- a/tools/kube-scheduler/Dockerfile.template
+++ b/tools/kube-scheduler/Dockerfile.template
@@ -7,25 +7,30 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kube-scheduler" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-scheduler"
-chmod +x "${prefix}/bin/kube-scheduler"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-scheduler"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "Verifying keyless signature for kube-scheduler"
-curl --silent --show-error --location --fail --output "/tmp/kube-scheduler.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-scheduler.sig"
-curl --silent --show-error --location --fail --output "/tmp/kube-scheduler.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kube-scheduler.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kube-scheduler" \
-    --signature "/tmp/kube-scheduler.sig" \
-    --certificate "/tmp/kube-scheduler.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kube-scheduler.sig" \
-    "/tmp/kube-scheduler.cert"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kube-scheduler"
 EOF
\ No newline at end of file
diff --git a/tools/kube-score/Dockerfile.template b/tools/kube-score/Dockerfile.template
index adba95a04d..903b9270c6 100644
--- a/tools/kube-score/Dockerfile.template
+++ b/tools/kube-score/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "zegl/kube-score" "v${version}" "kube-score_${version}_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kube-score" \
-    "https://github.com/zegl/kube-score/releases/download/v${version}/kube-score_${version}_linux_${alt_arch}"
-chmod +x "${prefix}/bin/kube-score"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/zegl/kube-score/releases/download/v${version}/kube-score_${version}_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "zegl/kube-score" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kube-score"
+
 EOF
\ No newline at end of file
diff --git a/tools/kube-trigger/Dockerfile.template b/tools/kube-trigger/Dockerfile.template
index 8532646617..eb91e3770c 100644
--- a/tools/kube-trigger/Dockerfile.template
+++ b/tools/kube-trigger/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/kubevela/kube-trigger
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/kubevela/kube-trigger" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/kubevela/kube-trigger .
 make -j$(nproc) all
diff --git a/tools/kubeadm/Dockerfile.template b/tools/kubeadm/Dockerfile.template
index c07db26990..23aaff17a1 100644
--- a/tools/kubeadm/Dockerfile.template
+++ b/tools/kubeadm/Dockerfile.template
@@ -7,28 +7,33 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
 COPY kubelet.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubeadm" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubeadm"
-chmod +x "${prefix}/bin/kubeadm"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubeadm"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "Verifying keyless signature for kubeadm"
-curl --silent --show-error --location --fail --output "/tmp/kubeadm.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubeadm.sig"
-curl --silent --show-error --location --fail --output "/tmp/kubeadm.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubeadm.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kubeadm" \
-    --signature "/tmp/kubeadm.sig" \
-    --certificate "/tmp/kubeadm.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kubeadm.sig" \
-    "/tmp/kubeadm.cert"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubeadm"
 
 "${prefix}/bin/kubeadm" completion bash >"${prefix}/share/bash-completion/completions/kubeadm"
 "${prefix}/bin/kubeadm" completion zsh >"${prefix}/share/zsh/vendor-completions/_kubeadm"
diff --git a/tools/kubeaudit/Dockerfile.template b/tools/kubeaudit/Dockerfile.template
index d883949afd..fed1bacb65 100644
--- a/tools/kubeaudit/Dockerfile.template
+++ b/tools/kubeaudit/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "Shopify/kubeaudit" "v${version}" "kubeaudit_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Shopify/kubeaudit/releases/download/v${version}/kubeaudit_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Shopify/kubeaudit/releases/download/v${version}/kubeaudit_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Shopify/kubeaudit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kubeaudit
 "${prefix}/bin/kubeaudit" completion bash >"${prefix}/share/bash-completion/completions/kubeaudit"
 "${prefix}/bin/kubeaudit" completion fish >"${prefix}/share/fish/vendor_completions.d/kubeaudit.fish"
diff --git a/tools/kubebox/Dockerfile.template b/tools/kubebox/Dockerfile.template
index 2ae0d54093..13c85cbe73 100644
--- a/tools/kubebox/Dockerfile.template
+++ b/tools/kubebox/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/kubebox
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "kubebox@${version}"
diff --git a/tools/kubebuilder/Dockerfile.template b/tools/kubebuilder/Dockerfile.template
index ef4fd2134d..4f02cc5c6a 100644
--- a/tools/kubebuilder/Dockerfile.template
+++ b/tools/kubebuilder/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/kubebuilder" "v${version}" "kubebuilder_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubebuilder" \
-    "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v${version}/kubebuilder_linux_${alt_arch}"
-chmod +x "${prefix}/bin/kubebuilder"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/kubebuilder/releases/download/v${version}/kubebuilder_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/kubebuilder" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubebuilder"
+
 
 "${prefix}/bin/kubebuilder" completion bash >"${prefix}/share/bash-completion/completions/kubebuilder"
 "${prefix}/bin/kubebuilder" completion fish >"${prefix}/share/fish/vendor_completions.d/kubebuilder.fish"
diff --git a/tools/kubeclarity-cli/Dockerfile.template b/tools/kubeclarity-cli/Dockerfile.template
index efe3516907..5a5894fc3c 100644
--- a/tools/kubeclarity-cli/Dockerfile.template
+++ b/tools/kubeclarity-cli/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "openclarity/kubeclarity" "v${version}" "kubeclarity-cli-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/openclarity/kubeclarity/releases/download/v${version}/kubeclarity-cli-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/openclarity/kubeclarity/releases/download/v${version}/kubeclarity-cli-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "openclarity/kubeclarity" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kubeclarity-cli
 "${prefix}/bin/kubeclarity-cli" completion bash >"${prefix}/share/bash-completion/completions/kubeclarity-cli"
 "${prefix}/bin/kubeclarity-cli" completion fish >"${prefix}/share/fish/vendor_completions.d/kubeclarity-cli.fish"
diff --git a/tools/kubecolor/Dockerfile.template b/tools/kubecolor/Dockerfile.template
index a9aebfea2a..6fd3496806 100644
--- a/tools/kubecolor/Dockerfile.template
+++ b/tools/kubecolor/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/hidetatz/kubecolor/releases/download/v${version}/kubecolor_${version}_Linux_${arch}.tar.gz"
+filename="$(basename "${url}")"
 
-curl --silent --show-error --location --fail "https://github.com/hidetatz/kubecolor/releases/download/v${version}/kubecolor_${version}_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "hidetatz/kubecolor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubecolor
 EOF
\ No newline at end of file
diff --git a/tools/kubeconform/Dockerfile.template b/tools/kubeconform/Dockerfile.template
index 43eb325ac9..8b98dff625 100644
--- a/tools/kubeconform/Dockerfile.template
+++ b/tools/kubeconform/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "yannh/kubeconform" "v${version}" "kubeconform-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/yannh/kubeconform/releases/download/v${version}/kubeconform-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/yannh/kubeconform/releases/download/v${version}/kubeconform-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "yannh/kubeconform" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubeconform
 EOF
\ No newline at end of file
diff --git a/tools/kubectl-aliases/Dockerfile.template b/tools/kubectl-aliases/Dockerfile.template
index 4e73e665de..ffac30125f 100644
--- a/tools/kubectl-aliases/Dockerfile.template
+++ b/tools/kubectl-aliases/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/etc/profile.d/kubectl-aliases" \
     "https://github.com/ahmetb/kubectl-aliases/raw/master/.kubectl_aliases"
 EOF
\ No newline at end of file
diff --git a/tools/kubectl-build/Dockerfile.template b/tools/kubectl-build/Dockerfile.template
index 483941576a..dbbaf66932 100644
--- a/tools/kubectl-build/Dockerfile.template
+++ b/tools/kubectl-build/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vmware-archive/buildkit-cli-for-kubectl" "v${version}" "linux-v${version}.tgz"
-curl --silent --show-error --location --fail "https://github.com/vmware-archive/buildkit-cli-for-kubectl/releases/download/v${version}/linux-v${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner 
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/vmware-archive/buildkit-cli-for-kubectl/releases/download/v${version}/linux-v${version}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "vmware-archive/buildkit-cli-for-kubectl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner 
 EOF
\ No newline at end of file
diff --git a/tools/kubectl-free/Dockerfile.template b/tools/kubectl-free/Dockerfile.template
index 0c69c4bce6..946ff12b06 100644
--- a/tools/kubectl-free/Dockerfile.template
+++ b/tools/kubectl-free/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "makocchi-git/kubectl-free" "v${version}" "kubectl-free_${version}_Linux_${arch}.zip"
-curl --silent --show-error --location --fail --remote-name "https://github.com/makocchi-git/kubectl-free/releases/download/v${version}/kubectl-free_${version}_Linux_${arch}.zip"
-unzip -q -o -d "/tmp" "kubectl-free_${version}_Linux_${arch}.zip"
-rm "kubectl-free_${version}_Linux_${arch}.zip"
-mv "/tmp/kubectl-free_${version}_Linux_${arch}/kubectl-free" "${prefix}/bin"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/makocchi-git/kubectl-free/releases/download/v${version}/kubectl-free_${version}_Linux_${arch}.zip"
+filename="$(basename "${url}")"
+
+check-github-release-asset "makocchi-git/kubectl-free" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
+    "kubectl-free_${version}_Linux_${arch}/kubectl-free"
 EOF
\ No newline at end of file
diff --git a/tools/kubectl-plugins/Dockerfile.template b/tools/kubectl-plugins/Dockerfile.template
index 744ed00a1d..87392730ac 100644
--- a/tools/kubectl-plugins/Dockerfile.template
+++ b/tools/kubectl-plugins/Dockerfile.template
@@ -14,7 +14,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=krew / /usr/local/
+COPY --link --from=krew / /usr/local/
 ARG name
 ARG version
 COPY --chmod=755 <<EOF /uniget_bootstrap/bin/krew-uniget
@@ -27,7 +27,7 @@ EOF
 COPY <<EOF /uniget_bootstrap/etc/profile.d/krew.sh
 export PATH="/libexec/krew/bin:${PATH}"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 export KREW_ROOT="${prefix}/libexec/krew"
 mkdir -p "${KREW_ROOT}"
 krew update
diff --git a/tools/kubectl-resources/Dockerfile.template b/tools/kubectl-resources/Dockerfile.template
index acc16e0857..06d6e0ccf3 100644
--- a/tools/kubectl-resources/Dockerfile.template
+++ b/tools/kubectl-resources/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "howardjohn/kubectl-resources" "v${version}" "kubectl-resources_${version}_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/howardjohn/kubectl-resources/releases/download/v${version}/kubectl-resources_${version}_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/howardjohn/kubectl-resources/releases/download/v${version}/kubectl-resources_${version}_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "howardjohn/kubectl-resources" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kubectl-resources
 EOF
\ No newline at end of file
diff --git a/tools/kubectl-ssh-proxy/Dockerfile.template b/tools/kubectl-ssh-proxy/Dockerfile.template
index 6b2f341a1c..efefcb58a6 100644
--- a/tools/kubectl-ssh-proxy/Dockerfile.template
+++ b/tools/kubectl-ssh-proxy/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "little-angry-clouds/kubectl-ssh-proxy" "${version}" "kubectl-ssh-proxy-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/little-angry-clouds/kubectl-ssh-proxy/releases/download/${version}/kubectl-ssh-proxy-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/little-angry-clouds/kubectl-ssh-proxy/releases/download/${version}/kubectl-ssh-proxy-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "little-angry-clouds/kubectl-ssh-proxy" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --no-same-owner
 mv "${prefix}/bin/kubectl-ssh_proxy-linux-amd64" "${prefix}/bin/kubectl-ssh_proxy"
 mv "${prefix}/bin/kube-ssh-proxy-ssh-bin-linux-amd64" "${prefix}/bin/kube-ssh-proxy-ssh-bin"
 EOF
\ No newline at end of file
diff --git a/tools/kubectl/Dockerfile.template b/tools/kubectl/Dockerfile.template
index 4b6e90b068..6fb37593d9 100644
--- a/tools/kubectl/Dockerfile.template
+++ b/tools/kubectl/Dockerfile.template
@@ -9,43 +9,56 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 COPY kubectl.sh /uniget_bootstrap/etc/profile.d/
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubectl" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl"
-chmod +x "${prefix}/bin/kubectl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 echo "Verifying keyless signature for kubectl"
-curl --silent --show-error --location --fail --output "/tmp/kubectl.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl.sig"
-curl --silent --show-error --location --fail --output "/tmp/kubectl.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kubectl" \
-    --signature "/tmp/kubectl.sig" \
-    --certificate "/tmp/kubectl.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kubectl.sig" \
-    "/tmp/kubectl.cert"
 
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubectl-convert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl-convert"
-chmod +x "${prefix}/bin/kubectl-convert"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubectl"
+
+"${prefix}/bin/kubectl" completion bash >"${prefix}/share/bash-completion/completions/kubectl"
+"${prefix}/bin/kubectl" completion zsh >"${prefix}/share/zsh/vendor-completions/_kubectl"
+EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl-convert"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 echo "Verifying keyless signature for kubectl-convert"
-curl --silent --show-error --location --fail --output "/tmp/kubectl-convert.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl-convert.sig"
-curl --silent --show-error --location --fail --output "/tmp/kubectl-convert.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubectl-convert.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kubectl-convert" \
-    --signature "/tmp/kubectl-convert.sig" \
-    --certificate "/tmp/kubectl-convert.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kubectl-convert.sig" \
-    "/tmp/kubectl-convert.cert"
 
-"${prefix}/bin/kubectl" completion bash >"${prefix}/share/bash-completion/completions/kubectl"
-"${prefix}/bin/kubectl" completion zsh >"${prefix}/share/zsh/vendor-completions/_kubectl"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubectl-convert"
 EOF
\ No newline at end of file
diff --git a/tools/kubectx/Dockerfile.template b/tools/kubectx/Dockerfile.template
index b02912dd49..a7930d24b6 100644
--- a/tools/kubectx/Dockerfile.template
+++ b/tools/kubectx/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "ahmetb/kubectx" "v${version}" "kubectx_v${version}_linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ahmetb/kubectx/releases/download/v${version}/kubectx_v${version}_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/ahmetb/kubectx/releases/download/v${version}/kubectx_v${version}_linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ahmetb/kubectx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubectx
 
 check-github-release-asset "ahmetb/kubectx" "v${version}" "kubens_v${version}_linux_${arch_suffix}.tar.gz"
diff --git a/tools/kubefire/Dockerfile.template b/tools/kubefire/Dockerfile.template
index fd176f55c6..0265c3e00c 100644
--- a/tools/kubefire/Dockerfile.template
+++ b/tools/kubefire/Dockerfile.template
@@ -8,14 +8,21 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 
-RUN <<EOF
-check-github-release-asset "innobead/kubefire" "v${version}" "kubefire-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubefire" \
-    "https://github.com/innobead/kubefire/releases/download/v${version}/kubefire-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kubefire"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/innobead/kubefire/releases/download/v${version}/kubefire-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "innobead/kubefire" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubefire"
+
 EOF
 
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "innobead/kubefire" "v${version}" "kubefire-linux-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/libexec/cni/host-local-rev" --create-dirs \
     "https://github.com/innobead/kubefire/releases/download/v${version}/host-local-rev-linux-${alt_arch}"
diff --git a/tools/kubelet/Dockerfile.template b/tools/kubelet/Dockerfile.template
index fd2d56c227..43e310200a 100644
--- a/tools/kubelet/Dockerfile.template
+++ b/tools/kubelet/Dockerfile.template
@@ -7,26 +7,31 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=cosign / /usr/local/
+COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
 COPY kubelet.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubelet" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubelet"
-chmod +x "${prefix}/bin/kubelet"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubelet"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "Verifying keyless signature for kubelet"
-curl --silent --show-error --location --fail --output "/tmp/kubelet.sig" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubelet.sig"
-curl --silent --show-error --location --fail --output "/tmp/kubelet.cert" \
-    "https://dl.k8s.io/release/v${version}/bin/linux/${alt_arch}/kubelet.cert"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}/bin/kubelet" \
-    --signature "/tmp/kubelet.sig" \
-    --certificate "/tmp/kubelet.cert" \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.cert" \
+    "${url}.cert"
+
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    --certificate "${uniget_cache_download}/${filename}.cert" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity krel-staging@k8s-releng-prod.iam.gserviceaccount.com
-rm -f \
-    "/tmp/kubelet.sig" \
-    "/tmp/kubelet.cert"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubelet"
 EOF
\ No newline at end of file
diff --git a/tools/kubeletctl/Dockerfile.template b/tools/kubeletctl/Dockerfile.template
index 9def39bdeb..933864ad0f 100644
--- a/tools/kubeletctl/Dockerfile.template
+++ b/tools/kubeletctl/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cyberark/kubeletctl" "v${version}" "kubeletctl_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubeletctl" \
-    "https://github.com/cyberark/kubeletctl/releases/download/v${version}/kubeletctl_linux_${alt_arch}"
-chmod +x "${prefix}/bin/kubeletctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cyberark/kubeletctl/releases/download/v${version}/kubeletctl_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cyberark/kubeletctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubeletctl"
+
 EOF
\ No newline at end of file
diff --git a/tools/kubent/Dockerfile.template b/tools/kubent/Dockerfile.template
index ffd5c1daa9..5b6b46d26b 100644
--- a/tools/kubent/Dockerfile.template
+++ b/tools/kubent/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "doitintl/kube-no-trouble" "${version}" "kubent-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/doitintl/kube-no-trouble/releases/download/${version}/kubent-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/doitintl/kube-no-trouble/releases/download/${version}/kubent-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "doitintl/kube-no-trouble" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/kubernetes-json-schema/Dockerfile.template b/tools/kubernetes-json-schema/Dockerfile.template
index 224b8a2440..fab459e098 100644
--- a/tools/kubernetes-json-schema/Dockerfile.template
+++ b/tools/kubernetes-json-schema/Dockerfile.template
@@ -5,7 +5,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     python3-pip \
@@ -13,15 +13,15 @@ apt-get -y install --no-install-recommends \
     python-is-python3
 EOF
 WORKDIR /tmp/openapi2jsonschema
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch master https://github.com/yannh/openapi2jsonschema .
 EOF
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 pip install --requirement requirements.txt --no-build-isolation --break-system-packages .
 EOF
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 echo "${name} ${version}"
 mkdir -p "${prefix}/share/kubernetes/${version}"
 mkdir -p "/tmp/openapi2jsonschema/${prefix}/usr/local/share/kubernetes/${version}"
diff --git a/tools/kubescape/Dockerfile.template b/tools/kubescape/Dockerfile.template
index 8f22208d29..869ff55797 100644
--- a/tools/kubescape/Dockerfile.template
+++ b/tools/kubescape/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "armosec/kubescape" "v${version}" "kubescape-ubuntu-latest.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/armosec/kubescape/releases/download/v${version}/kubescape-ubuntu-latest.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/armosec/kubescape/releases/download/v${version}/kubescape-ubuntu-latest.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "armosec/kubescape" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 mv "${prefix}/bin/kubescape-ubuntu-latest" "${prefix}/bin/kubescape"
 "${prefix}/bin/kubescape" completion bash >"${prefix}/share/bash-completion/completions/kubescape"
 "${prefix}/bin/kubescape" completion fish >"${prefix}/share/fish/vendor_completions.d/kubescape.fish"
diff --git a/tools/kubeseal/Dockerfile.template b/tools/kubeseal/Dockerfile.template
index 8e0fcf30ca..22ef488939 100644
--- a/tools/kubeseal/Dockerfile.template
+++ b/tools/kubeseal/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "bitnami-labs/sealed-secrets" "v${version}" "kubeseal-${version}-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${version}/kubeseal-${version}-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/bitnami-labs/sealed-secrets/releases/download/v${version}/kubeseal-${version}-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "bitnami-labs/sealed-secrets" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubeseal
 EOF
\ No newline at end of file
diff --git a/tools/kubesec/Dockerfile.template b/tools/kubesec/Dockerfile.template
index 4c7213142f..75f8156440 100644
--- a/tools/kubesec/Dockerfile.template
+++ b/tools/kubesec/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "controlplaneio/kubesec" "v${version}" "kubesec_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/controlplaneio/kubesec/releases/download/v${version}/kubesec_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/controlplaneio/kubesec/releases/download/v${version}/kubesec_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "controlplaneio/kubesec" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kubesec
 "${prefix}/bin/kubesec" completion bash >"${prefix}/share/bash-completion/completions/kubesec"
 "${prefix}/bin/kubesec" completion fish >"${prefix}/share/fish/vendor_completions.d/kubesec.fish"
diff --git a/tools/kubeshark/Dockerfile.template b/tools/kubeshark/Dockerfile.template
index 5b70ecc371..d5170d6bdb 100644
--- a/tools/kubeshark/Dockerfile.template
+++ b/tools/kubeshark/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubeshark/kubeshark" "v${version}" "kubeshark_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kubeshark" \
-    "https://github.com/kubeshark/kubeshark/releases/download/v${version}/kubeshark_linux_${alt_arch}"
-chmod +x "${prefix}/bin/kubeshark"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubeshark/kubeshark/releases/download/v${version}/kubeshark_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubeshark/kubeshark" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kubeshark"
+
 
 "${prefix}/bin/kubeshark" completion bash >"${prefix}/share/bash-completion/completions/kubeshark"
 "${prefix}/bin/kubeshark" completion fish >"${prefix}/share/fish/vendor_completions.d/kubeshark.fish"
diff --git a/tools/kubeswitch/Dockerfile.template b/tools/kubeswitch/Dockerfile.template
index 8e2f184f4f..616a5febb7 100644
--- a/tools/kubeswitch/Dockerfile.template
+++ b/tools/kubeswitch/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "danielb42/kubeswitch" "v${version}" "kubeswitch_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/danielb42/kubeswitch/releases/download/v${version}/kubeswitch_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/danielb42/kubeswitch/releases/download/v${version}/kubeswitch_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "danielb42/kubeswitch" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kubeswitch
 EOF
 COPY <<"EOF" "/uniget_bootstrap/share/bash-completion/completions/kubeswitch"
diff --git a/tools/kubeval/Dockerfile.template b/tools/kubeval/Dockerfile.template
index 40f98b7c3c..5a78c92e8f 100644
--- a/tools/kubeval/Dockerfile.template
+++ b/tools/kubeval/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "instrumenta/kubeval" "v${version}" "kubeval-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/instrumenta/kubeval/releases/download/v${version}/kubeval-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/instrumenta/kubeval/releases/download/v${version}/kubeval-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "instrumenta/kubeval" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kubeval
 EOF
\ No newline at end of file
diff --git a/tools/kubo/Dockerfile.template b/tools/kubo/Dockerfile.template
index c615dadbb1..49728909ab 100644
--- a/tools/kubo/Dockerfile.template
+++ b/tools/kubo/Dockerfile.template
@@ -8,14 +8,20 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY ipfs.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-check-github-release-asset "ipfs/kubo" "v${version}" "kubo_v${version}_linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ipfs/kubo/releases/download/v${version}/kubo_v${version}_linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ipfs/kubo/releases/download/v${version}/kubo_v${version}_linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ipfs/kubo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     kubo/ipfs
 "${prefix}/bin/ipfs" commands completion bash >"${prefix}/share/bash-completion/completions/ipfs"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 export IPFS_PATH="${prefix}/var/lib/ipfs"
 mkdir -p "${IPFS_PATH}"
 "${prefix}/bin/ipfs" init
diff --git a/tools/kudo/Dockerfile.template b/tools/kudo/Dockerfile.template
index 0e72ba2f86..3009d947e0 100644
--- a/tools/kudo/Dockerfile.template
+++ b/tools/kudo/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="${arch}"
@@ -21,10 +21,14 @@ case "${alt_arch}" in
         ;;
 esac
 
-check-github-release-asset "kudobuilder/kudo" "v${version}" "kudo_${version}_linux_${arch_suffix}.tar.gz"
+url="https://github.com/kudobuilder/kudo/releases/download/v${version}/kudo_${version}_linux_${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading kudo ${version}"
-curl --silent --show-error --location --fail "https://github.com/kudobuilder/kudo/releases/download/v${version}/kudo_${version}_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "kudobuilder/kudo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubectl-kudo
 EOF
\ No newline at end of file
diff --git a/tools/kustomize/Dockerfile.template b/tools/kustomize/Dockerfile.template
index f1a53bfb66..566fdf1861 100644
--- a/tools/kustomize/Dockerfile.template
+++ b/tools/kustomize/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/kustomize" "kustomize%2Fv${version}" "kustomize_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/kustomize" "kustomize%2Fv${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 "${prefix}/bin/kustomize" completion bash >"${prefix}/share/bash-completion/completions/kustomize"
 "${prefix}/bin/kustomize" completion fish >"${prefix}/share/fish/vendor_completions.d/kustomize.fish"
 "${prefix}/bin/kustomize" completion zsh >"${prefix}/share/zsh/vendor-completions/_kustomize"
diff --git a/tools/kustomizer/Dockerfile.template b/tools/kustomizer/Dockerfile.template
index dd893be1da..3f0ef75196 100644
--- a/tools/kustomizer/Dockerfile.template
+++ b/tools/kustomizer/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stefanprodan/kustomizer" "v${version}" "kustomizer_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/stefanprodan/kustomizer/releases/download/v${version}/kustomizer_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stefanprodan/kustomizer/releases/download/v${version}/kustomizer_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stefanprodan/kustomizer" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     kustomizer
 "${prefix}/bin/kustomizer" completion bash >"${prefix}/share/bash-completion/completions/kustomizer"
 "${prefix}/bin/kustomizer" completion fish >"${prefix}/share/fish/vendor_completions.d/kustomizer.fish"
diff --git a/tools/kuttl/Dockerfile.template b/tools/kuttl/Dockerfile.template
index 51eb0d5b3e..62a690ad88 100644
--- a/tools/kuttl/Dockerfile.template
+++ b/tools/kuttl/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="${arch}"
@@ -22,14 +22,17 @@ case "${alt_arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "kudobuilder/kuttl" "v${version}" "kuttl_${version}_linux_${arch_suffix}.tar.gz"
+url="https://github.com/kudobuilder/kuttl/releases/download/v${version}/kuttl_${version}_linux_${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading kuttl ${version}"
-curl --silent --show-error --location --fail "https://github.com/kudobuilder/kuttl/releases/download/v${version}/kuttl_${version}_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "kudobuilder/kuttl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kubectl-kuttl
 
-echo "### Installing completion"
 "${prefix}/bin/kubectl-kuttl" completion bash >"${prefix}/share/bash-completion/completions/kubectl-kuttl"
 "${prefix}/bin/kubectl-kuttl" completion fish >"${prefix}/share/fish/vendor_completions.d/kubectl-kuttl.fish"
 "${prefix}/bin/kubectl-kuttl" completion zsh >"${prefix}/share/zsh/vendor-completions/_kubectl-kuttl"
diff --git a/tools/kwok/Dockerfile.template b/tools/kwok/Dockerfile.template
index 2a0ee8cca8..e57e93210a 100644
--- a/tools/kwok/Dockerfile.template
+++ b/tools/kwok/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/kwok" "v${version}" "kwok-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/kwok" \
-    "https://github.com/kubernetes-sigs/kwok/releases/download/v${version}/kwok-linux-${alt_arch}"
-chmod +x "${prefix}/bin/kwok"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/kwok/releases/download/v${version}/kwok-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/kwok" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/kwok"
+
 
 check-github-release-asset "kubernetes-sigs/kwok" "v${version}" "kwokctl-linux-${alt_arch}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/kwokctl" \
diff --git a/tools/kyverno/Dockerfile.template b/tools/kyverno/Dockerfile.template
index c0573a6bd8..550ba06353 100644
--- a/tools/kyverno/Dockerfile.template
+++ b/tools/kyverno/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kyverno/kyverno" "v${version}" "kyverno-cli_v${version}_linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/kyverno/kyverno/releases/download/v${version}/kyverno-cli_v${version}_linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kyverno/kyverno/releases/download/v${version}/kyverno-cli_v${version}_linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kyverno/kyverno" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     kyverno
 "${prefix}/bin/kyverno" completion bash >"${prefix}/share/bash-completion/completions/kyverno"
 "${prefix}/bin/kyverno" completion fish >"${prefix}/share/fish/vendor_completions.d/kyverno.fish"
diff --git a/tools/lab/Dockerfile.template b/tools/lab/Dockerfile.template
index 331a7ddd52..6790505bd1 100644
--- a/tools/lab/Dockerfile.template
+++ b/tools/lab/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "zaquestion/lab" "v${version}" "lab_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/zaquestion/lab/releases/download/v${version}/lab_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/zaquestion/lab/releases/download/v${version}/lab_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "zaquestion/lab" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     lab
 "${prefix}/bin/lab" completion bash >"${prefix}/share/bash-completion/completions/lab"
 "${prefix}/bin/lab" completion fish >"${prefix}/share/fish/vendor_completions.d/lab.fish"
diff --git a/tools/lazydocker/Dockerfile.template b/tools/lazydocker/Dockerfile.template
index 2e0b8c8472..a5cc22627a 100644
--- a/tools/lazydocker/Dockerfile.template
+++ b/tools/lazydocker/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jesseduffield/lazydocker" "v${version}" "lazydocker_${version}_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jesseduffield/lazydocker/releases/download/v${version}/lazydocker_${version}_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jesseduffield/lazydocker/releases/download/v${version}/lazydocker_${version}_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jesseduffield/lazydocker" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     lazydocker
 EOF
\ No newline at end of file
diff --git a/tools/lazygit/Dockerfile.template b/tools/lazygit/Dockerfile.template
index 709307295c..43a17208d8 100644
--- a/tools/lazygit/Dockerfile.template
+++ b/tools/lazygit/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jesseduffield/lazygit" "v${version}" "lazygit_${version}_Linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jesseduffield/lazygit/releases/download/v${version}/lazygit_${version}_Linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jesseduffield/lazygit/releases/download/v${version}/lazygit_${version}_Linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jesseduffield/lazygit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     lazygit
 EOF
\ No newline at end of file
diff --git a/tools/lazysql/Dockerfile.template b/tools/lazysql/Dockerfile.template
index f95635d41d..b47b74123f 100644
--- a/tools/lazysql/Dockerfile.template
+++ b/tools/lazysql/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "jorgerojas26/lazysql" "v${version}" "lazysql_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jorgerojas26/lazysql/releases/download/v${version}/lazysql_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/jorgerojas26/lazysql/releases/download/v${version}/lazysql_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jorgerojas26/lazysql" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     lazysql
 EOF
\ No newline at end of file
diff --git a/tools/lazytrivy/Dockerfile.template b/tools/lazytrivy/Dockerfile.template
index 7d12373d0d..8cc37cae2b 100644
--- a/tools/lazytrivy/Dockerfile.template
+++ b/tools/lazytrivy/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "owenrumney/lazytrivy" "v${version}" "lazytrivy-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/lazytrivy" \
-    "https://github.com/owenrumney/lazytrivy/releases/download/v${version}/lazytrivy-linux-${alt_arch}"
-chmod +x "${prefix}/bin/lazytrivy"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/owenrumney/lazytrivy/releases/download/v${version}/lazytrivy-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "owenrumney/lazytrivy" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/lazytrivy"
+
 EOF
\ No newline at end of file
diff --git a/tools/lectl/Dockerfile.template b/tools/lectl/Dockerfile.template
index 73941f62fe..870a04b707 100644
--- a/tools/lectl/Dockerfile.template
+++ b/tools/lectl/Dockerfile.template
@@ -5,12 +5,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sahsanu/lectl/raw/v${version}/lectl"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/lectl" \
-    "https://github.com/sahsanu/lectl/raw/v${version}/lectl"
-chmod +x "${prefix}/bin/lectl"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/lectl"
 EOF
\ No newline at end of file
diff --git a/tools/lego/Dockerfile.template b/tools/lego/Dockerfile.template
index 918bee2d4d..9c72bfeae1 100644
--- a/tools/lego/Dockerfile.template
+++ b/tools/lego/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "go-acme/lego" "v${version}" "lego_v${version}_linux_${alt_arch}.tar.gz"
 curl --silent --location --fail "https://github.com/go-acme/lego/releases/download/v${version}/lego_v${version}_linux_${alt_arch}.tar.gz" \
 | tar --extract --gzip --directory="${prefix}${target}/bin/" --no-same-owner \
diff --git a/tools/libbpf/Dockerfile.template b/tools/libbpf/Dockerfile.template
index 402dbdc0dd..702aa16e38 100644
--- a/tools/libbpf/Dockerfile.template
+++ b/tools/libbpf/Dockerfile.template
@@ -7,8 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     libelf \
     elfutils-dev \
     linux-headers
@@ -17,7 +17,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/libbpf
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/libbpf/libbpf .
 cd src
 make -j$(nproc)
diff --git a/tools/libcap-ng/Dockerfile.template b/tools/libcap-ng/Dockerfile.template
index b4edfb1a51..0c38783d35 100644
--- a/tools/libcap-ng/Dockerfile.template
+++ b/tools/libcap-ng/Dockerfile.template
@@ -7,15 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     linux-headers
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/libcap-ng
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/stevegrubb/libcap-ng .
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-static --disable-shared --without-python
diff --git a/tools/libcap/Dockerfile.template b/tools/libcap/Dockerfile.template
index 3513d5c716..f8519fa5bb 100644
--- a/tools/libcap/Dockerfile.template
+++ b/tools/libcap/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/libcap
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://git.kernel.org/pub/scm/libs/libcap/libcap.git "libcap-${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "libcap-${version}" https://git.kernel.org/pub/scm/libs/libcap/libcap.git .
 make -j$(nproc)
diff --git a/tools/libcgroup/Dockerfile.template b/tools/libcgroup/Dockerfile.template
index 600fe014be..226a1e60f3 100644
--- a/tools/libcgroup/Dockerfile.template
+++ b/tools/libcgroup/Dockerfile.template
@@ -7,8 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     m4 \
     bison \
     flex \
@@ -16,7 +16,7 @@ apk add --update-cache --no-cache \
     linux-headers
 EOF
 COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p "${prefix}/etc/ld.so.conf.d"
 EOF
 COPY <<EOF /uniget_bootstrap/etc/ld.so.conf.d/libcgroup.conf.go-template
@@ -26,9 +26,17 @@ WORKDIR /tmp/libcgroup
 ARG name
 ARG version
 # Unable to build statically linked tools
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/libcgroup/libcgroup/releases/download/v${version}/libcgroup-${version}.tar.gz" \
-| tar --extract --gzip --strip-components 1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/libcgroup/libcgroup/releases/download/v${version}/libcgroup-${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "libcgroup/libcgroup" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components 1
+
 ./configure --prefix="${prefix}" --disable-pam --disable-daemon --disable-systemd
 make -j$(nproc) LDFLAGS=-static
 make install
diff --git a/tools/libmnl/Dockerfile.template b/tools/libmnl/Dockerfile.template
index 66a365d2eb..b88800cf17 100644
--- a/tools/libmnl/Dockerfile.template
+++ b/tools/libmnl/Dockerfile.template
@@ -7,19 +7,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     linux-headers
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/libmnl
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://git.netfilter.org/libmnl" "libmnl-${version}"
 git clone --config advice.detachedHead=false --depth 1 --branch "libmnl-${version}" git://git.netfilter.org/libmnl .
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-static=yes --enable-shared=yes
 make -j$(nproc)
diff --git a/tools/libnftnl/Dockerfile.template b/tools/libnftnl/Dockerfile.template
index 214529e48b..e12f00e1f5 100644
--- a/tools/libnftnl/Dockerfile.template
+++ b/tools/libnftnl/Dockerfile.template
@@ -10,18 +10,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=make / /usr/local/
 COPY --link --from=libmnl / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     linux-headers
 EOF
 WORKDIR /tmp/libnftnl
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://git.netfilter.org/libnftnl" "libnftnl-${version}"
 git clone --config advice.detachedHead=false --depth 1 --branch "libnftnl-${version}" git://git.netfilter.org/libnftnl .
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 export PKG_CONFIG_PATH="/lib/pkgconfig:${PKG_CONFIG_PATH}"
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-static=yes --enable-shared=yes
diff --git a/tools/libnvidia-container/Dockerfile.template b/tools/libnvidia-container/Dockerfile.template
index 9c4efbd75a..166ea77eff 100644
--- a/tools/libnvidia-container/Dockerfile.template
+++ b/tools/libnvidia-container/Dockerfile.template
@@ -8,9 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=go / /usr/local/
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     apt-utils \
@@ -32,10 +30,12 @@ apt-get -y install --no-install-recommends \
     pkg-config \
     xz-utils
 EOF
+COPY --link --from=go / /usr/local/
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/libnvidia-container
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/NVIDIA/libnvidia-container .
 export WITH_LIBELF=yes
 export WITH_TIRPC=yes
diff --git a/tools/lima/Dockerfile.template b/tools/lima/Dockerfile.template
index 2951b06b5d..14f9264f6f 100644
--- a/tools/lima/Dockerfile.template
+++ b/tools/lima/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "lima-vm/lima" "v${version}" "lima-${version}-Linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-Linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-Linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "lima-vm/lima" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/linkchecker/Dockerfile.template b/tools/linkchecker/Dockerfile.template
index 21ae79b8ed..26515080ea 100644
--- a/tools/linkchecker/Dockerfile.template
+++ b/tools/linkchecker/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/linkchecker" --console-script linkchecker "linkchecker==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/linux-kernel-wsl-stable/Dockerfile.template b/tools/linux-kernel-wsl-stable/Dockerfile.template
index 2a5efb8b46..b9d7113493 100644
--- a/tools/linux-kernel-wsl-stable/Dockerfile.template
+++ b/tools/linux-kernel-wsl-stable/Dockerfile.template
@@ -7,12 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://github.com/microsoft/WSL2-Linux-Kernel/archive/refs/tags/linux-msft-wsl-${version}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/microsoft/WSL2-Linux-Kernel/archive/refs/tags/linux-msft-wsl-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
 mkdir -p "${prefix}/src/linux-${version}-wsl2"
-cd "${prefix}/src/linux-${version}-wsl2"
-curl --silent --show-error --location --fail "https://github.com/microsoft/WSL2-Linux-Kernel/archive/refs/tags/linux-msft-wsl-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/src/linux-${version}-wsl2" --strip-components=1 --no-same-owner
 EOF
 COPY --chmod=0755 \
     install-deps-ubuntu.sh \
diff --git a/tools/linux-kernel-wsl/Dockerfile.template b/tools/linux-kernel-wsl/Dockerfile.template
index 32ef02ae56..ae120c4e2b 100644
--- a/tools/linux-kernel-wsl/Dockerfile.template
+++ b/tools/linux-kernel-wsl/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://github.com/microsoft/WSL2-Linux-Kernel/archive/refs/tags/linux-msft-wsl-${version}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/microsoft/WSL2-Linux-Kernel/archive/refs/tags/linux-msft-wsl-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
 mkdir -p "${prefix}/src/linux-${version}-wsl2"
-cd "${prefix}/src/linux-${version}-wsl2"
-curl --silent --show-error --location --fail "https://github.com/microsoft/WSL2-Linux-Kernel/archive/refs/tags/linux-msft-wsl-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/src/linux-${version}-wsl2" --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/linux-kernel/Dockerfile.template b/tools/linux-kernel/Dockerfile.template
index 9d2c11d88e..41c7f1684d 100644
--- a/tools/linux-kernel/Dockerfile.template
+++ b/tools/linux-kernel/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot/linux-${version}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot/linux-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
 mkdir -p "${prefix}/src/linux-${version}"
-cd "${prefix}/src/linux-${version}"
-curl --silent --show-error --location --fail "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot/linux-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/src/linux-${version}" --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/linuxkit/Dockerfile.template b/tools/linuxkit/Dockerfile.template
index ef4febca54..cfc9078a56 100644
--- a/tools/linuxkit/Dockerfile.template
+++ b/tools/linuxkit/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "linuxkit/linuxkit" "v${version}" "linuxkit-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/linuxkit" \
-    "https://github.com/linuxkit/linuxkit/releases/download/v${version}/linuxkit-linux-${alt_arch}"
-chmod +x "${prefix}/bin/linuxkit"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/linuxkit/linuxkit/releases/download/v${version}/linuxkit-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "linuxkit/linuxkit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/linuxkit"
+
 EOF
\ No newline at end of file
diff --git a/tools/localizer/Dockerfile.template b/tools/localizer/Dockerfile.template
index b60aeebee2..bd86890aa3 100644
--- a/tools/localizer/Dockerfile.template
+++ b/tools/localizer/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "getoutreach/localizer" "v${version}" "localizer_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/getoutreach/localizer/releases/download/v${version}/localizer_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/getoutreach/localizer/releases/download/v${version}/localizer_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "getoutreach/localizer" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     localizer
 EOF
\ No newline at end of file
diff --git a/tools/loft/Dockerfile.template b/tools/loft/Dockerfile.template
index 19ac5c45a7..003723c3dd 100644
--- a/tools/loft/Dockerfile.template
+++ b/tools/loft/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "loft-sh/loft" "v${version}" "loft-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/loft" \
-    "https://github.com/loft-sh/loft/releases/download/v${version}/loft-linux-${alt_arch}"
-chmod +x "${prefix}/bin/loft"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/loft-sh/loft/releases/download/v${version}/loft-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "loft-sh/loft" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/loft"
+
 "${prefix}/bin/loft" completion bash >"${prefix}/share/bash-completion/completions/loft"
 "${prefix}/bin/loft" completion fish >"${prefix}/share/fish/vendor_completions.d/loft.fish"
 "${prefix}/bin/loft" completion zsh >"${prefix}/share/zsh/vendor-completions/_loft"
diff --git a/tools/logcli/Dockerfile.template b/tools/logcli/Dockerfile.template
index f9cc34ab76..4ba03c48d5 100644
--- a/tools/logcli/Dockerfile.template
+++ b/tools/logcli/Dockerfile.template
@@ -7,13 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/loki" "v${version}" "logcli-linux-${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/grafana/loki/releases/download/v${version}/logcli-linux-${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/loki" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 mv "${prefix}/bin/logcli-linux-${alt_arch}" "${prefix}/bin/logcli"
+
 "${prefix}/bin/logcli" --completion-script-bash >"${prefix}/share/bash-completion/completions/logcli"
 "${prefix}/bin/logcli" --completion-script-zsh >"${prefix}/share/zsh/vendor-completions/_logcli"
 EOF
\ No newline at end of file
diff --git a/tools/loki-canary/Dockerfile.template b/tools/loki-canary/Dockerfile.template
index 75a552dd26..8d8cf3059c 100644
--- a/tools/loki-canary/Dockerfile.template
+++ b/tools/loki-canary/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/loki" "v${version}" "loki-canary-linux-${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/grafana/loki/releases/download/v${version}/loki-canary-linux-${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/loki" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 mv "${prefix}/bin/loki-canary-linux-amd64" "${prefix}/bin/loki-canary"
 EOF
\ No newline at end of file
diff --git a/tools/loki/Dockerfile.template b/tools/loki/Dockerfile.template
index ba30ed62b1..5a73da9c2a 100644
--- a/tools/loki/Dockerfile.template
+++ b/tools/loki/Dockerfile.template
@@ -7,12 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/loki" "v${version}" "loki-linux-${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/grafana/loki/releases/download/v${version}/loki-linux-${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/loki" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 mv "${prefix}/bin/loki-linux-${alt_arch}" "${prefix}/bin/loki"
 EOF
 COPY loki.yaml /uniget_bootstrap/etc/loki/config.yaml
\ No newline at end of file
diff --git a/tools/lowcharts/Dockerfile.template b/tools/lowcharts/Dockerfile.template
index 80aab03d1c..5659889168 100644
--- a/tools/lowcharts/Dockerfile.template
+++ b/tools/lowcharts/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "juan-leon/lowcharts" "v${version}" "lowcharts-${version}-x86_64-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/juan-leon/lowcharts/releases/download/v${version}/lowcharts-${version}-x86_64-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/juan-leon/lowcharts/releases/download/v${version}/lowcharts-${version}-x86_64-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "juan-leon/lowcharts" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     lowcharts
 EOF
\ No newline at end of file
diff --git a/tools/lsd/Dockerfile.template b/tools/lsd/Dockerfile.template
index 13976edef5..c0b016751c 100644
--- a/tools/lsd/Dockerfile.template
+++ b/tools/lsd/Dockerfile.template
@@ -8,10 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/lsd
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "lsd-rs/lsd" "v${version}" "lsd-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/lsd-rs/lsd/releases/download/v${version}/lsd-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/lsd-rs/lsd/releases/download/v${version}/lsd-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "lsd-rs/lsd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 mv lsd "${prefix}/bin/"
 mv lsd.1 "${prefix}/share/man/man1/"
 
diff --git a/tools/lstags/Dockerfile.template b/tools/lstags/Dockerfile.template
index 5d44559c28..f4156cf7c5 100644
--- a/tools/lstags/Dockerfile.template
+++ b/tools/lstags/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ivanilves/lstags" "v${version}" "lstags-linux-v${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ivanilves/lstags/releases/download/v${version}/lstags-linux-v${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ivanilves/lstags/releases/download/v${version}/lstags-linux-v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ivanilves/lstags" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/luet/Dockerfile.template b/tools/luet/Dockerfile.template
index cdc7a4c78f..075e72c29e 100644
--- a/tools/luet/Dockerfile.template
+++ b/tools/luet/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mudler/luet" "${version}" "luet-${version}-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/luet" \
-    "https://github.com/mudler/luet/releases/download/${version}/luet-${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/luet"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mudler/luet/releases/download/${version}/luet-${version}-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mudler/luet" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/luet"
+
 
 "${prefix}/bin/luet" completion bash >"${prefix}/share/bash-completion/completions/luet"
 "${prefix}/bin/luet" completion fish >"${prefix}/share/fish/vendor_completions.d/luet.fish"
diff --git a/tools/lxroot/Dockerfile.template b/tools/lxroot/Dockerfile.template
index 80db2bc25e..e8193b46a1 100644
--- a/tools/lxroot/Dockerfile.template
+++ b/tools/lxroot/Dockerfile.template
@@ -5,15 +5,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
 apk update
-apk add \
+apk add --update-cache \
     wget
 EOF
 WORKDIR /tmp/lxroot
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/parke/lxroot .
 g++ lxroot.cpp -o "${prefix}/bin/lxroot" -s -Os -fomit-frame-pointer -fno-stack-protector -ffunction-sections -fdata-sections -Wl,--gc-sections -fno-unroll-loops -fmerge-all-constants -fno-ident -Wl,-z,norelro -Wl,--build-id=none -fno-exceptions -fno-rtti -static
 EOF
diff --git a/tools/lz4/Dockerfile.template b/tools/lz4/Dockerfile.template
index 5d1be9fed1..3facae76c4 100644
--- a/tools/lz4/Dockerfile.template
+++ b/tools/lz4/Dockerfile.template
@@ -11,10 +11,16 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/lz4
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "lz4/lz4" "v${version}" "lz4-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/lz4/lz4/releases/download/v${version}/lz4-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/lz4/lz4/releases/download/v${version}/lz4-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "lz4/lz4" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
 
 make -C lib -j$(nproc)
 make -C programs -j$(nproc) LDFLAGS=-static
diff --git a/tools/mage/Dockerfile.template b/tools/mage/Dockerfile.template
index 20d50d45a7..a3d56768b1 100644
--- a/tools/mage/Dockerfile.template
+++ b/tools/mage/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="64bit"
@@ -22,10 +22,14 @@ case "${alt_arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "magefile/mage" "v${version}" "mage_${version}_Linux-${arch_suffix}.tar.gz"
+url="https://github.com/magefile/mage/releases/download/v${version}/mage_${version}_Linux-${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
 
-echo "### Downloading mage ${version}"
-curl --silent --show-error --location --fail "https://github.com/magefile/mage/releases/download/v${version}/mage_${version}_Linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "magefile/mage" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     mage
 EOF
\ No newline at end of file
diff --git a/tools/make/Dockerfile.template b/tools/make/Dockerfile.template
index 56a51eb2b0..45870c08fc 100644
--- a/tools/make/Dockerfile.template
+++ b/tools/make/Dockerfile.template
@@ -8,9 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/make
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://ftp.gnu.org/gnu/make/make-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://ftp.gnu.org/gnu/make/make-${version}.tar.gz"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 ./configure --prefix="${prefix}"
 make -j$(nproc) LDFLAGS=-static
 make install
diff --git a/tools/mani/Dockerfile.template b/tools/mani/Dockerfile.template
index c89e53316e..4a726db135 100644
--- a/tools/mani/Dockerfile.template
+++ b/tools/mani/Dockerfile.template
@@ -7,11 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "alajmo/mani" "v${version}" "mani_${version}_linux_${alt_arch}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/alajmo/mani/releases/download/v${version}/mani_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-curl --silent --show-error --location --fail "https://github.com/alajmo/mani/releases/download/v${version}/mani_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "alajmo/mani" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     mani \
     mani.1
 mv "${prefix}/bin/mani.1" "${prefix}/share/man/man1/"
diff --git a/tools/manifest-tool/Dockerfile.template b/tools/manifest-tool/Dockerfile.template
index ce9210e602..bdf85ceefe 100644
--- a/tools/manifest-tool/Dockerfile.template
+++ b/tools/manifest-tool/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "estesp/manifest-tool" "v${version}" "binaries-manifest-tool-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/estesp/manifest-tool/releases/download/v${version}/binaries-manifest-tool-${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/estesp/manifest-tool/releases/download/v${version}/binaries-manifest-tool-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "estesp/manifest-tool" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     manifest-tool-linux-${alt_arch}
 mv "${prefix}/bin/manifest-tool-linux-${alt_arch}" "${prefix}/bin/manifest-tool"
 EOF
\ No newline at end of file
diff --git a/tools/mapcidr/Dockerfile.template b/tools/mapcidr/Dockerfile.template
index 8e0fad7cb8..49d5e281c2 100644
--- a/tools/mapcidr/Dockerfile.template
+++ b/tools/mapcidr/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/projectdiscovery/mapcidr
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/projectdiscovery/mapcidr .
 make -j$(nproc)
 cp mapcidr "${prefix}/bin/"
diff --git a/tools/markdownlint/Dockerfile.template b/tools/markdownlint/Dockerfile.template
index bc90f53805..f937cdc4e6 100644
--- a/tools/markdownlint/Dockerfile.template
+++ b/tools/markdownlint/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/markdownlint
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "markdownlint-cli@${version}"
diff --git a/tools/marvin/Dockerfile.template b/tools/marvin/Dockerfile.template
index ecf3b713fe..3d4b62ad69 100644
--- a/tools/marvin/Dockerfile.template
+++ b/tools/marvin/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "undistro/marvin" "v${version}" "marvin_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/undistro/marvin/releases/download/v${version}/marvin_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/undistro/marvin/releases/download/v${version}/marvin_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "undistro/marvin" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     marvin
 
 "${prefix}/bin/marvin" completion bash >"${prefix}/share/bash-completion/completions/marvin"
diff --git a/tools/maven/Dockerfile.template b/tools/maven/Dockerfile.template
index 5fdf683eac..1807993876 100644
--- a/tools/maven/Dockerfile.template
+++ b/tools/maven/Dockerfile.template
@@ -7,9 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://archive.apache.org/dist/maven/maven-3/${version}/binaries/apache-maven-${version}-bin.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/opt/maven"
-curl --silent --show-error --location --fail "https://archive.apache.org/dist/maven/maven-3/${version}/binaries/apache-maven-${version}-bin.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/opt/maven" --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/opt/maven" --strip-components=1 --no-same-owner
+
 ln --symbolic --relative --force "${prefix}/opt/maven/bin/mvn" "${prefix}/bin/mvn"
 EOF
\ No newline at end of file
diff --git a/tools/mc/Dockerfile.template b/tools/mc/Dockerfile.template
index 89c3e6e800..41c21bb09d 100644
--- a/tools/mc/Dockerfile.template
+++ b/tools/mc/Dockerfile.template
@@ -7,17 +7,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.min.io/client/mc/release/linux-${alt_arch}/mc.RELEASE.${version}"
+filename="$(basename "${url}")"
 
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/mc" \
-    "https://dl.min.io/client/mc/release/linux-${alt_arch}/mc.RELEASE.${version}"
-chmod +x "${prefix}/bin/mc"
-EOF
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/mc"
+EOF
 COPY <<EOF /uniget_bootstrap/share/bash-completion/completions/mc
 complete -C /bin/mc mc
 EOF
-
 COPY <<EOF /uniget_bootstrap/share/fish/vendor_completions.d/mc.fish
 function __complete_mc
     set -lx COMP_LINE (commandline -cp)
diff --git a/tools/mcfly/Dockerfile.template b/tools/mcfly/Dockerfile.template
index 1873d60e92..413b313729 100644
--- a/tools/mcfly/Dockerfile.template
+++ b/tools/mcfly/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cantino/mcfly" "v${version}" "mcfly-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cantino/mcfly/releases/download/v${version}/mcfly-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cantino/mcfly/releases/download/v${version}/mcfly-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cantino/mcfly" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/melange/Dockerfile.template b/tools/melange/Dockerfile.template
index e41851df78..817ccb8193 100644
--- a/tools/melange/Dockerfile.template
+++ b/tools/melange/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/chainguard-dev/melange
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone https://github.com/chainguard-dev/melange "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/chainguard-dev/melange .
 make -j$(nproc) melange
diff --git a/tools/melt/Dockerfile.template b/tools/melt/Dockerfile.template
index 0cd9380125..cc5b09ff00 100644
--- a/tools/melt/Dockerfile.template
+++ b/tools/melt/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/melt" "v${version}" "melt_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/melt/releases/download/v${version}/melt_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/melt/releases/download/v${version}/melt_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/melt" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "melt_${version}_Linux_${arch_suffix}/melt" \
     "melt_${version}_Linux_${arch_suffix}/completions" \
     "melt_${version}_Linux_${arch_suffix}/manpages"
diff --git a/tools/mergerfs/Dockerfile.template b/tools/mergerfs/Dockerfile.template
index fbd98ebf0f..178f7fc4dd 100644
--- a/tools/mergerfs/Dockerfile.template
+++ b/tools/mergerfs/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "trapexit/mergerfs" "${version}" "mergerfs-static-linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/trapexit/mergerfs/releases/download/${version}/mergerfs-static-linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/" --strip-components=2 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/trapexit/mergerfs/releases/download/${version}/mergerfs-static-linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "trapexit/mergerfs" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/" --strip-components=2 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/mermaid-cli/Dockerfile.template b/tools/mermaid-cli/Dockerfile.template
index 7740b3f8a8..2694f0ddc1 100644
--- a/tools/mermaid-cli/Dockerfile.template
+++ b/tools/mermaid-cli/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/mermail-cli
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "@mermaid-js/mermaid-cli@${version}"
diff --git a/tools/meteor-commit/Dockerfile.template b/tools/meteor-commit/Dockerfile.template
index e68d4c0c34..8b6c542a71 100644
--- a/tools/meteor-commit/Dockerfile.template
+++ b/tools/meteor-commit/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stefanlogue/meteor" "v${version}" "meteor-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/meteor" \
-    "https://github.com/stefanlogue/meteor/releases/download/v${version}/meteor-linux-${alt_arch}"
-chmod +x "${prefix}/bin/meteor"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stefanlogue/meteor/releases/download/v${version}/meteor-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stefanlogue/meteor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/meteor"
+
 EOF
\ No newline at end of file
diff --git a/tools/meteor/Dockerfile.template b/tools/meteor/Dockerfile.template
index 8764b6bd25..53387cb283 100644
--- a/tools/meteor/Dockerfile.template
+++ b/tools/meteor/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "raystack/meteor" "v${version}" "meteor_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/raystack/meteor/releases/download/v${version}/meteor_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/raystack/meteor/releases/download/v${version}/meteor_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "raystack/meteor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     meteor
 
 "${prefix}/bin/meteor" completion bash >"${prefix}/share/bash-completion/completions/meteor"
diff --git a/tools/mgo/Dockerfile.template b/tools/mgo/Dockerfile.template
index f5b6c21a25..ff0cd85233 100644
--- a/tools/mgo/Dockerfile.template
+++ b/tools/mgo/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/CAFxX/mgo
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/CAFxX/mgo" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/CAFxX/mgo .
 go build -o "${prefix}/bin/mgo" .
diff --git a/tools/micro/Dockerfile.template b/tools/micro/Dockerfile.template
index d3af9d33ff..d88ac423f8 100644
--- a/tools/micro/Dockerfile.template
+++ b/tools/micro/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "micro/micro" "v${version}" "micro-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/micro/micro/releases/download/v${version}/micro-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/micro/micro/releases/download/v${version}/micro-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "micro/micro" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     micro
 
 curl --silent --fail --show-error --location --output "${prefix}/etc/systemd/system/micro.service.go-template" \
diff --git a/tools/miller/Dockerfile.template b/tools/miller/Dockerfile.template
index 626b4b4b55..c33bb34f2c 100644
--- a/tools/miller/Dockerfile.template
+++ b/tools/miller/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "johnkerl/miller" "v${version}" "miller-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/johnkerl/miller/releases/download/v${version}/miller-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/johnkerl/miller/releases/download/v${version}/miller-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "johnkerl/miller" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "miller-${version}-linux-${alt_arch}/mlr"
 
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/mlr.1" \
diff --git a/tools/mimir/Dockerfile.template b/tools/mimir/Dockerfile.template
index 1af64d5341..b842fa8a8c 100644
--- a/tools/mimir/Dockerfile.template
+++ b/tools/mimir/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/mimir" "mimir-${version}" "mimir-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/mimir" \
-    "https://github.com/grafana/mimir/releases/download/mimir-${version}/mimir-linux-${alt_arch}"
-chmod +x "${prefix}/bin/mimir"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/grafana/mimir/releases/download/mimir-${version}/mimir-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/mimir" "mimir-${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/mimir"
+
 EOF
 COPY mimir.yaml /uniget_bootstrap/etc/mimir/
 COPY nginx.conf /uniget_bootstrap/etc/mimir/
diff --git a/tools/mimirtool/Dockerfile.template b/tools/mimirtool/Dockerfile.template
index a527c3739a..9f281f7c7b 100644
--- a/tools/mimirtool/Dockerfile.template
+++ b/tools/mimirtool/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/mimir" "mimir-${version}" "mimirtool-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/mimirtool" \
-    "https://github.com/grafana/mimir/releases/download/mimir-${version}/mimirtool-linux-${alt_arch}"
-chmod +x "${prefix}/bin/mimirtool"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/grafana/mimir/releases/download/mimir-${version}/mimirtool-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/mimir" "mimir-${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/mimirtool"
+
 EOF
\ No newline at end of file
diff --git a/tools/minder/Dockerfile.template b/tools/minder/Dockerfile.template
index 9b95d55510..a0f315aa45 100644
--- a/tools/minder/Dockerfile.template
+++ b/tools/minder/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stacklok/minder" "v${version}" "minder_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/stacklok/minder/releases/download/v${version}/minder_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stacklok/minder/releases/download/v${version}/minder_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stacklok/minder" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/minder" completion bash >"${prefix}/share/bash-completion/completions/minder"
 "${prefix}/bin/minder" completion fish >"${prefix}/share/fish/vendor_completions.d/minder.fish"
diff --git a/tools/minectl/Dockerfile.template b/tools/minectl/Dockerfile.template
index 4a5dcf43a9..6c588b09b3 100644
--- a/tools/minectl/Dockerfile.template
+++ b/tools/minectl/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dirien/minectl" "v${version}" "minectl_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/dirien/minectl/releases/download/v${version}/minectl_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dirien/minectl/releases/download/v${version}/minectl_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dirien/minectl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     minectl
 "${prefix}/bin/minectl" completion bash >"${prefix}/share/bash-completion/completions/minectl"
 "${prefix}/bin/minectl" completion fish >"${prefix}/share/fish/vendor_completions.d/minectl.fish"
diff --git a/tools/minikube/Dockerfile.template b/tools/minikube/Dockerfile.template
index d97f0c41d4..75e94692af 100644
--- a/tools/minikube/Dockerfile.template
+++ b/tools/minikube/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes/minikube" "v${version}" "minikube-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/minikube" \
-    "https://github.com/kubernetes/minikube/releases/download/v${version}/minikube-linux-${alt_arch}"
-chmod +x "${prefix}/bin/minikube"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes/minikube/releases/download/v${version}/minikube-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes/minikube" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/minikube"
+
 "${prefix}/bin/minikube" completion bash >"${prefix}/share/bash-completion/completions/minikube"
 "${prefix}/bin/minikube" completion fish >"${prefix}/share/fish/vendor_completions.d/minikube.fish"
 "${prefix}/bin/minikube" completion zsh >"${prefix}/share/zsh/vendor-completions/_minikube"
diff --git a/tools/minio/Dockerfile.template b/tools/minio/Dockerfile.template
index 4ca959e44f..1f96fac164 100644
--- a/tools/minio/Dockerfile.template
+++ b/tools/minio/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/minio" \
-    "https://dl.min.io/server/minio/release/linux-${alt_arch}/minio.RELEASE.${version}"
-chmod +x "${prefix}/bin/minio"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.min.io/server/minio/release/linux-${alt_arch}/minio.RELEASE.${version}"
+filename="$(basename "${url}")"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/minio"
 EOF
\ No newline at end of file
diff --git a/tools/mink/Dockerfile.template b/tools/mink/Dockerfile.template
index b178dd59a8..81007bf81f 100644
--- a/tools/mink/Dockerfile.template
+++ b/tools/mink/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mattmoor/mink" "v${version}" "mink_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mattmoor/mink/releases/download/v${version}/mink_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mattmoor/mink/releases/download/v${version}/mink_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mattmoor/mink" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "mink_${version}_Linux_x86_64/mink"
 EOF
\ No newline at end of file
diff --git a/tools/mint/Dockerfile.template b/tools/mint/Dockerfile.template
index 43eeb72c41..d39024b3e2 100644
--- a/tools/mint/Dockerfile.template
+++ b/tools/mint/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix=""
@@ -20,8 +20,16 @@ case "${alt_arch}" in
         exit 1
         ;;
 esac
-curl --silent --show-error --location --fail "https://github.com/mintoolkit/mint/releases/download/${version}/dist_linux${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+
+url="https://github.com/mintoolkit/mint/releases/download/${version}/dist_linux${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "mintoolkit/mint" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "dist_linux${arch_suffix}/mint" \
     "dist_linux${arch_suffix}/mint-sensor"
 EOF
\ No newline at end of file
diff --git a/tools/mitmproxy/Dockerfile.template b/tools/mitmproxy/Dockerfile.template
index 0ab6f2ad2a..d86ba24206 100644
--- a/tools/mitmproxy/Dockerfile.template
+++ b/tools/mitmproxy/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://downloads.mitmproxy.org/${version}/mitmproxy-${version}-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://downloads.mitmproxy.org/${version}/mitmproxy-${version}-linux-${arch}.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     mitmproxy \
     mitmdump \
     mitmweb
diff --git a/tools/mkcert/Dockerfile.template b/tools/mkcert/Dockerfile.template
index c37e19336d..011e9b1da2 100644
--- a/tools/mkcert/Dockerfile.template
+++ b/tools/mkcert/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "FiloSottile/mkcert" "v${version}" "mkcert-v${version}-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/mkcert" \
-    "https://github.com/FiloSottile/mkcert/releases/download/v${version}/mkcert-v${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/mkcert"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/FiloSottile/mkcert/releases/download/v${version}/mkcert-v${version}-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "FiloSottile/mkcert" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/mkcert"
+
 EOF
\ No newline at end of file
diff --git a/tools/mkdocs/Dockerfile.template b/tools/mkdocs/Dockerfile.template
index 7f623db7f1..daf102049a 100644
--- a/tools/mkdocs/Dockerfile.template
+++ b/tools/mkdocs/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
 WORKDIR /uniget_bootstrap/libexec/mkdocs
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/mkdocs" --console-script mkdocs \
     "mkdocs==${version}" \
     mkdocs-material \
diff --git a/tools/mods/Dockerfile.template b/tools/mods/Dockerfile.template
index b3909ac358..2796fe48d9 100644
--- a/tools/mods/Dockerfile.template
+++ b/tools/mods/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/mods" "v${version}" "mods_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/mods/releases/download/v${version}/mods_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/mods/releases/download/v${version}/mods_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/mods" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "mods_${version}_Linux_${arch_suffix}/mods" \
     "mods_${version}_Linux_${arch_suffix}/completions"
 
diff --git a/tools/monaspace/Dockerfile.template b/tools/monaspace/Dockerfile.template
index 3e8a25c110..12badb3a9b 100644
--- a/tools/monaspace/Dockerfile.template
+++ b/tools/monaspace/Dockerfile.template
@@ -8,12 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 WORKDIR /tmp/monaspace
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "githubnext/monaspace" "v${version}" "monaspace-v${version}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/githubnext/monaspace/releases/download/v${version}/monaspace-v${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o "${filename}"
+
+check-github-release-asset "githubnext/monaspace" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o "${uniget_cache_download}/${filename}"
 
 mkdir -p \
     "${prefix}/share/monaspace" \
diff --git a/tools/mp3binder/Dockerfile.template b/tools/mp3binder/Dockerfile.template
index 56fdb35d91..f4ea869b7c 100644
--- a/tools/mp3binder/Dockerfile.template
+++ b/tools/mp3binder/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "crra/mp3binder" "v${version}" "linux_${alt_arch}.zip"
-curl --silent --show-error --location --fail --remote-name "https://github.com/crra/mp3binder/releases/download/v${version}/linux_${alt_arch}.zip"
-unzip -q -o -d "/tmp" "linux_${alt_arch}.zip"
-rm "linux_${alt_arch}.zip"
-mv "/tmp/mp3binder" "${prefix}/bin"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/crra/mp3binder/releases/download/v${version}/linux_${alt_arch}.zip"
+filename="$(basename "${url}")"
+
+check-github-release-asset "crra/mp3binder" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
+    mp3binder
 EOF
\ No newline at end of file
diff --git a/tools/mu-repo/Dockerfile.template b/tools/mu-repo/Dockerfile.template
index 9765901830..2d8f3e3c69 100644
--- a/tools/mu-repo/Dockerfile.template
+++ b/tools/mu-repo/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/mu" --console-script mu "mu-repo==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/musl/Dockerfile.template b/tools/musl/Dockerfile.template
index 02aad3ea19..0889b15d8a 100644
--- a/tools/musl/Dockerfile.template
+++ b/tools/musl/Dockerfile.template
@@ -11,20 +11,28 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/musl
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p "${prefix}/etc/ld.so.conf.d"
 EOF
 COPY <<"EOF" /uniget_bootstrap/etc/ld.so.conf.d/musl.conf.go-template
 {{ .Target }}/lib
 EOF
-RUN <<EOF
-curl --silent --show-error --location --fail https://musl.libc.org/releases/musl-${version}.tar.gz \
-| tar --extract --gzip --strip-components=1 --no-same-owner
-# install to lib/x86_64-linux-musl?
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://musl.libc.org/releases/musl-${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 ./configure --prefix="${prefix}"
 make -j"$(nproc)"
 make install
 ln --symbolic --relative --force "${prefix}/lib/libc.so" "${prefix}/lib/libc.musl-x86_64.so.1"
+
 # fix paths in bin/musl-gcc
 # fix paths in lib/musl-gcc.specs
 EOF
\ No newline at end of file
diff --git a/tools/mutagen-compose/Dockerfile.template b/tools/mutagen-compose/Dockerfile.template
index 53b12dd05d..7752465f1b 100644
--- a/tools/mutagen-compose/Dockerfile.template
+++ b/tools/mutagen-compose/Dockerfile.template
@@ -7,11 +7,11 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "mutagen-io/mutagen-compose" "v${version}" "mutagen-compose_linux_${alt_arch}_v${version%-*}.tar.gz"
 curl --silent --show-error --location --fail \
     "https://github.com/mutagen-io/mutagen-compose/releases/download/v${version}/mutagen-compose_linux_${alt_arch}_v${version%-*}.tar.gz" \
 | tar --extract --gzip \
-    --directory "${prefix}/bin" \
+    --directory="${prefix}/bin" \
     --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/mutagen/Dockerfile.template b/tools/mutagen/Dockerfile.template
index b058866753..a43fcc5cce 100644
--- a/tools/mutagen/Dockerfile.template
+++ b/tools/mutagen/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mutagen-io/mutagen" "v${version}" "mutagen_linux_${alt_arch}_v${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mutagen-io/mutagen/releases/download/v${version}/mutagen_linux_${alt_arch}_v${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mutagen-io/mutagen/releases/download/v${version}/mutagen_linux_${alt_arch}_v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mutagen-io/mutagen" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 ${prefix}/bin/mutagen generate \
     "--bash-completion-script=${prefix}/share/bash-completion/completions/${name}" \
     "--fish-completion-script=${prefix}/share/fish/vendor_completions.d/${name}.fish" \
@@ -18,7 +24,7 @@ ${prefix}/bin/mutagen generate \
 
 mkdir -p "${prefix}/libexec/mutagen"
 tar --extract --gzip \
-    --file "${prefix}/bin/mutagen-agents.tar.gz" \
-    --directory "${prefix}/libexec/mutagen"
+    --file="${prefix}/bin/mutagen-agents.tar.gz" \
+    --directory="${prefix}/libexec/mutagen"
 rm "${prefix}/bin/mutagen-agents.tar.gz"
 EOF
\ No newline at end of file
diff --git a/tools/n8n/Dockerfile.template b/tools/n8n/Dockerfile.template
index 3d21bddcb3..9827e47ca9 100644
--- a/tools/n8n/Dockerfile.template
+++ b/tools/n8n/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/n8n
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "n8n@${version}"
diff --git a/tools/namespace/Dockerfile.template b/tools/namespace/Dockerfile.template
index 84b48f9c43..a439e935c2 100644
--- a/tools/namespace/Dockerfile.template
+++ b/tools/namespace/Dockerfile.template
@@ -7,18 +7,32 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://get.namespace.so/packages/nsc/v${version}/nsc_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://get.namespace.so/packages/nsc/v${version}/nsc_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://get.namespace.so/packages/nsc/v${version}/nsc_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     nsc \
     docker-credential-nsc
+EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://get.namespace.so/packages/ns/v${version}/ns_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-check-download "https://get.namespace.so/packages/ns/v${version}/ns_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://get.namespace.so/packages/ns/v${version}/ns_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ns
-    
+EOF
+RUN <<EOF # no download cache    
 "${prefix}/bin/nsc" completion bash >"${prefix}/share/bash-completion/completions/nsc"
 "${prefix}/bin/nsc" completion fish >"${prefix}/share/fish/vendor_completions.d/nsc.fish"
 "${prefix}/bin/nsc" completion zsh >"${prefix}/share/zsh/vendor-completions/_nsc"
diff --git a/tools/nancy/Dockerfile.template b/tools/nancy/Dockerfile.template
index 9ddbda0039..0cf55ab453 100644
--- a/tools/nancy/Dockerfile.template
+++ b/tools/nancy/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "sonatype-nexus-community/nancy" "v${version}" "nancy-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/sonatype-nexus-community/nancy/releases/download/v${version}/nancy-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/sonatype-nexus-community/nancy/releases/download/v${version}/nancy-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sonatype-nexus-community/nancy" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     nancy
 EOF
\ No newline at end of file
diff --git a/tools/navi/Dockerfile.template b/tools/navi/Dockerfile.template
index 024af6b8c5..46e53decc5 100644
--- a/tools/navi/Dockerfile.template
+++ b/tools/navi/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "denisidoro/navi" "v${version}" "navi-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/denisidoro/navi/releases/download/v${version}/navi-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/denisidoro/navi/releases/download/v${version}/navi-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "denisidoro/navi" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/ncdu/Dockerfile.template b/tools/ncdu/Dockerfile.template
index fd43cd1295..e9996dc9ed 100644
--- a/tools/ncdu/Dockerfile.template
+++ b/tools/ncdu/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://dev.yorhel.nl/download/ncdu-${version}-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://dev.yorhel.nl/download/ncdu-${version}-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dev.yorhel.nl/download/ncdu-${version}-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/neo4j/Dockerfile.template b/tools/neo4j/Dockerfile.template
index 0e6abf8c0e..5cf7697840 100644
--- a/tools/neo4j/Dockerfile.template
+++ b/tools/neo4j/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://dist.neo4j.org/neo4j-community-${version}-unix.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dist.neo4j.org/neo4j-community-${version}-unix.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
 mkdir -p "${prefix}/opt/neo4j"
-curl --silent --show-error --location --fail "https://dist.neo4j.org/neo4j-community-${version}-unix.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/opt/neo4j" --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/opt/neo4j" --strip-components=1 --no-same-owner
+
 ln --symbolic --relative --force "${prefix}/opt/neo4j/bin/neo4j" "${prefix}/bin/"
 ln --symbolic --relative --force "${prefix}/opt/neo4j/bin/cypher-shell" "${prefix}/bin/"
 EOF
\ No newline at end of file
diff --git a/tools/neofetch/Dockerfile.template b/tools/neofetch/Dockerfile.template
index 02b1c797b3..dea48839d4 100644
--- a/tools/neofetch/Dockerfile.template
+++ b/tools/neofetch/Dockerfile.template
@@ -7,10 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/neofetch" \
-    "https://github.com/dylanaraps/neofetch/raw/${version}/neofetch"
-chmod +x "${prefix}/bin/neofetch"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dylanaraps/neofetch/raw/${version}/neofetch"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/neofetch"
+
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/neofetch.1" \
     "https://github.com/dylanaraps/neofetch/raw/${version}/neofetch.1"
 EOF
\ No newline at end of file
diff --git a/tools/nerd-fonts/Dockerfile.template b/tools/nerd-fonts/Dockerfile.template
index 88d50f507c..847e0c6a6e 100644
--- a/tools/nerd-fonts/Dockerfile.template
+++ b/tools/nerd-fonts/Dockerfile.template
@@ -5,16 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-WORKDIR /tmp/nerd-fonts
+WORKDIR /uniget_bootstrap/share/fonts/NerdFonts
 ARG name
 ARG version
-RUN <<EOF
-mkdir -p "${prefix}/share/fonts/NerdFonts"
-
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 for font in CascadiaCode; do
-    check-github-release-asset "ryanoasis/nerd-fonts" "v${version}" "${font}.zip"
-    curl --silent --show-error --location --fail --remote-name "https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/${font}.zip"
-    unzip -q -o "${font}.zip"
-    mv *.ttf "${prefix}/share/fonts/NerdFonts"
+    url="https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/${font}.zip"
+    filename="$(basename "${url}")"
+
+    check-github-release-asset "ryanoasis/nerd-fonts" "v${version}" "${filename}"
+    curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+        "${url}"
+    unzip -q -o "${uniget_cache_download}/${filename}"
 done
 EOF
diff --git a/tools/nerdctl/Dockerfile.template b/tools/nerdctl/Dockerfile.template
index cadee2e47d..322ecc46fd 100644
--- a/tools/nerdctl/Dockerfile.template
+++ b/tools/nerdctl/Dockerfile.template
@@ -8,10 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY nerdctl.toml.go-template /uniget_bootstrap/etc/nerdctl/
-RUN <<EOF
-check-github-release-asset "containerd/nerdctl" "v${version}" "nerdctl-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containerd/nerdctl/releases/download/v${version}/nerdctl-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containerd/nerdctl/releases/download/v${version}/nerdctl-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containerd/nerdctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 "${prefix}/bin/nerdctl" completion bash >"${prefix}/share/bash-completion/completions/nerdctl"
 "${prefix}/bin/nerdctl" completion fish >"${prefix}/share/fish/vendor_completions.d/nerdctl.fish"
 "${prefix}/bin/nerdctl" completion zsh >"${prefix}/share/zsh/vendor-completions/_nerdctl"
diff --git a/tools/newman/Dockerfile.template b/tools/newman/Dockerfile.template
index b23ab2cf55..1c58fe1eb9 100644
--- a/tools/newman/Dockerfile.template
+++ b/tools/newman/Dockerfile.template
@@ -15,7 +15,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/newman
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "newman@${version}"
diff --git a/tools/nftables/Dockerfile.template b/tools/nftables/Dockerfile.template
index afa384ca40..d9eb2b5709 100644
--- a/tools/nftables/Dockerfile.template
+++ b/tools/nftables/Dockerfile.template
@@ -9,8 +9,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     bison \
     flex \
     asciidoc \
@@ -28,11 +28,11 @@ COPY --link --from=libnftnl / /usr/local/
 WORKDIR /tmp/nftables
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone "https://git.netfilter.org/nftables/" "v${version}"
 git clone --config advice.detachedHead=false --depth 1 --branch "v${version}" git://git.netfilter.org/nftables .
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 export PKG_CONFIG_PATH="/lib/pkgconfig:${PKG_CONFIG_PATH}"
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-static=yes --with-json --with-cli=readline
diff --git a/tools/nms/Dockerfile.template b/tools/nms/Dockerfile.template
index 7dfaa3cefc..3e6e0681ec 100644
--- a/tools/nms/Dockerfile.template
+++ b/tools/nms/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/nms
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/bartobri/no-more-secrets .
 make nms sneakers CFLAGS="-Wextra -Wall -O2 -static"
 make install DESTDIR="${prefix}" prefix=""
diff --git a/tools/node-exporter/Dockerfile.template b/tools/node-exporter/Dockerfile.template
index 6afc06d994..152857515c 100644
--- a/tools/node-exporter/Dockerfile.template
+++ b/tools/node-exporter/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus/node_exporter" "v${version}" "node_exporter-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus/node_exporter/releases/download/v${version}/node_exporter-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus/node_exporter/releases/download/v${version}/node_exporter-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus/node_exporter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "node_exporter-${version}.linux-${alt_arch}/node_exporter"
 EOF
\ No newline at end of file
diff --git a/tools/nodejs-lts/Dockerfile.template b/tools/nodejs-lts/Dockerfile.template
index 3d3061f3fd..052c7bf516 100644
--- a/tools/nodejs-lts/Dockerfile.template
+++ b/tools/nodejs-lts/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix=x64
@@ -22,10 +22,15 @@ case "${alt_arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-echo "### Downloading node.js ${version}"
-check-download "https://nodejs.org/dist/v${version}/node-v${version}-linux-${arch_suffix}.tar.xz"
-curl --silent --show-error --location --fail "https://nodejs.org/dist/v${version}/node-v${version}-linux-${arch_suffix}.tar.xz" \
-| tar --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner \
+url="https://nodejs.org/dist/v${version}/node-v${version}-linux-${arch_suffix}.tar.xz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner \
     "node-v${version}-linux-${arch_suffix}/bin" \
     "node-v${version}-linux-${arch_suffix}/include" \
     "node-v${version}-linux-${arch_suffix}/lib" \
diff --git a/tools/nodejs/Dockerfile.template b/tools/nodejs/Dockerfile.template
index 95bc1317ff..e948eb65cd 100644
--- a/tools/nodejs/Dockerfile.template
+++ b/tools/nodejs/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix=x64
@@ -22,9 +22,15 @@ case "${alt_arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-echo "### Downloading node.js ${version}"
-curl --silent --show-error --location --fail "https://nodejs.org/dist/v${version}/node-v${version}-linux-${arch_suffix}.tar.xz" \
-| tar --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner \
+url="https://nodejs.org/dist/v${version}/node-v${version}-linux-${arch_suffix}.tar.xz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner \
     "node-v${version}-linux-${arch_suffix}/bin" \
     "node-v${version}-linux-${arch_suffix}/include" \
     "node-v${version}-linux-${arch_suffix}/lib" \
diff --git a/tools/norouter/Dockerfile.template b/tools/norouter/Dockerfile.template
index eb4697f3fe..82afba928b 100644
--- a/tools/norouter/Dockerfile.template
+++ b/tools/norouter/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "norouter/norouter" "v${version}" "norouter-Linux-${arch}.tgz"
-curl --silent --show-error --location --fail "https://github.com/norouter/norouter/releases/download/v${version}/norouter-Linux-${arch}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/norouter/norouter/releases/download/v${version}/norouter-Linux-${arch}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "norouter/norouter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     norouter
 EOF
\ No newline at end of file
diff --git a/tools/notation/Dockerfile.template b/tools/notation/Dockerfile.template
index 44c3121d28..19f9e30596 100644
--- a/tools/notation/Dockerfile.template
+++ b/tools/notation/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "notaryproject/notation" "v${version}" "notation_${version}_linux_${alt_arch}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/notaryproject/notation/releases/download/v${version}/notation_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-curl --silent --show-error --location --fail "https://github.com/notaryproject/notation/releases/download/v${version}/notation_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+check-github-release-asset "notaryproject/notation" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     notation
 EOF
\ No newline at end of file
diff --git a/tools/npm/Dockerfile.template b/tools/npm/Dockerfile.template
index 5901c8a9e4..d3ef79188b 100644
--- a/tools/npm/Dockerfile.template
+++ b/tools/npm/Dockerfile.template
@@ -5,6 +5,6 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN <<EOF # no download cache
 touch "${prefix}/var/cache/uniget/npm-is-included-in-prebuilt-binaries-of-nodejs"
 EOF
diff --git a/tools/nsutils/Dockerfile.template b/tools/nsutils/Dockerfile.template
index ca19487d30..31c3c8f0ea 100644
--- a/tools/nsutils/Dockerfile.template
+++ b/tools/nsutils/Dockerfile.template
@@ -8,8 +8,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     libcap-dev \
     libcap-static \
     libbsd-dev \
@@ -21,7 +21,7 @@ COPY --link --from=libcap / /usr/local/
 WORKDIR /tmp/nsutils
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/rd235/nsutils "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/rd235/nsutils .
 autoreconf -if
diff --git a/tools/nuclei-templates/Dockerfile.template b/tools/nuclei-templates/Dockerfile.template
index 00cde39b4d..3ec212b426 100644
--- a/tools/nuclei-templates/Dockerfile.template
+++ b/tools/nuclei-templates/Dockerfile.template
@@ -5,12 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
+WORKDIR /uniget_bootstrap/share/nuclei-templates
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://github.com/projectdiscovery/nuclei-templates/archive/refs/tags/v${version}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/projectdiscovery/nuclei-templates/archive/refs/tags/v${version}.tar.gz"
+filename="$( basename "${url}" )"
 
-mkdir -p "${prefix}/share/nuclei-templates/"
-curl --silent --show-error --location --fail "https://github.com/projectdiscovery/nuclei-templates/archive/refs/tags/v${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/nuclei-templates/" --strip-components=1 --no-same-owner
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/nuclei/Dockerfile.template b/tools/nuclei/Dockerfile.template
index ca19f96186..cb0d5586b9 100644
--- a/tools/nuclei/Dockerfile.template
+++ b/tools/nuclei/Dockerfile.template
@@ -7,12 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/nuclei" "v${version}" "nuclei_${version}_linux_${alt_arch}.zip"
-
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/nuclei/releases/download/v${version}/nuclei_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/nuclei" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     nuclei
 EOF
\ No newline at end of file
diff --git a/tools/nushell/Dockerfile.template b/tools/nushell/Dockerfile.template
index f8def428f8..30a8c872c9 100644
--- a/tools/nushell/Dockerfile.template
+++ b/tools/nushell/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting library string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${lib_suffix}"
 
-check-github-release-asset "nushell/nushell" "${version}" "nu-${version}-${arch}-unknown-linux-${lib_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/nushell/nushell/releases/download/${version}/nu-${version}-${arch}-unknown-linux-${lib_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
+url="https://github.com/nushell/nushell/releases/download/${version}/nu-${version}-${arch}-unknown-linux-${lib_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "nushell/nushell" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
 rm -f \
     "${prefix}/bin/LICENSE" \
     "${prefix}/bin/README.txt"
diff --git a/tools/nvidia-container-toolkit/Dockerfile.template b/tools/nvidia-container-toolkit/Dockerfile.template
index 6919f6b2b0..4de22a761a 100644
--- a/tools/nvidia-container-toolkit/Dockerfile.template
+++ b/tools/nvidia-container-toolkit/Dockerfile.template
@@ -8,9 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-COPY --link --from=go / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     dh-make \
@@ -18,10 +16,12 @@ apt-get -y install --no-install-recommends \
     devscripts \
     lsb-release
 EOF
+COPY --link --from=make / /usr/local/
+COPY --link --from=go / /usr/local/
 WORKDIR /tmp/nvidia-container-toolkit
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/NVIDIA/nvidia-container-toolkit .
 make cmds
 cp \
diff --git a/tools/nvm/Dockerfile.template b/tools/nvm/Dockerfile.template
index bd6893b015..d2c6677b96 100644
--- a/tools/nvm/Dockerfile.template
+++ b/tools/nvm/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 export NVM_DIR="${prefix}/opt/nvm"
 mkdir -p "${NVM_DIR}"
 curl --silent --show-error --location --fail https://raw.githubusercontent.com/nvm-sh/nvm/v${version}/install.sh | bash
diff --git a/tools/nx/Dockerfile.template b/tools/nx/Dockerfile.template
index 09bc643921..6053aad196 100644
--- a/tools/nx/Dockerfile.template
+++ b/tools/nx/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/nx
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "nx@${version}"
diff --git a/tools/nydus-snapshotter/Dockerfile.template b/tools/nydus-snapshotter/Dockerfile.template
index 50fa5ffbf6..cfd8a829e8 100644
--- a/tools/nydus-snapshotter/Dockerfile.template
+++ b/tools/nydus-snapshotter/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "containerd/nydus-snapshotter" "v${version}" "nydus-snapshotter-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containerd/nydus-snapshotter/releases/download/v${version}/nydus-snapshotter-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containerd/nydus-snapshotter/releases/download/v${version}/nydus-snapshotter-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containerd/nydus-snapshotter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
 EOF
 
 # https://github.com/containerd/nydus-snapshotter/raw/v${version}/misc/snapshotter/nydus-snapshotter.fusedev.service
diff --git a/tools/nydus/Dockerfile.template b/tools/nydus/Dockerfile.template
index 5b19c70444..04ab246443 100644
--- a/tools/nydus/Dockerfile.template
+++ b/tools/nydus/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dragonflyoss/nydus" "v${version}" "nydus-static-v${version}-linux-${alt_arch}.tgz"
-curl --silent --show-error --location --fail "https://github.com/dragonflyoss/nydus/releases/download/v${version}/nydus-static-v${version}-linux-${alt_arch}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dragonflyoss/nydus/releases/download/v${version}/nydus-static-v${version}-linux-${alt_arch}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dragonflyoss/nydus" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
 EOF
 
 # SystemD coming in 2.3.0
diff --git a/tools/oc/Dockerfile.template b/tools/oc/Dockerfile.template
index dea1bd1fa2..ffd0a732fa 100644
--- a/tools/oc/Dockerfile.template
+++ b/tools/oc/Dockerfile.template
@@ -8,10 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 ARG commit_sha=0cbc58b
-RUN <<EOF
-check-github-release-asset "openshift/origin" "v${version}" "openshift-origin-client-tools-v${version}-${commit_sha}-linux-64bit.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/openshift/origin/releases/download/v${version}/openshift-origin-client-tools-v${version}-${commit_sha}-linux-64bit.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --wildcards \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/openshift/origin/releases/download/v${version}/openshift-origin-client-tools-v${version}-${commit_sha}-linux-64bit.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "openshift/origin" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --wildcards \
     */oc
 
 "${prefix}/bin/oc" completion bash >"${prefix}/share/bash-completion/completions/oc"
diff --git a/tools/ocb/Dockerfile.template b/tools/ocb/Dockerfile.template
index f43c518e90..67a3e54cbe 100644
--- a/tools/ocb/Dockerfile.template
+++ b/tools/ocb/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "open-telemetry/opentelemetry-collector" "cmd%2Fbuilder%2Fv${version}" "ocb_${version}_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ocb" \
-    "https://github.com/open-telemetry/opentelemetry-collector/releases/download/cmd%2Fbuilder%2Fv${version}/ocb_${version}_linux_${alt_arch}"
-chmod +x "${prefix}/bin/ocb"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/open-telemetry/opentelemetry-collector/releases/download/cmd%2Fbuilder%2Fv${version}/ocb_${version}_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "open-telemetry/opentelemetry-collector" "cmd%2Fbuilder%2Fv${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ocb"
+
 
 "${prefix}/bin/ocb" completion bash >"${prefix}/share/bash-completion/completions/ocb"
 "${prefix}/bin/ocb" completion fish >"${prefix}/share/fish/vendor_completions.d/ocb.fish"
diff --git a/tools/oci-image-tool/Dockerfile.template b/tools/oci-image-tool/Dockerfile.template
index 224f952464..c6a3a102d3 100644
--- a/tools/oci-image-tool/Dockerfile.template
+++ b/tools/oci-image-tool/Dockerfile.template
@@ -16,7 +16,7 @@ ARG version
 ENV CGO_ENABLED=0 \
     GO111MODULE=auto \
     GOPATH=/go
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/opencontainers/image-tools .
 make -j$(nproc) tool
 cp oci-image-tool "${prefix}/bin/"
diff --git a/tools/oci-runtime-tool/Dockerfile.template b/tools/oci-runtime-tool/Dockerfile.template
index 885636aeeb..c789e64363 100644
--- a/tools/oci-runtime-tool/Dockerfile.template
+++ b/tools/oci-runtime-tool/Dockerfile.template
@@ -16,7 +16,7 @@ ARG version
 ENV CGO_ENABLED=0 \
     GO111MODULE=auto \
     GOPATH=/go
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/opencontainers/runtime-tools .
 make -j$(nproc) tool
 cp oci-runtime-tool "${prefix}/bin/"
diff --git a/tools/ocm/Dockerfile.template b/tools/ocm/Dockerfile.template
index db95976830..bbfccb97e9 100644
--- a/tools/ocm/Dockerfile.template
+++ b/tools/ocm/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "open-component-model/ocm" "v${version}" "ocm-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/open-component-model/ocm/releases/download/v${version}/ocm-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/open-component-model/ocm/releases/download/v${version}/ocm-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "open-component-model/ocm" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/ocm" completion bash >"${prefix}/share/bash-completion/completions/ocm"
 "${prefix}/bin/ocm" completion fish >"${prefix}/share/fish/vendor_completions.d/ocm.fish"
diff --git a/tools/octopilot/Dockerfile.template b/tools/octopilot/Dockerfile.template
index 9d1fe85f2a..46c98676dc 100644
--- a/tools/octopilot/Dockerfile.template
+++ b/tools/octopilot/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dailymotion-oss/octopilot" "v${version}" "octopilot_${version}_linux_amd64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/octopilot" \
-    "https://github.com/dailymotion-oss/octopilot/releases/download/v${version}/octopilot_${version}_linux_amd64"
-chmod +x "${prefix}/bin/octopilot"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dailymotion-oss/octopilot/releases/download/v${version}/octopilot_${version}_linux_amd64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dailymotion-oss/octopilot" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/octopilot"
+
 EOF
\ No newline at end of file
diff --git a/tools/octosql/Dockerfile.template b/tools/octosql/Dockerfile.template
index c7fafc332e..f9cfeaf016 100644
--- a/tools/octosql/Dockerfile.template
+++ b/tools/octosql/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cube2222/octosql" "v${version}" "octosql_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cube2222/octosql/releases/download/v${version}/octosql_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cube2222/octosql/releases/download/v${version}/octosql_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cube2222/octosql" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     octosql
     
 "${prefix}/bin/octosql" completion bash >"${prefix}/share/bash-completion/completions/octosql"
diff --git a/tools/ojg/Dockerfile.template b/tools/ojg/Dockerfile.template
index 3ce6bd5944..aae485363f 100644
--- a/tools/ojg/Dockerfile.template
+++ b/tools/ojg/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/ohler55/ojg
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/ohler55/ojg" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/ohler55/ojg .
 make -C cmd/oj build
diff --git a/tools/ojg/manifest.yaml b/tools/ojg/manifest.yaml
index 71e4178213..bfce6f7bb2 100644
--- a/tools/ojg/manifest.yaml
+++ b/tools/ojg/manifest.yaml
@@ -4,8 +4,6 @@ name: ojg
 version: "1.24.1"
 binary: oj
 check: ${binary} --version | cut -d' ' -f2 | tr -d v
-build_dependencies:
-- bar
 platforms:
 - linux/amd64
 - linux/arm64
diff --git a/tools/opa/Dockerfile.template b/tools/opa/Dockerfile.template
index df2c0c0766..bdceeb7f79 100644
--- a/tools/opa/Dockerfile.template
+++ b/tools/opa/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "open-policy-agent/opa" "v${version}" "opa_linux_${alt_arch}_static"
-curl --silent --show-error --location --fail --output "${prefix}/bin/opa" \
-    "https://github.com/open-policy-agent/opa/releases/download/v${version}/opa_linux_${alt_arch}_static"
-chmod +x "${prefix}/bin/opa"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/open-policy-agent/opa/releases/download/v${version}/opa_linux_${alt_arch}_static"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "open-policy-agent/opa" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/opa"
+
 "${prefix}/bin/opa" completion bash >"${prefix}/share/bash-completion/completions/opa"
 "${prefix}/bin/opa" completion fish >"${prefix}/share/fish/vendor_completions.d/opa.fish"
 "${prefix}/bin/opa" completion zsh >"${prefix}/share/zsh/vendor-completions/_opa"
diff --git a/tools/openjdk-jre/Dockerfile.template b/tools/openjdk-jre/Dockerfile.template
index e4ac11e68a..61cc14806c 100644
--- a/tools/openjdk-jre/Dockerfile.template
+++ b/tools/openjdk-jre/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -27,10 +27,16 @@ MAJOR_VERSION="$(echo "${version}" | cut -d. -f1)"
 version_url_encoded="$(echo "${version}" | sed 's/+/%2B/g')"
 version_filename="$(echo "${version}" | sed 's/+/_/g')"
 
-check-github-release-asset "adoptium/temurin${MAJOR_VERSION}-binaries" "jdk-${version}" "OpenJDK${MAJOR_VERSION}U-jre_x64_alpine-linux_hotspot_${version_filename}.tar.gz"
+url="https://github.com/adoptium/temurin${MAJOR_VERSION}-binaries/releases/download/jdk-${version_url_encoded}/OpenJDK${MAJOR_VERSION}U-jre_x64_alpine-linux_hotspot_${version_filename}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "adoptium/temurin${MAJOR_VERSION}-binaries" "jdk-${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/opt/openjdk-jre"
-curl --silent --show-error --location --fail "https://github.com/adoptium/temurin${MAJOR_VERSION}-binaries/releases/download/jdk-${version_url_encoded}/OpenJDK${MAJOR_VERSION}U-jre_x64_alpine-linux_hotspot_${version_filename}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/opt/openjdk-jre" --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/opt/openjdk-jre" --strip-components=1 --no-same-owner
 
 cd "${prefix}/opt/openjdk-jre/bin"
 find . -type f -executable \
diff --git a/tools/openjdk/Dockerfile.template b/tools/openjdk/Dockerfile.template
index 29cb034fde..ad5b6148da 100644
--- a/tools/openjdk/Dockerfile.template
+++ b/tools/openjdk/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -27,10 +27,16 @@ MAJOR_VERSION="$(echo "${version}" | cut -d. -f1)"
 version_url_encoded="$(echo "${version}" | sed 's/+/%2B/g')"
 version_filename="$(echo "${version}" | sed 's/+/_/g')"
 
-check-github-release-asset "adoptium/temurin${MAJOR_VERSION}-binaries" "jdk-${version}" "OpenJDK${MAJOR_VERSION}U-jdk_x64_alpine-linux_hotspot_${version_filename}.tar.gz"
+url="https://github.com/adoptium/temurin${MAJOR_VERSION}-binaries/releases/download/jdk-${version_url_encoded}/OpenJDK${MAJOR_VERSION}U-jdk_x64_alpine-linux_hotspot_${version_filename}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "adoptium/temurin${MAJOR_VERSION}-binaries" "jdk-${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/opt/openjdk"
-curl --silent --show-error --location --fail "https://github.com/adoptium/temurin${MAJOR_VERSION}-binaries/releases/download/jdk-${version_url_encoded}/OpenJDK${MAJOR_VERSION}U-jdk_x64_alpine-linux_hotspot_${version_filename}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/opt/openjdk" --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/opt/openjdk" --strip-components=1 --no-same-owner
 
 cd "${prefix}/opt/openjdk/bin"
 find . -type f -executable \
diff --git a/tools/opentofu/Dockerfile.template b/tools/opentofu/Dockerfile.template
index 7a642e66bb..418718b4ff 100644
--- a/tools/opentofu/Dockerfile.template
+++ b/tools/opentofu/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/opentofu/opentofu/releases/download/v${version}/tofu_${version}_linux_${alt_arch}.zip"
-check-github-release-asset "opentofu/opentofu" "v${version}" "tofu_${version}_linux_${alt_arch}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+
+check-github-release-asset "opentofu/opentofu" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     tofu
 EOF
\ No newline at end of file
diff --git a/tools/oras/Dockerfile.template b/tools/oras/Dockerfile.template
index 731e0d60de..07ef6bbf7e 100644
--- a/tools/oras/Dockerfile.template
+++ b/tools/oras/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "oras-project/oras" "v${version}" "oras_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "oras-project/oras" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     oras
 "${prefix}/bin/oras" completion bash >"${prefix}/share/bash-completion/completions/oras"
 "${prefix}/bin/oras" completion fish >"${prefix}/share/fish/vendor_completions.d/oras.fish"
diff --git a/tools/osquery/Dockerfile.template b/tools/osquery/Dockerfile.template
index a94870ad3a..fe791aeb74 100644
--- a/tools/osquery/Dockerfile.template
+++ b/tools/osquery/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "osquery/osquery" "${version}" "osquery-${version}_1.linux_${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/osquery/osquery/releases/download/${version}/osquery-${version}_1.linux_${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/" --strip-components=2 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/osquery/osquery/releases/download/${version}/osquery-${version}_1.linux_${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "osquery/osquery" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/" --strip-components=2 --no-same-owner \
     opt/osquery
 ln --symbolic --relative --force "${prefix}/bin/osqueryd" "${prefix}/bin/osqueryi"
 EOF
\ No newline at end of file
diff --git a/tools/osv-scanner/Dockerfile.template b/tools/osv-scanner/Dockerfile.template
index 391dc0cd94..f2e72edaf1 100644
--- a/tools/osv-scanner/Dockerfile.template
+++ b/tools/osv-scanner/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "google/osv-scanner" "v${version}" "osv-scanner_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/osv-scanner" \
-    "https://github.com/google/osv-scanner/releases/download/v${version}/osv-scanner_linux_${alt_arch}"
-chmod +x "${prefix}/bin/osv-scanner"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/google/osv-scanner/releases/download/v${version}/osv-scanner_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "google/osv-scanner" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/osv-scanner"
+
 EOF
\ No newline at end of file
diff --git a/tools/overlaybd-snapshotter/Dockerfile.template b/tools/overlaybd-snapshotter/Dockerfile.template
index 64ef13bc94..6d56216b54 100644
--- a/tools/overlaybd-snapshotter/Dockerfile.template
+++ b/tools/overlaybd-snapshotter/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/containerd/accelerated-container-image
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containerd/accelerated-container-image .
 make -j$(nproc) binaries
 cp bin/overlaybd-snapshotter bin/ctr bin/convertor "${prefix}/bin/"
diff --git a/tools/overlaybd/Dockerfile.template b/tools/overlaybd/Dockerfile.template
index c6a0333665..6ec672a556 100644
--- a/tools/overlaybd/Dockerfile.template
+++ b/tools/overlaybd/Dockerfile.template
@@ -8,7 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     cmake \
@@ -28,7 +28,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/overlaybd
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containerd/overlaybd .
 git submodule update --init
 mkdir build
diff --git a/tools/pack/Dockerfile.template b/tools/pack/Dockerfile.template
index da7509d8b8..cc52103202 100644
--- a/tools/pack/Dockerfile.template
+++ b/tools/pack/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "buildpacks/pack" "v${version}" "pack-v${version}-linux${arch_suffix}.tgz"
-curl --silent --show-error --location --fail "https://github.com/buildpacks/pack/releases/download/v${version}/pack-v${version}-linux${arch_suffix}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+url="https://github.com/buildpacks/pack/releases/download/v${version}/pack-v${version}-linux${arch_suffix}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "buildpacks/pack" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/pack" completion bash >"${prefix}/share/bash-completion/completions/pack"
 "${prefix}/bin/pack" completion fish >"${prefix}/share/fish/vendor_completions.d/pack.fish"
diff --git a/tools/packer/Dockerfile.template b/tools/packer/Dockerfile.template
index d9fa85f9cc..a4f31d4f63 100644
--- a/tools/packer/Dockerfile.template
+++ b/tools/packer/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://releases.hashicorp.com/packer/${version}/packer_${version}_linux_${alt_arch}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
+
 echo "complete -C /bin/packer packer" >"${prefix}/etc/profile.d/packer.sh"
 EOF
\ No newline at end of file
diff --git a/tools/pacstall/Dockerfile.template b/tools/pacstall/Dockerfile.template
index 20a56d7d24..a4b9003ee0 100644
--- a/tools/pacstall/Dockerfile.template
+++ b/tools/pacstall/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 set -e -x
 
 curl --silent --show-error --location --fail --output "${prefix}/bin/pacstall" \
diff --git a/tools/pandoc/Dockerfile.template b/tools/pandoc/Dockerfile.template
index 6d9a894d25..8787e7dab8 100644
--- a/tools/pandoc/Dockerfile.template
+++ b/tools/pandoc/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jgm/pandoc" "${version}" "pandoc-${version}-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jgm/pandoc/releases/download/${version}/pandoc-${version}-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jgm/pandoc/releases/download/${version}/pandoc-${version}-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jgm/pandoc" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/paranoia/Dockerfile.template b/tools/paranoia/Dockerfile.template
index b07eb3ac4c..b59c57e740 100644
--- a/tools/paranoia/Dockerfile.template
+++ b/tools/paranoia/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "jetstack/paranoia" "v${version}" "paranoia-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/paranoia" \
-    "https://github.com/jetstack/paranoia/releases/download/v${version}/paranoia-linux-${alt_arch}"
-chmod +x "${prefix}/bin/paranoia"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jetstack/paranoia/releases/download/v${version}/paranoia-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "jetstack/paranoia" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/paranoia"
+
 
 "${prefix}/bin/paranoia" completion bash >"${prefix}/share/bash-completion/completions/paranoia"
 "${prefix}/bin/paranoia" completion fish >"${prefix}/share/fish/vendor_completions.d/paranoia.fish"
diff --git a/tools/parca-agent/Dockerfile.template b/tools/parca-agent/Dockerfile.template
index 822ad2535e..0bc473d0c8 100644
--- a/tools/parca-agent/Dockerfile.template
+++ b/tools/parca-agent/Dockerfile.template
@@ -7,9 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "parca-dev/parca-agent" "v${version}" "parca-agent_${version}_Linux_${arch}"
-
 echo "### Downloading parca-agent ${version}"
 curl --silent --show-error --location --fail --output "${prefix}/bin/parca-agent" \
     "https://github.com/parca-dev/parca-agent/releases/download/v${version}/parca-agent_${version}_Linux_${arch}"
diff --git a/tools/parca/Dockerfile.template b/tools/parca/Dockerfile.template
index 3f09fb1d29..fb182eaeb3 100644
--- a/tools/parca/Dockerfile.template
+++ b/tools/parca/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="${arch}"
@@ -21,8 +21,14 @@ case "${alt_arch}" in
         ;;
 esac
 
-check-github-release-asset "parca-dev/parca" "v${version}" "parca_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/parca-dev/parca/releases/download/v${version}/parca_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/parca-dev/parca/releases/download/v${version}/parca_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "parca-dev/parca" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     parca
 EOF
\ No newline at end of file
diff --git a/tools/pass-audit/Dockerfile.template b/tools/pass-audit/Dockerfile.template
index 219a31942d..1b414e02f6 100644
--- a/tools/pass-audit/Dockerfile.template
+++ b/tools/pass-audit/Dockerfile.template
@@ -9,22 +9,28 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-COPY --link --from=python / /usr/local/
-COPY --link --from=pipx / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     patch
 EOF
+COPY --link --from=make / /usr/local/
+COPY --link --from=python / /usr/local/
+COPY --link --from=pipx / /usr/local/
 WORKDIR /tmp/pass-audit
 ARG name
 ARG version
 COPY setup.cfg.patch /tmp/
-RUN <<EOF
-check-github-release-asset "roddhjav/pass-audit" "v${version}" "pass-audit-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/roddhjav/pass-audit/releases/download/v${version}/pass-audit-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/roddhjav/pass-audit/releases/download/v${version}/pass-audit-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "roddhjav/pass-audit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 patch </tmp/setup.cfg.patch
 export PIPX_HOME="${prefix}/libexec/pipx"
 export PIPX_BIN_DIR="${prefix}/bin"
@@ -32,7 +38,7 @@ pipx install .
 ln --symbolic --relative --force "${prefix}/libexec/pipx/venvs/pass-audit/bin/paudit" "${prefix}/bin/paudit"
 sed -i "s|#\!${prefix}/|#\!/|" "${prefix}/libexec/pipx/venvs/pass-audit/bin/paudit"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 mkdir -p "${prefix}/lib/password-store/extensions/"
 mv audit.bash "${prefix}/lib/password-store/extensions/"
 sed -i 's/python3 -m pass_audit/paudit/g' "${prefix}/lib/password-store/extensions/audit.bash"
diff --git a/tools/pass-git-helper/Dockerfile.template b/tools/pass-git-helper/Dockerfile.template
index f884c4a250..9dab50fa79 100644
--- a/tools/pass-git-helper/Dockerfile.template
+++ b/tools/pass-git-helper/Dockerfile.template
@@ -13,9 +13,17 @@ COPY --link --from=pipx / /usr/local/
 WORKDIR /tmp/pass-git-helper
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/languitar/pass-git-helper/archive/refs/tags/v${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/languitar/pass-git-helper/archive/refs/tags/v${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 printenv | sort
 export PIPX_HOME="${prefix}/libexec/pipx"
 export PIPX_BIN_DIR="${prefix}/bin"
diff --git a/tools/pass-import/Dockerfile.template b/tools/pass-import/Dockerfile.template
index edc6c0ebbc..e35d2b79cf 100644
--- a/tools/pass-import/Dockerfile.template
+++ b/tools/pass-import/Dockerfile.template
@@ -12,7 +12,7 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=pipx / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 export PIPX_HOME="${prefix}/libexec/pipx"
 export PIPX_BIN_DIR="${prefix}/bin"
 pipx install pass-import
@@ -20,10 +20,16 @@ ln --symbolic --relative --force "${prefix}/libexec/pipx/venvs/pass-import/bin/p
 sed -i "s|#\!${prefix}/|#\!/|" "${prefix}/libexec/pipx/venvs/pass-import/bin/pimport"
 EOF
 WORKDIR /tmp
-RUN <<EOF
-check-github-release-asset "roddhjav/pass-import" "v${version}" "pass-import-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/roddhjav/pass-import/releases/download/v${version}/pass-import-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/roddhjav/pass-import/releases/download/v${version}/pass-import-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "roddhjav/pass-import" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 \
     "pass-import-${version}/import.bash" \
     "pass-import-${version}/share/man/man1" \
     "pass-import-${version}/share/bash-completion" \
diff --git a/tools/pass-otp/Dockerfile.template b/tools/pass-otp/Dockerfile.template
index 2cf41964ca..302c1d17fc 100644
--- a/tools/pass-otp/Dockerfile.template
+++ b/tools/pass-otp/Dockerfile.template
@@ -5,7 +5,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     make
@@ -13,10 +13,16 @@ EOF
 WORKDIR /tmp/pass-otp
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tadfisher/pass-otp" "v${version}" "pass-otp-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/tadfisher/pass-otp/releases/download/v${version}/pass-otp-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tadfisher/pass-otp/releases/download/v${version}/pass-otp-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tadfisher/pass-otp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 make -j$(nproc) install \
     DESTDIR="${prefix}" \
     PREFIX="" \
diff --git a/tools/pass-tail/Dockerfile.template b/tools/pass-tail/Dockerfile.template
index 40435280c4..cff2c370ef 100644
--- a/tools/pass-tail/Dockerfile.template
+++ b/tools/pass-tail/Dockerfile.template
@@ -5,7 +5,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     make
@@ -13,9 +13,17 @@ EOF
 WORKDIR /tmp/pass-tail
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/palortoff/pass-extension-tail/archive/refs/tags/v${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/palortoff/pass-extension-tail/archive/refs/tags/v${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 make -j$(nproc) install \
     DESTDIR="${prefix}" \
     PREFIX="" \
diff --git a/tools/pass-update/Dockerfile.template b/tools/pass-update/Dockerfile.template
index b2a86b5515..56bb388914 100644
--- a/tools/pass-update/Dockerfile.template
+++ b/tools/pass-update/Dockerfile.template
@@ -5,7 +5,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     make
@@ -13,10 +13,16 @@ EOF
 WORKDIR /tmp/pass-update
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "roddhjav/pass-update" "v${version}" "pass-update-${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/roddhjav/pass-update/releases/download/v${version}/pass-update-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/roddhjav/pass-update/releases/download/v${version}/pass-update-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "roddhjav/pass-update" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 make -j$(nproc) install \
     DESTDIR="${prefix}" \
     PREFIX="" \
diff --git a/tools/pass/Dockerfile.template b/tools/pass/Dockerfile.template
index 2352c2799c..57ab5e6e8f 100644
--- a/tools/pass/Dockerfile.template
+++ b/tools/pass/Dockerfile.template
@@ -11,10 +11,17 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/pass
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://git.zx2c4.com/password-store/snapshot/password-store-${version}.tar.xz"
-curl --silent --show-error --location --fail "https://git.zx2c4.com/password-store/snapshot/password-store-${version}.tar.xz" \
-| tar --extract --xz --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://git.zx2c4.com/password-store/snapshot/password-store-${version}.tar.xz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --strip-components=1 --no-same-owner
+
 make -j$(nproc) install \
     DESTDIR="${prefix}" \
     PREFIX="" \
diff --git a/tools/passage/Dockerfile.template b/tools/passage/Dockerfile.template
index 12626c0de1..3fac2e2870 100644
--- a/tools/passage/Dockerfile.template
+++ b/tools/passage/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/pass
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 COMMIT="$(
     echo "${version}" \
     | cut -d. -f2
diff --git a/tools/passh/Dockerfile.template b/tools/passh/Dockerfile.template
index 28510abccd..d0ce296901 100644
--- a/tools/passh/Dockerfile.template
+++ b/tools/passh/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/passh
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/clarkwang/passh "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/clarkwang/passh .
 make -j$(nproc) LDFLAGS=-static
diff --git a/tools/passt/Dockerfile.template b/tools/passt/Dockerfile.template
index 8d8abb4a1d..1e79fa0baa 100644
--- a/tools/passt/Dockerfile.template
+++ b/tools/passt/Dockerfile.template
@@ -7,15 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     linux-headers
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/passt
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --branch "${version}" https://passt.top/passt/ .
 make -j$(nproc) static
 make install DESTDIR="${prefix}" prefix=""
diff --git a/tools/patat/Dockerfile.template b/tools/patat/Dockerfile.template
index f7fb1d6c5c..50021d7e16 100644
--- a/tools/patat/Dockerfile.template
+++ b/tools/patat/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jaspervdj/patat/releases/download/v${version}/patat-v${version}-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-RUN <<EOF
-check-github-release-asset "jaspervdj/patat" "v${version}" "patat-v${version}-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/jaspervdj/patat/releases/download/v${version}/patat-v${version}-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+check-github-release-asset "jaspervdj/patat" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     patat-v${version}-linux-${arch}/patat
 
 curl --silent --show-error --location --fail "https://github.com/jaspervdj/patat/releases/download/v${version}/patat-v${version}-linux-${arch}.tar.gz" \
diff --git a/tools/pebble/Dockerfile.template b/tools/pebble/Dockerfile.template
index b92527909f..fe43f3f998 100644
--- a/tools/pebble/Dockerfile.template
+++ b/tools/pebble/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "canonical/pebble" "v${version}" "pebble_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/canonical/pebble/releases/download/v${version}/pebble_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/canonical/pebble/releases/download/v${version}/pebble_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "canonical/pebble" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     pebble
 EOF
\ No newline at end of file
diff --git a/tools/perl/Dockerfile.template b/tools/perl/Dockerfile.template
index efc618d1c7..6871d02e58 100644
--- a/tools/perl/Dockerfile.template
+++ b/tools/perl/Dockerfile.template
@@ -17,7 +17,7 @@ PERL_VERSION="${version}"
 PERL_PREFIX="/uniget_bootstrap"
 CPAN="https://www.cpan.org"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "/usr/local/bin/staticperl" \
     http://cvs.schmorp.de/App-Staticperl/bin/staticperl
 chmod +x "/usr/local/bin/staticperl"
diff --git a/tools/phive/Dockerfile.template b/tools/phive/Dockerfile.template
index 1959f84966..4d6c90cfe6 100644
--- a/tools/phive/Dockerfile.template
+++ b/tools/phive/Dockerfile.template
@@ -9,10 +9,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-COPY --from=php / /usr/local/
-RUN <<EOF
-check-github-release-asset "phar-io/phive" "${version}" "phive-${version}.phar"
-curl --silent --show-error --location --fail --output "${prefix}/bin/phive" \
-    "https://github.com/phar-io/phive/releases/download/${version}/phive-${version}.phar"
-chmod +x "${prefix}/bin/phive"
+COPY --link --from=php / /usr/local/
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/phar-io/phive/releases/download/${version}/phive-${version}.phar"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "phar-io/phive" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/phive"
+
 EOF
\ No newline at end of file
diff --git a/tools/php/Dockerfile.template b/tools/php/Dockerfile.template
index 468965adfc..7042b37d02 100644
--- a/tools/php/Dockerfile.template
+++ b/tools/php/Dockerfile.template
@@ -7,8 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=spc / /usr/local/
-RUN <<EOF
+COPY --link --from=spc / /usr/local/
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install \
     re2c
@@ -20,7 +20,7 @@ ARG EXTENSION_BULK="apcu,bcmath,bz2,calendar,ctype,curl,dba,dom,event,exif,filei
 ARG EXTENSIONS_COMMON="bcmath,bz2,calendar,ctype,curl,dom,exif,fileinfo,filter,ftp,gd,gmp,iconv,xml,mbstring,mbregex,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,redis,session,simplexml,soap,sockets,sqlite3,tokenizer,xmlwriter,xmlreader,zlib,zip"
 ARG EXTENSIONS_MINIMAL="pcntl,posix,mbstring,tokenizer,phar"
 ARG EXTENSIONS="${EXTENSIONS_COMMON}"
-RUN <<EOF
+RUN <<EOF # no download cache
 PHP_MINOR_VERSION="$( echo "${version}" | cut -d. -f1-2)"
 
 mkdir -p \
@@ -28,8 +28,8 @@ mkdir -p \
     buildroot/sources/php-src \
     source/php-src
 curl --silent --show-error --location --fail --output "downloads/php-${version}.tar.gz" "https://github.com/php/php-src/archive/refs/tags/php-${version}.tar.gz"
-tar --extract --gzip --file "downloads/php-${version}.tar.gz" --directory buildroot/sources/php-src/ --strip-components=1 --no-same-owner
-tar --extract --gzip --file "downloads/php-${version}.tar.gz" --directory source/php-src/ --strip-components=1 --no-same-owner
+tar --extract --gzip --file="downloads/php-${version}.tar.gz" --directory=buildroot/sources/php-src/ --strip-components=1 --no-same-owner
+tar --extract --gzip --file="downloads/php-${version}.tar.gz" --directory=source/php-src/ --strip-components=1 --no-same-owner
 
 spc download \
     --with-php="${PHP_MINOR_VERSION}" \
@@ -46,7 +46,7 @@ fi
 SPC_USE_SUDO=no spc doctor --auto-fix
 spc install-pkg upx
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 spc build --build-cli --build-micro --build-fpm "${EXTENSIONS}" --debug --with-upx-pack
 cp \
     buildroot/bin/php \
diff --git a/tools/pigz/Dockerfile.template b/tools/pigz/Dockerfile.template
index 486285f354..9d189f7513 100644
--- a/tools/pigz/Dockerfile.template
+++ b/tools/pigz/Dockerfile.template
@@ -7,8 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     zlib-dev \
     zlib-static
 EOF
@@ -16,7 +16,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/pigz
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/madler/pigz "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/madler/pigz .
 make -j$(nproc) all LDFLAGS=-static
diff --git a/tools/pipx/Dockerfile.template b/tools/pipx/Dockerfile.template
index ba555263a0..b0dd2fb6a0 100644
--- a/tools/pipx/Dockerfile.template
+++ b/tools/pipx/Dockerfile.template
@@ -12,10 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/pipx" --console-script pipx "pipx==${version}"
-
-#register-python-argcomplete              pipx >"${prefix}/share/bash-completion/completions/pipx"
-#register-python-argcomplete --shell fish pipx >"${prefix}/share/fish/vendor_completions.d/pipx.fish"
-#register-python-argcomplete              pipx >"${prefix}/share/zsh/vendor-completions/_pipx"
 EOF
diff --git a/tools/podman-docker-shim/Dockerfile.template b/tools/podman-docker-shim/Dockerfile.template
index be28c8d44f..cbb0bb1c6c 100644
--- a/tools/podman-docker-shim/Dockerfile.template
+++ b/tools/podman-docker-shim/Dockerfile.template
@@ -5,11 +5,9 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
-
 COPY docker /uniget_bootstrap/libexec/podman/
-RUN <<EOF
+RUN <<EOF # no download cache
 ln --symbolic --relative --force "${prefix}/libexec/podman/docker" "/bin/docker"
 EOF
\ No newline at end of file
diff --git a/tools/podman-tui/Dockerfile.template b/tools/podman-tui/Dockerfile.template
index fc031455bb..dabc1db558 100644
--- a/tools/podman-tui/Dockerfile.template
+++ b/tools/podman-tui/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/containers/podman-tui
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 export CGO_ENABLED=0
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containers/podman-tui .
 go build -mod=vendor -o ./bin/linux/podman-tui -tags "containers_image_openpgp remote"
diff --git a/tools/podman/Dockerfile.template b/tools/podman/Dockerfile.template
index b92465143d..8ca99c52e9 100644
--- a/tools/podman/Dockerfile.template
+++ b/tools/podman/Dockerfile.template
@@ -10,12 +10,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=go / /usr/local/
-COPY --link --from=make / /usr/local/
-COPY --link --from=go-md2man / /usr/local/
-COPY --link --from=cni / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     musl-dev \
 	btrfs-progs \
     btrfs-progs-dev \
@@ -38,19 +34,23 @@ apk add --update-cache --no-cache \
     mandoc
 cp -r /usr/local/libexec/cni/ /usr/lib/
 EOF
+COPY --link --from=go / /usr/local/
+COPY --link --from=make / /usr/local/
+COPY --link --from=go-md2man / /usr/local/
+COPY --link --from=cni / /usr/local/
 WORKDIR /tmp/podman
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containers/podman .
 go get -u github.com/mattn/go-sqlite3
 go mod vendor
 EOF
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 export CGO_ENABLED=1
 make -j$(nproc) LDFLAGS_PODMAN="-s -w -extldflags '-static'" BUILDTAGS='seccomp selinux apparmor exclude_graphdriver_devicemapper containers_image_openpgp'
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 make install             DESTDIR="${prefix}" PREFIX=""
 make install.completions DESTDIR="${prefix}" PREFIX=""
 make install.man         DESTDIR="${prefix}" PREFIX=""
diff --git a/tools/polaris/Dockerfile.template b/tools/polaris/Dockerfile.template
index e7fe65d2a6..b4dd16f2cc 100644
--- a/tools/polaris/Dockerfile.template
+++ b/tools/polaris/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "FairwindsOps/polaris" "${version}" "polaris_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/FairwindsOps/polaris/releases/download/${version}/polaris_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/FairwindsOps/polaris/releases/download/${version}/polaris_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "FairwindsOps/polaris" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     polaris
 EOF
\ No newline at end of file
diff --git a/tools/policy/Dockerfile.template b/tools/policy/Dockerfile.template
index c8626db485..abb6cd82a3 100644
--- a/tools/policy/Dockerfile.template
+++ b/tools/policy/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "opcr-io/policy" "v${version}" "policy${version}_linux_${arch_suffix}.zip"
 url="https://github.com/opcr-io/policy/releases/download/v${version}/policy${version}_linux_${arch_suffix}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+
+check-github-release-asset "opcr-io/policy" "v${version}" "${filename}"
+
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 EOF
diff --git a/tools/pop/Dockerfile.template b/tools/pop/Dockerfile.template
index 49ca185d2d..1d44c9f86a 100644
--- a/tools/pop/Dockerfile.template
+++ b/tools/pop/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/pop" "v${version}" "pop_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/pop/releases/download/v${version}/pop_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/charmbracelet/pop/releases/download/v${version}/pop_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/pop" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     pop \
     manpages \
     completions
diff --git a/tools/popeye/Dockerfile.template b/tools/popeye/Dockerfile.template
index d0de021538..dc0ee4d9fc 100644
--- a/tools/popeye/Dockerfile.template
+++ b/tools/popeye/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "derailed/popeye" "v${version}" "popeye_Linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/derailed/popeye/releases/download/v${version}/popeye_Linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/derailed/popeye/releases/download/v${version}/popeye_Linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "derailed/popeye" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     popeye
 "${prefix}/bin/popeye" completion bash >"${prefix}/share/bash-completion/completions/popeye"
 "${prefix}/bin/popeye" completion fish >"${prefix}/share/fish/vendor_completions.d/popeye.fish"
diff --git a/tools/portainer/Dockerfile.template b/tools/portainer/Dockerfile.template
index 813d4792e5..b6e5142657 100644
--- a/tools/portainer/Dockerfile.template
+++ b/tools/portainer/Dockerfile.template
@@ -8,10 +8,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY portainer.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-check-github-release-asset "portainer/portainer" "${version}" "portainer-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/portainer/portainer/releases/download/${version}/portainer-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/portainer/portainer/releases/download/${version}/portainer-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "portainer/portainer" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --strip-components=1 --no-same-owner \
     portainer/portainer
 
 mkdir -p "${prefix}/share/portainer"
diff --git a/tools/porter/Dockerfile.template b/tools/porter/Dockerfile.template
index 045a1a2f2f..477af1f753 100644
--- a/tools/porter/Dockerfile.template
+++ b/tools/porter/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "getporter/porter" "v${version}" "porter-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/porter" \
-    "https://github.com/getporter/porter/releases/download/v${version}/porter-linux-${alt_arch}"
-chmod +x "${prefix}/bin/porter"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/getporter/porter/releases/download/v${version}/porter-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "getporter/porter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/porter"
+
 "${prefix}/bin/porter" completion bash >"${prefix}/share/bash-completion/completions/porter"
 "${prefix}/bin/porter" completion fish >"${prefix}/share/fish/vendor_completions.d/porter.fish"
 "${prefix}/bin/porter" completion zsh >"${prefix}/share/zsh/vendor-completions/_porter"
diff --git a/tools/posting/Dockerfile.template b/tools/posting/Dockerfile.template
index ab2d90b090..b14509700d 100644
--- a/tools/posting/Dockerfile.template
+++ b/tools/posting/Dockerfile.template
@@ -8,10 +8,10 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/posting" --console-script posting "posting==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/powerline-go/Dockerfile.template b/tools/powerline-go/Dockerfile.template
index 332a3a7cfc..4cc19cf517 100644
--- a/tools/powerline-go/Dockerfile.template
+++ b/tools/powerline-go/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "justjanne/powerline-go" "v${version}" "powerline-go-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/powerline-go" \
-    "https://github.com/justjanne/powerline-go/releases/download/v${version}/powerline-go-linux-${alt_arch}"
-chmod +x "${prefix}/bin/powerline-go"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/justjanne/powerline-go/releases/download/v${version}/powerline-go-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "justjanne/powerline-go" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/powerline-go"
+
 EOF
\ No newline at end of file
diff --git a/tools/powershell/Dockerfile.template b/tools/powershell/Dockerfile.template
index 928836567e..a68c8f77fc 100644
--- a/tools/powershell/Dockerfile.template
+++ b/tools/powershell/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     libicu70
diff --git a/tools/pre-commit/Dockerfile.template b/tools/pre-commit/Dockerfile.template
index 0434784b63..bac8b5eaa7 100644
--- a/tools/pre-commit/Dockerfile.template
+++ b/tools/pre-commit/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/pre-commit" --console-script pre-commit "pre-commit==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/presenterm/Dockerfile.template b/tools/presenterm/Dockerfile.template
index 9900fd1e79..3239c03dd9 100644
--- a/tools/presenterm/Dockerfile.template
+++ b/tools/presenterm/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mfontanini/presenterm" "v${version}" "presenterm-${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/mfontanini/presenterm/releases/download/v${version}/presenterm-${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mfontanini/presenterm/releases/download/v${version}/presenterm-${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mfontanini/presenterm" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "presenterm-${version}/presenterm"
 EOF
\ No newline at end of file
diff --git a/tools/process-compose/Dockerfile.template b/tools/process-compose/Dockerfile.template
index bb17464efa..a62070f3f2 100644
--- a/tools/process-compose/Dockerfile.template
+++ b/tools/process-compose/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "F1bonacc1/process-compose" "v${version}" "process-compose_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/F1bonacc1/process-compose/releases/download/v${version}/process-compose_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/F1bonacc1/process-compose/releases/download/v${version}/process-compose_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "F1bonacc1/process-compose" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/process-compose" completion bash >"${prefix}/share/bash-completion/completions/process-compose"
 "${prefix}/bin/process-compose" completion fish >"${prefix}/share/fish/vendor_completions.d/process-compose.fish"
diff --git a/tools/procs/Dockerfile.template b/tools/procs/Dockerfile.template
index 4f25de7889..dcf7a88fc2 100644
--- a/tools/procs/Dockerfile.template
+++ b/tools/procs/Dockerfile.template
@@ -7,12 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dalance/procs" "v${version}" "procs-v${version}-${arch}-linux.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/dalance/procs/releases/download/v${version}/procs-v${version}-${arch}-linux.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dalance/procs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
+
 "${prefix}/bin/procs" --gen-completion-out bash >"${prefix}/share/bash-completion/completions/procs"
 "${prefix}/bin/procs" --gen-completion-out fish >"${prefix}/share/fish/vendor_completions.d/procs.fish"
 "${prefix}/bin/procs" --gen-completion-out zsh >"${prefix}/share/zsh/vendor-completions/_procs"
diff --git a/tools/promcolor/Dockerfile.template b/tools/promcolor/Dockerfile.template
index 009ae3f40d..9466261ce7 100644
--- a/tools/promcolor/Dockerfile.template
+++ b/tools/promcolor/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "fhemberger/promcolor" "v${version}" "promcolor_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/fhemberger/promcolor/releases/download/v${version}/promcolor_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/fhemberger/promcolor/releases/download/v${version}/promcolor_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "fhemberger/promcolor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     promcolor
 EOF
\ No newline at end of file
diff --git a/tools/prometheus/Dockerfile.template b/tools/prometheus/Dockerfile.template
index f6b90d516d..de5fec16e6 100644
--- a/tools/prometheus/Dockerfile.template
+++ b/tools/prometheus/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus/prometheus" "v${version}" "prometheus-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus/prometheus" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "prometheus-${version}.linux-${alt_arch}/prometheus"
 EOF
 COPY prometheus.yaml /uniget_bootstrap/etc/prometheus/
\ No newline at end of file
diff --git a/tools/promql-cli/Dockerfile.template b/tools/promql-cli/Dockerfile.template
index f5807012f3..4ef98ff1f1 100644
--- a/tools/promql-cli/Dockerfile.template
+++ b/tools/promql-cli/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "nalbury/promql-cli" "v${version}" "promql-v${version}-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/nalbury/promql-cli/releases/download/v${version}/promql-v${version}-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/nalbury/promql-cli/releases/download/v${version}/promql-v${version}-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "nalbury/promql-cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/promtail/Dockerfile.template b/tools/promtail/Dockerfile.template
index 91b2c718e9..52962481a4 100644
--- a/tools/promtail/Dockerfile.template
+++ b/tools/promtail/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/loki" "v${version}" "promtail-linux-${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/grafana/loki/releases/download/v${version}/promtail-linux-${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/loki" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 mv "${prefix}/bin/promtail-linux-${alt_arch}" "${prefix}/bin/promtail"
 EOF
\ No newline at end of file
diff --git a/tools/promtool/Dockerfile.template b/tools/promtool/Dockerfile.template
index 024acf30f9..21c314a323 100644
--- a/tools/promtool/Dockerfile.template
+++ b/tools/promtool/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus/prometheus" "v${version}" "prometheus-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus/prometheus" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "prometheus-${version}.linux-${alt_arch}/promtool"
 EOF
\ No newline at end of file
diff --git a/tools/proot/Dockerfile.template b/tools/proot/Dockerfile.template
index 366ab737a6..ef61e635ca 100644
--- a/tools/proot/Dockerfile.template
+++ b/tools/proot/Dockerfile.template
@@ -9,8 +9,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     talloc-dev \
     talloc-static \
     linux-headers \
@@ -19,7 +19,7 @@ apk add --update-cache --no-cache \
 EOF
 COPY --link --from=make / /usr/local/
 WORKDIR /tmp/proot
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/proot-me/proot .
 make -C src -j$(nproc) LDFLAGS="-static -ltalloc"
 make -C doc proot/man.1
diff --git a/tools/proxify/Dockerfile.template b/tools/proxify/Dockerfile.template
index 6fa47f2372..bbce201e49 100644
--- a/tools/proxify/Dockerfile.template
+++ b/tools/proxify/Dockerfile.template
@@ -7,12 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/proxify" "v${version}" "proxify_${version}_linux_${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/proxify/releases/download/v${version}/proxify_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/proxify" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     proxify \
     replay \
     mitmrelay
diff --git a/tools/pulumi/Dockerfile.template b/tools/pulumi/Dockerfile.template
index 293ac562b8..796b3fd8fd 100644
--- a/tools/pulumi/Dockerfile.template
+++ b/tools/pulumi/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "pulumi/pulumi" "v${version}" "pulumi-v${version}-linux-${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/pulumi/pulumi/releases/download/v${version}/pulumi-v${version}-linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
+url="https://github.com/pulumi/pulumi/releases/download/v${version}/pulumi-v${version}-linux-${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "pulumi/pulumi" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
 
 "${prefix}/bin/pulumi" completion bash >"${prefix}/share/bash-completion/completions/pulumi"
 "${prefix}/bin/pulumi" completion fish >"${prefix}/share/fish/vendor_completions.d/pulumi.fish"
diff --git a/tools/purl/Dockerfile.template b/tools/purl/Dockerfile.template
index 097448e38b..70ddc2b6e1 100644
--- a/tools/purl/Dockerfile.template
+++ b/tools/purl/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "catatsuy/purl" "v${version}" "purl-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/catatsuy/purl/releases/download/v${version}/purl-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/catatsuy/purl/releases/download/v${version}/purl-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "catatsuy/purl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     purl
 EOF
\ No newline at end of file
diff --git a/tools/pushgateway/Dockerfile.template b/tools/pushgateway/Dockerfile.template
index 30ff0de64f..1c309d3324 100644
--- a/tools/pushgateway/Dockerfile.template
+++ b/tools/pushgateway/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "prometheus/pushgateway" "v${version}" "pushgateway-${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/prometheus/pushgateway/releases/download/v${version}/pushgateway-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/prometheus/pushgateway/releases/download/v${version}/pushgateway-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "prometheus/pushgateway" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "pushgateway-${version}.linux-${alt_arch}/pushgateway"
 EOF
diff --git a/tools/pv/Dockerfile.template b/tools/pv/Dockerfile.template
index f3e0d63671..7aeef3c69a 100644
--- a/tools/pv/Dockerfile.template
+++ b/tools/pv/Dockerfile.template
@@ -7,18 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
 apk update
-apk add \
+apk add --update-cache \
     gettext \
     gettext-dev
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/pv
 ARG name
 ARG version
 # Static linking causes "undefined refererence to printf
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://codeberg.org/a-j-wood/pv .
 autoreconf -is
 ./configure --prefix="${prefix}"
diff --git a/tools/pwru/Dockerfile.template b/tools/pwru/Dockerfile.template
index e51f89ac3a..8f217f422e 100644
--- a/tools/pwru/Dockerfile.template
+++ b/tools/pwru/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cilium/pwru" "v${version}" "pwru-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cilium/pwru/releases/download/v${version}/pwru-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cilium/pwru/releases/download/v${version}/pwru-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cilium/pwru" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/python-static/Dockerfile.template b/tools/python-static/Dockerfile.template
index 4d694d0434..b9bb9aad4a 100644
--- a/tools/python-static/Dockerfile.template
+++ b/tools/python-static/Dockerfile.template
@@ -7,16 +7,21 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 PYTHON_VERSION="$( echo "${version}" | cut -d. -f1-3 )"
 RELEASE_TAG="$( echo "${version}" | cut -d. -f4 )"
 
+url="https://github.com/indygreg/python-build-standalone/releases/download/${RELEASE_TAG}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-${arch}-unknown-linux-musl-lto-full.tar.zst"
+filename="$(basename "${url}")"
+
 check-github-release-asset \
     "indygreg/python-build-standalone" \
     "${RELEASE_TAG}" \
-    "cpython-${PYTHON_VERSION}+${RELEASE_TAG}-${arch}-unknown-linux-musl-lto-full.tar.zst"
+    "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-curl --silent --show-error --location --fail "https://github.com/indygreg/python-build-standalone/releases/download/${RELEASE_TAG}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-${arch}-unknown-linux-musl-lto-full.tar.zst" \
-| tar --extract --zstd --directory="${prefix}/" --strip-components=2 --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --zstd --directory="${prefix}/" --strip-components=2 --no-same-owner \
     python/install
 EOF
\ No newline at end of file
diff --git a/tools/python/Dockerfile.template b/tools/python/Dockerfile.template
index d2e63420cd..7bd46ff951 100644
--- a/tools/python/Dockerfile.template
+++ b/tools/python/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 PYTHON_VERSION="$( echo "${version}" | cut -d. -f1-3 )"
 RELEASE_TAG="$( echo "${version}" | cut -d. -f4 )"
 
@@ -24,13 +24,17 @@ case "${arch}" in
         ;;
 esac
 
+url="https://github.com/indygreg/python-build-standalone/releases/download/${RELEASE_TAG}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-${arch}-unknown-linux-gnu-${OPT_TAG}-full.tar.zst"
+filename="$(basename "${url}")"
 
 check-github-release-asset \
     "indygreg/python-build-standalone" \
     "${RELEASE_TAG}" \
-    "cpython-${PYTHON_VERSION}+${RELEASE_TAG}-${arch}-unknown-linux-gnu-${OPT_TAG}-full.tar.zst"
+    "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-curl --silent --show-error --location --fail "https://github.com/indygreg/python-build-standalone/releases/download/${RELEASE_TAG}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-${arch}-unknown-linux-gnu-${OPT_TAG}-full.tar.zst" \
-| tar --extract --zstd --directory="${prefix}/" --strip-components=2 --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --zstd --directory="${prefix}/" --strip-components=2 --no-same-owner \
     python/install
 EOF
\ No newline at end of file
diff --git a/tools/qemu/Dockerfile.template b/tools/qemu/Dockerfile.template
index 40ad36fcb6..791f5f0144 100644
--- a/tools/qemu/Dockerfile.template
+++ b/tools/qemu/Dockerfile.template
@@ -8,7 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
 ENV DEBIAN_FRONTEND=non-interactive
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     ninja-build \
@@ -24,12 +24,12 @@ WORKDIR /tmp/qemu
 ARG name
 ARG version
 ARG TARGETS="aarch64-softmmu x86_64-softmmu"
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/qemu/qemu "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/qemu/qemu .
 EOF
 WORKDIR /tmp/qemu/build
-RUN <<EOF
+RUN <<EOF # no download cache
 ../configure --prefix="${prefix}" --static --enable-tools --disable-user --disable-gio --target-list="${TARGETS}"
 make -j$(nproc)
 EOF
diff --git a/tools/qrencode/Dockerfile.template b/tools/qrencode/Dockerfile.template
index 1765e15c7e..b55d031be9 100644
--- a/tools/qrencode/Dockerfile.template
+++ b/tools/qrencode/Dockerfile.template
@@ -7,18 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
 apk update
-apk add \
+apk add --update-cache \
     libpng-dev \
     libpng-static \
     zlib-static
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/qrencode
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/fukuchi/libqrencode .
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-static
diff --git a/tools/qsv/Dockerfile.template b/tools/qsv/Dockerfile.template
index 8afe7ee767..1f82b4271a 100644
--- a/tools/qsv/Dockerfile.template
+++ b/tools/qsv/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting suffix based on architecture"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "jqnatividad/qsv" "${version}" "qsv-${version}-${arch}-unknown-linux-${arch_suffix}.zip"
 url="https://github.com/jqnatividad/qsv/releases/download/${version}/qsv-${version}-${arch}-unknown-linux-${arch_suffix}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+
+check-github-release-asset "jqnatividad/qsv" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     qsv
 EOF
\ No newline at end of file
diff --git a/tools/quarto-full/Dockerfile.template b/tools/quarto-full/Dockerfile.template
index 3bdacb9be9..8c2e93deb8 100644
--- a/tools/quarto-full/Dockerfile.template
+++ b/tools/quarto-full/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "quarto-dev/quarto-cli" "v${version}" "quarto-${version}-linux-${alt_arch}.tar.gz"
 mkdir -p "${prefix}/opt/quarto"
 curl --silent --show-error --location --fail "https://github.com/quarto-dev/quarto-cli/releases/download/v${version}/quarto-${version}-linux-${alt_arch}.tar.gz" \
diff --git a/tools/quarto/Dockerfile.template b/tools/quarto/Dockerfile.template
index d2f081272d..f69934bf9e 100644
--- a/tools/quarto/Dockerfile.template
+++ b/tools/quarto/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "quarto-dev/quarto-cli" "v${version}" "quarto-${version}-linux-${alt_arch}.tar.gz"
 mkdir -p "${prefix}/opt/quarto"
 curl --silent --show-error --location --fail "https://github.com/quarto-dev/quarto-cli/releases/download/v${version}/quarto-${version}-linux-${alt_arch}.tar.gz" \
diff --git a/tools/rage/Dockerfile.template b/tools/rage/Dockerfile.template
index b9017f8cc3..1c4ec2f711 100644
--- a/tools/rage/Dockerfile.template
+++ b/tools/rage/Dockerfile.template
@@ -7,15 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=jq / /usr/local/
-ARG name
-ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     binutils
 EOF
-RUN <<EOF
+COPY --link --from=jq / /usr/local/
+ARG name
+ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -31,24 +31,26 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-ASSET="$(
+url="$(
     curl --silent --show-error --location --fail "https://api.github.com/repos/str4d/rage/releases/tags/v${version}" \
     | jq --raw-output --arg arch "${alt_arch}" '
         .assets[] | 
         select(.name | contains($arch)) | 
         select(.name | contains("musl")) | 
         select(.name | endswith(".deb")) | 
-        .name
+        .browser_download_url
     '
 )"
-if test -z "${ASSET}"; then
+if test -z "${url}"; then
     echo "ERROR: Unable to determine asset for ${alt_arch}."
     exit 1
 fi
+filename="$(basename "${url}")"
 
-curl --silent --show-error --location --fail --remote-name "https://github.com/str4d/rage/releases/download/v${version}/${ASSET}"
-ar -x "${ASSET}"
-tar --extract --xz --directory="${prefix}" --file="data.tar.xz" --strip-components=1 --no-same-owner \
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+ar -x "${uniget_cache_download}/${filename}"
+tar --file="data.tar.xz" --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner \
     usr/bin \
     usr/share/man \
     usr/share/bash-completion \
diff --git a/tools/rare/Dockerfile.template b/tools/rare/Dockerfile.template
index 479c99dad5..c12cdbac4b 100644
--- a/tools/rare/Dockerfile.template
+++ b/tools/rare/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "zix99/rare" "${version}" "rare_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/zix99/rare/releases/download/${version}/rare_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+url="https://github.com/zix99/rare/releases/download/${version}/rare_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "zix99/rare" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 rm -f \
     "${prefix}/bin/README.md" \
     "${prefix}/bin/LICENSE"
diff --git a/tools/redis/Dockerfile.template b/tools/redis/Dockerfile.template
index bb8aefd490..0555c48cbd 100644
--- a/tools/redis/Dockerfile.template
+++ b/tools/redis/Dockerfile.template
@@ -5,8 +5,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     jemalloc-dev \
     openssl-dev \
     openssl-libs-static
diff --git a/tools/regal/Dockerfile.template b/tools/regal/Dockerfile.template
index 8ffdee6a37..0dd0967bcc 100644
--- a/tools/regal/Dockerfile.template
+++ b/tools/regal/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,17 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "StyraInc/regal" "v${version}" "regal_Linux_${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/regal" \
-    "https://github.com/StyraInc/regal/releases/download/v${version}/regal_Linux_${arch_suffix}"
-chmod +x "${prefix}/bin/regal"
+url="https://github.com/StyraInc/regal/releases/download/v${version}/regal_Linux_${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "StyraInc/regal" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/regal"
+
 
 "${prefix}/bin/regal" completion bash >"${prefix}/share/bash-completion/completions/regal"
 "${prefix}/bin/regal" completion fish >"${prefix}/share/fish/vendor_completions.d/regal.fish"
diff --git a/tools/regclient/Dockerfile.template b/tools/regclient/Dockerfile.template
index e79f1ef10a..d4500b5c03 100644
--- a/tools/regclient/Dockerfile.template
+++ b/tools/regclient/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/regclient/regclient/releases/download/v${version}/regctl-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "regclient/regclient" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/regctl"
 
-RUN <<EOF
-check-github-release-asset "regclient/regclient" "v${version}" "regctl-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/regctl" \
-    "https://github.com/regclient/regclient/releases/download/v${version}/regctl-linux-${alt_arch}"
-chmod +x "${prefix}/bin/regctl"
 "${prefix}/bin/regctl" completion bash >"${prefix}/share/bash-completion/completions/regctl"
 "${prefix}/bin/regctl" completion fish >"${prefix}/share/fish/vendor_completions.d/regctl.fish"
 "${prefix}/bin/regctl" completion zsh >"${prefix}/share/zsh/vendor-completions/_regctl"
diff --git a/tools/registry/Dockerfile.template b/tools/registry/Dockerfile.template
index ca91a9a155..ca5c1e34a4 100644
--- a/tools/registry/Dockerfile.template
+++ b/tools/registry/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "distribution/distribution" "v${version}" "registry_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/distribution/distribution/releases/download/v${version}/registry_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/distribution/distribution/releases/download/v${version}/registry_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "distribution/distribution" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     registry
 EOF
\ No newline at end of file
diff --git a/tools/rekor/Dockerfile.template b/tools/rekor/Dockerfile.template
index c2982d692a..d422554e76 100644
--- a/tools/rekor/Dockerfile.template
+++ b/tools/rekor/Dockerfile.template
@@ -11,74 +11,86 @@ COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
 COPY rekor.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-check-github-release-asset "sigstore/rekor" "v${version}" "rekor-cli-linux-${alt_arch}"
 
-echo "### Installing rekor-cli ${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/rekor-cli" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-cli-linux-${alt_arch}"
-chmod +x "${prefix}/bin/rekor-cli"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sigstore/rekor/releases/download/v${version}/rekor-cli-linux-${alt_arch}"
+filename="$(basename "${url}")"
 
-echo "### Installing shell completion for rekor-cli ${version}"
-"${prefix}/bin/rekor-cli" completion bash >"${prefix}/share/bash-completion/completions/rekor-cli"
-"${prefix}/bin/rekor-cli" completion fish >"${prefix}/share/fish/vendor_completions.d/rekor-cli.fish"
-"${prefix}/bin/rekor-cli" completion zsh >"${prefix}/share/zsh/vendor-completions/_rekor-cli"
+echo "### Downloading rekor-cli ${version}"
+check-github-release-asset "sigstore/rekor" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-echo "### Checking PGP signature for rekor-cli ${version}"
-curl --silent --show-error --location --fail --output "rekor-cli-linux-${alt_arch}.sig" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-cli-linux-${alt_arch}.sig"
+echo "### Checking signature for rekor-cli ${version}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
 cosign verify-blob \
     --key "https://raw.githubusercontent.com/sigstore/rekor/v${version}/release/release-cosign.pub" \
-    --signature "rekor-cli-linux-${alt_arch}.sig" \
-    "${prefix}/bin/rekor-cli"
-rm -f "rekor-cli-linux-${alt_arch}.sig"
+    --signature "${uniget_cache_download}/${filename}.sig" \
+    "${uniget_cache_download}/${filename}"
 
 echo "### Checking keyless signature for rekor-cli ${version}"
-curl --silent --show-error --location --fail --output "rekor-cli-linux-${alt_arch}-keyless.pem" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-cli-linux-${alt_arch}-keyless.pem"
-curl --silent --show-error --location --fail --output "rekor-cli-linux-${alt_arch}-keyless.sig" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-cli-linux-${alt_arch}-keyless.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}-keyless.pem" \
+    "${url}-keyless.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}-keyless.sig" \
+    "${url}-keyless.sig"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "rekor-cli-linux-${alt_arch}-keyless.pem" \
-    --signature "rekor-cli-linux-${alt_arch}-keyless.sig" \
+    --cert "${uniget_cache_download}/${filename}-keyless.pem" \
+    --signature "${uniget_cache_download}/${filename}-keyless.sig" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity "keyless@projectsigstore.iam.gserviceaccount.com" \
+    "${uniget_cache_download}/${filename}"
+
+echo "### Installing rekor-cli ${version}"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
     "${prefix}/bin/rekor-cli"
-rm -f "rekor-cli-linux-${alt_arch}-keyless.pem" "rekor-cli-linux-${alt_arch}-keyless.sig"
+
+echo "### Installing shell completion for rekor-cli ${version}"
+"${prefix}/bin/rekor-cli" completion bash >"${prefix}/share/bash-completion/completions/rekor-cli"
+"${prefix}/bin/rekor-cli" completion fish >"${prefix}/share/fish/vendor_completions.d/rekor-cli.fish"
+"${prefix}/bin/rekor-cli" completion zsh >"${prefix}/share/zsh/vendor-completions/_rekor-cli"
 
 "${prefix}/bin/rekor-cli" version
+EOF
 
-echo "### Installing rekor-server ${version}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/rekor-server" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-server-linux-${alt_arch}"
-chmod +x "${prefix}/bin/rekor-server"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sigstore/rekor/releases/download/v${version}/rekor-server-linux-${alt_arch}"
+filename="$(basename "${url}")"
+
+echo "### Downloading rekor-server ${version}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Installing shell completion for rekor-server ${version}"
 "${prefix}/bin/rekor-server" completion bash >"${prefix}/share/bash-completion/completions/rekor-server"
 "${prefix}/bin/rekor-server" completion fish >"${prefix}/share/fish/vendor_completions.d/rekor-server.fish"
 "${prefix}/bin/rekor-server" completion zsh >"${prefix}/share/zsh/vendor-completions/_rekor-server"
 
-echo "### Checking PGP signature for rekor-server ${version}"
-curl --silent --show-error --location --fail --output "rekor-server-linux-${alt_arch}.sig" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-server-linux-${alt_arch}.sig"
+echo "### Checking signature for rekor-server ${version}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
 cosign verify-blob \
     --key "https://raw.githubusercontent.com/sigstore/rekor/v${version}/release/release-cosign.pub" \
-    --signature "rekor-server-linux-${alt_arch}.sig" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     "${prefix}/bin/rekor-server"
-rm -f "rekor-server-linux-${alt_arch}.sig"
 
 echo "### Checking keyless signature for rekor-server ${version}"
-curl --silent --show-error --location --fail --output "rekor-server-linux-${alt_arch}-keyless.pem" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-server-linux-${alt_arch}-keyless.pem"
-curl --silent --show-error --location --fail --output "rekor-server-linux-${alt_arch}-keyless.sig" \
-    "https://github.com/sigstore/rekor/releases/download/v${version}/rekor-server-linux-${alt_arch}-keyless.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}-keyless.pem" \
+    "${url}-keyless.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}-keyless.sig" \
+    "${url}-keyless.sig"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "rekor-server-linux-${alt_arch}-keyless.pem" \
-    --signature "rekor-server-linux-${alt_arch}-keyless.sig" \
+    --cert "${uniget_cache_download}/${filename}-keyless.pem" \
+    --signature "${uniget_cache_download}/${filename}-keyless.sig" \
     --certificate-oidc-issuer https://accounts.google.com \
     --certificate-identity "keyless@projectsigstore.iam.gserviceaccount.com" \
     "${prefix}/bin/rekor-server"
-rm -f "rekor-server-linux-${alt_arch}-keyless.pem" "rekor-server-linux-${alt_arch}-keyless.sig"
+
+echo "### Installing rekor-server ${version}"
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/rekor-server"
 
 "${prefix}/bin/rekor-server" version
 EOF
\ No newline at end of file
diff --git a/tools/release-cli/Dockerfile.template b/tools/release-cli/Dockerfile.template
index 4441f89ccf..8d9bf0c9a1 100644
--- a/tools/release-cli/Dockerfile.template
+++ b/tools/release-cli/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://gitlab.com/gitlab-org/release-cli/-/releases/v${version}/downloads/bin/release-cli-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/release-cli" \
-    "https://gitlab.com/gitlab-org/release-cli/-/releases/v${version}/downloads/bin/release-cli-linux-${alt_arch}"
-chmod +x "${prefix}/bin/release-cli"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.com/gitlab-org/release-cli/-/releases/v${version}/downloads/bin/release-cli-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/release-cli"
+
 EOF
\ No newline at end of file
diff --git a/tools/reptyr/Dockerfile.template b/tools/reptyr/Dockerfile.template
index f49f612786..cdd50af47d 100644
--- a/tools/reptyr/Dockerfile.template
+++ b/tools/reptyr/Dockerfile.template
@@ -7,15 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     linux-headers
 EOF
 COPY --link --from=make / /usr/local/
 WORKDIR /tmp/github.com/nelhage/reptyr
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/nelhage/reptyr "reptyr-${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "reptyr-${version}" https://github.com/nelhage/reptyr .
 sed -E -i "s/#define REPTYR_VERSION \".+\"/#define REPTYR_VERSION \"${version}\"/" reptyr.h
diff --git a/tools/reveal.js/Dockerfile.template b/tools/reveal.js/Dockerfile.template
index 1ec22ba787..14e9f1dd09 100644
--- a/tools/reveal.js/Dockerfile.template
+++ b/tools/reveal.js/Dockerfile.template
@@ -5,10 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
+WORKDIR /uniget_bootstrap/share/reveal.js
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/hakimel/reveal.js/archive/refs/tags/${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/" --no-same-owner
-mv "${prefix}/share/reveal.js-${version}" "${prefix}/share/reveal.js"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/hakimel/reveal.js/archive/refs/tags/${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/ripgrep/Dockerfile.template b/tools/ripgrep/Dockerfile.template
index 667c2105f6..219ff1b893 100644
--- a/tools/ripgrep/Dockerfile.template
+++ b/tools/ripgrep/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "BurntSushi/ripgrep" "${version}" "ripgrep-${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/BurntSushi/ripgrep/releases/download/${version}/ripgrep-${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/BurntSushi/ripgrep/releases/download/${version}/ripgrep-${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "BurntSushi/ripgrep" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "ripgrep-${version}-x86_64-unknown-linux-musl/rg" \
     "ripgrep-${version}-x86_64-unknown-linux-musl/doc/rg.1" \
     "ripgrep-${version}-x86_64-unknown-linux-musl/complete"
@@ -21,9 +27,4 @@ mv "${prefix}/bin/complete/_rg" "${prefix}/share/zsh/vendor-completions/_ripgrep
 rm -rf \
     "${prefix}/bin/doc" \
     "${prefix}/bin/complete"
-EOF
-#RUN <<EOF
-#"${prefix}/bin/ripgrep" completion bash >"${prefix}/share/bash-completion/completions/ripgrep"
-#"${prefix}/bin/ripgrep" completion fish >"${prefix}/share/fish/vendor_completions.d/ripgrep.fish"
-#"${prefix}/bin/ripgrep" completion zsh >"${prefix}/share/zsh/vendor-completions/_ripgrep"
-#EOF
+EOF
\ No newline at end of file
diff --git a/tools/rke/Dockerfile.template b/tools/rke/Dockerfile.template
index 7a0457646d..4136bed54d 100644
--- a/tools/rke/Dockerfile.template
+++ b/tools/rke/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rancher/rke" "v${version}" "rke_linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/rke" \
-    "https://github.com/rancher/rke/releases/download/v${version}/rke_linux-${alt_arch}"
-chmod +x "${prefix}/bin/rke"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rancher/rke/releases/download/v${version}/rke_linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rancher/rke" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/rke"
+
 EOF
\ No newline at end of file
diff --git a/tools/rke2/Dockerfile.template b/tools/rke2/Dockerfile.template
index f4a95df321..98d1d79fee 100644
--- a/tools/rke2/Dockerfile.template
+++ b/tools/rke2/Dockerfile.template
@@ -7,15 +7,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 real_version="$(
     echo "${version}" \
     | sed -E 's/^([[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+)\.([[:digit:]]+)$/\1+rke2r\2/'
 )"
+url="https://github.com/rancher/rke2/releases/download/v${real_version}/rke2.linux-${alt_arch}.tar.gz"
+filename="$(basename "${url}")"
 
-check-github-release-asset "rancher/rke2" "v${real_version}" "rke2.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/rancher/rke2/releases/download/v${real_version}/rke2.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --no-same-owner \
+check-github-release-asset "rancher/rke2" "v${real_version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --no-same-owner \
     bin/rke2 \
     lib
 mv \
diff --git a/tools/rootlesskit/Dockerfile.template b/tools/rootlesskit/Dockerfile.template
index 8ef2611dea..0ff80009ee 100644
--- a/tools/rootlesskit/Dockerfile.template
+++ b/tools/rootlesskit/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rootless-containers/rootlesskit" "v${version}" "rootlesskit-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/rootless-containers/rootlesskit/releases/download/v${version}/rootlesskit-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rootless-containers/rootlesskit/releases/download/v${version}/rootlesskit-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rootless-containers/rootlesskit" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/runc/Dockerfile.template b/tools/runc/Dockerfile.template
index 199a6028f6..d93b604c7c 100644
--- a/tools/runc/Dockerfile.template
+++ b/tools/runc/Dockerfile.template
@@ -10,13 +10,20 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY --link --from=go-md2man / /usr/local/
-RUN <<EOF
-check-github-release-asset "opencontainers/runc" "v${version}" "runc.${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/runc" \
-    "https://github.com/opencontainers/runc/releases/download/v${version}/runc.${alt_arch}"
-chmod +x "${prefix}/bin/runc"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/opencontainers/runc/releases/download/v${version}/runc.${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "opencontainers/runc" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/runc"
+
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man8/runc-checkpoint.8.md" \
     "https://github.com/opencontainers/runc/raw/v${version}/man/runc-checkpoint.8.md"
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man8/runc-create.8.md" \
diff --git a/tools/runlike/Dockerfile.template b/tools/runlike/Dockerfile.template
index 1f5ef81d51..4f394b04d1 100644
--- a/tools/runlike/Dockerfile.template
+++ b/tools/runlike/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/runlike" --console-script runlike "runlike==${version}"
 EOF
diff --git a/tools/runq/Dockerfile.template b/tools/runq/Dockerfile.template
index 379da729e1..d54c2bb03e 100644
--- a/tools/runq/Dockerfile.template
+++ b/tools/runq/Dockerfile.template
@@ -9,22 +9,22 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=go / /usr/local/
-COPY --link --from=make / /usr/local/
-COPY --link --from=tini / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     libseccomp-dev \
     libseccomp-static
 EOF
+COPY --link --from=go / /usr/local/
+COPY --link --from=make / /usr/local/
+COPY --link --from=tini / /usr/local/
 WORKDIR /go/src/github.com/gotoz/runq
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" --recurse-submodules https://github.com/gotoz/runq .
 make -j$(nproc)
 EOF
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 mkdir -p /var/lib/runq/qemu
 mv /usr/local/bin/tini /usr/bin/docker-init
 export QEMU_ROOT="${prefix}/var/lib/runq"
diff --git a/tools/runtainer/Dockerfile.template b/tools/runtainer/Dockerfile.template
index c14d3b0259..c7949e6601 100644
--- a/tools/runtainer/Dockerfile.template
+++ b/tools/runtainer/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "plumber-cd/runtainer" "v${version}" "runtainer-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/runtainer" \
-    "https://github.com/plumber-cd/runtainer/releases/download/v${version}/runtainer-linux-${alt_arch}"
-chmod +x "${prefix}/bin/runtainer"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/plumber-cd/runtainer/releases/download/v${version}/runtainer-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "plumber-cd/runtainer" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/runtainer"
+
 
 "${prefix}/bin/runtainer" completion bash >"${prefix}/share/bash-completion/completions/runtainer"
 "${prefix}/bin/runtainer" completion fish >"${prefix}/share/fish/vendor_completions.d/runtainer.fish"
diff --git a/tools/rush/Dockerfile.template b/tools/rush/Dockerfile.template
index 88c0470b38..3d410bb674 100644
--- a/tools/rush/Dockerfile.template
+++ b/tools/rush/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "shenwei356/rush" "v${version}" "rush_linux_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/shenwei356/rush/releases/download/v${version}/rush_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/shenwei356/rush/releases/download/v${version}/rush_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "shenwei356/rush" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/rust/Dockerfile.template b/tools/rust/Dockerfile.template
index ff1ea284c0..1c6da0b452 100644
--- a/tools/rust/Dockerfile.template
+++ b/tools/rust/Dockerfile.template
@@ -11,7 +11,7 @@ COPY <<EOF /uniget_bootstrap/etc/profile.d/rust.sh.go-template
 export CARGO_HOME="{{ .Target }}/cargo"
 export RUSTUP_HOME="{{ .Target }}/rustup"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 rustup_version="$(
     curl --silent --fail --url https://api.github.com/repos/rust-lang/rustup/tags \
     | jq --raw-output '.[].name' \
@@ -31,7 +31,7 @@ export RUSTUP_HOME="${prefix}/rustup"
 "${prefix}/cargo/bin/cargo" --version
 "${prefix}/cargo/bin/rustc" --version
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 "${prefix}/cargo/bin/rustup" completions bash rustup >"${prefix}/share/bash-completion/completions/rustup"
 "${prefix}/cargo/bin/rustup" completions fish rustup >"${prefix}/share/fish/vendor_completions.d/rustup.fish"
 "${prefix}/cargo/bin/rustup" completions zsh rustup >"${prefix}/share/zsh/vendor-completions/_rustup"
@@ -43,7 +43,7 @@ cp \
     "${prefix}/rustup/toolchains/${version}-${arch}-unknown-linux-gnu/share/zsh/site-functions/_cargo" \
     "${prefix}/share/zsh/vendor-completions/"
 EOF
-RUN <<EOF
+RUN <<EOF # no download cache
 find "${prefix}/cargo/bin" -type f -executable \
 | while read -r FILE; do
     ln --symbolic --relative --force "${prefix}/cargo/bin/$(basename "${FILE}")" "${prefix}/bin/"
diff --git a/tools/salami/Dockerfile.template b/tools/salami/Dockerfile.template
index ea5240b139..fef7715ac2 100644
--- a/tools/salami/Dockerfile.template
+++ b/tools/salami/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "petrgazarov/salami" "${version}" "salami-${version}-linux-${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/salami" \
-    "https://github.com/petrgazarov/salami/releases/download/${version}/salami-${version}-linux-${arch_suffix}"
-chmod +x "${prefix}/bin/salami"
+url="https://github.com/petrgazarov/salami/releases/download/${version}/salami-${version}-linux-${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "petrgazarov/salami" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/salami"
+
 EOF
\ No newline at end of file
diff --git a/tools/saml2aws/Dockerfile.template b/tools/saml2aws/Dockerfile.template
index 93e5dcf36b..2b90f9ca94 100644
--- a/tools/saml2aws/Dockerfile.template
+++ b/tools/saml2aws/Dockerfile.template
@@ -7,10 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-echo "### Setting architecture string for ${TARGETPLATFORM}"
-check-github-release-asset "Versent/saml2aws" "v${version}" "saml2aws_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/Versent/saml2aws/releases/download/v${version}/saml2aws_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/Versent/saml2aws/releases/download/v${version}/saml2aws_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "Versent/saml2aws" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     saml2aws
 EOF
\ No newline at end of file
diff --git a/tools/sass-dart/Dockerfile.template b/tools/sass-dart/Dockerfile.template
index 84602ecf18..51cdfb2e5e 100644
--- a/tools/sass-dart/Dockerfile.template
+++ b/tools/sass-dart/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,16 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "sass/dart-sass" "${version}" "dart-sass-${version}-linux-${arch_suffix}-musl.tar.gz"
+url="https://github.com/sass/dart-sass/releases/download/${version}/dart-sass-${version}-linux-${arch_suffix}-musl.tar.gz"
+filenamE="(basename "${url}")"
+
+check-github-release-asset "sass/dart-sass" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/libexec/dart-sass"
-curl --silent --show-error --location --fail "https://github.com/sass/dart-sass/releases/download/${version}/dart-sass-${version}-linux-${arch_suffix}-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/libexec/dart-sass" --strip-components=2 --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/libexec/dart-sass" --strip-components=2 --no-same-owner \
     dart-sass/src/sass.snapshot
 EOF
 COPY --chmod=0755 <<EOF /uniget_bootstrap/bin/sass
diff --git a/tools/sass/Dockerfile.template b/tools/sass/Dockerfile.template
index 895eaa7884..d624a038ee 100644
--- a/tools/sass/Dockerfile.template
+++ b/tools/sass/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/sass
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "sass@${version}"
diff --git a/tools/savvy/Dockerfile.template b/tools/savvy/Dockerfile.template
index 15e91d8ae9..1dc1b5be50 100644
--- a/tools/savvy/Dockerfile.template
+++ b/tools/savvy/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,17 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "getsavvyinc/savvy-cli" "${version}" "savvy_linux_${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/savvy" \
-    "https://github.com/getsavvyinc/savvy-cli/releases/download/${version}/savvy_linux_${arch_suffix}"
-chmod +x "${prefix}/bin/savvy"
+url="https://github.com/getsavvyinc/savvy-cli/releases/download/${version}/savvy_linux_${arch_suffix}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "getsavvyinc/savvy-cli" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/savvy"
+
 
 "${prefix}/bin/savvy" completion bash >"${prefix}/share/bash-completion/completions/savvy"
 "${prefix}/bin/savvy" completion fish >"${prefix}/share/fish/vendor_completions.d/savvy.fish"
diff --git a/tools/sbom-operator/Dockerfile.template b/tools/sbom-operator/Dockerfile.template
index 1817a17a5f..6fd1043906 100644
--- a/tools/sbom-operator/Dockerfile.template
+++ b/tools/sbom-operator/Dockerfile.template
@@ -10,21 +10,26 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ckotzbauer/sbom-operator" "${version}" "sbom-operator_${version}_linux_${alt_arch}.tar.gz"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ckotzbauer/sbom-operator/releases/download/${version}/sbom-operator_${version}_linux_${alt_arch}.tar.gz"
+filename="(basename "${url}")"
 
-echo "### Downloading sbom-operator ${version}"
-curl --silent --show-error --location --fail --remote-name "https://github.com/ckotzbauer/sbom-operator/releases/download/${version}/sbom-operator_${version}_linux_${alt_arch}.tar.gz"
-echo "    SHA256 checksum: $(sha256sum sbom-operator_${version}_linux_${alt_arch}.tar.gz | cut -d' ' -f1)"
+echo "### Downloading sbom-operator ${version} for ${alt_arch}"
+check-github-release-asset "ckotzbauer/sbom-operator" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+echo "    SHA256 checksum: $(sha256sum ${uniget_cache_download}/${filename} | cut -d' ' -f1)"
 
 echo "### Downloading signature and certificate"
-curl --silent --show-error --location --fail --remote-name "https://github.com/ckotzbauer/sbom-operator/releases/download/${version}/sbom-operator_${version}_linux_${alt_arch}.tar.gz.sig"
-curl --silent --show-error --location --fail --remote-name "https://github.com/ckotzbauer/sbom-operator/releases/download/${version}/sbom-operator_${version}_linux_${alt_arch}.tar.gz.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+    "${url}.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.pem" \
+    "${url}.pem"
 
 echo "### Verifying signature"
-COSIGN_EXPERIMENTAL=1 cosign verify-blob "sbom-operator_${version}_linux_${alt_arch}.tar.gz" \
-    --certificate "sbom-operator_${version}_linux_${alt_arch}.tar.gz.pem" \
-    --signature "sbom-operator_${version}_linux_${alt_arch}.tar.gz.sig" \
+COSIGN_EXPERIMENTAL=1 cosign verify-blob "${uniget_cache_download}/${filename}" \
+    --certificate "${uniget_cache_download}/${filename}.pem" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity-regexp 'https://github.com/ckotzbauer/actions-toolkit/.github/workflows/toolkit-release-goreleaser.yml@.+' \
     --certificate-github-workflow-repository ckotzbauer/sbom-operator \
@@ -32,6 +37,8 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob "sbom-operator_${version}_linux_${alt_a
     --certificate-github-workflow-ref refs/heads/main \
     --certificate-github-workflow-trigger workflow_dispatch
 
-tar --extract --gzip --file "sbom-operator_${version}_linux_${alt_arch}.tar.gz" --directory="${prefix}/bin/" --no-same-owner \
+echo "### Installing sbom-operator ${version}"
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     sbom-operator
 EOF
\ No newline at end of file
diff --git a/tools/sbom-tool/Dockerfile.template b/tools/sbom-tool/Dockerfile.template
index 651de17dcf..83341f508f 100644
--- a/tools/sbom-tool/Dockerfile.template
+++ b/tools/sbom-tool/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "microsoft/sbom-tool" "v${version}" "sbom-tool-linux-x64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sbom-tool" \
-    "https://github.com/microsoft/sbom-tool/releases/download/v${version}/sbom-tool-linux-x64"
-chmod +x "${prefix}/bin/sbom-tool"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/microsoft/sbom-tool/releases/download/v${version}/sbom-tool-linux-x64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "microsoft/sbom-tool" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sbom-tool"
+
 EOF
\ No newline at end of file
diff --git a/tools/sbom-utility/Dockerfile.template b/tools/sbom-utility/Dockerfile.template
index 47a8a701d2..050a5ca536 100644
--- a/tools/sbom-utility/Dockerfile.template
+++ b/tools/sbom-utility/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "CycloneDX/sbom-utility" "v${version}" "sbom-utility-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/CycloneDX/sbom-utility/releases/download/v${version}/sbom-utility-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/CycloneDX/sbom-utility/releases/download/v${version}/sbom-utility-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "CycloneDX/sbom-utility" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     sbom-utility \
     config.json \
     custom.json \
diff --git a/tools/sbom2doc/Dockerfile.template b/tools/sbom2doc/Dockerfile.template
index 81d25a040d..4d44d745ee 100644
--- a/tools/sbom2doc/Dockerfile.template
+++ b/tools/sbom2doc/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/sbom2doc" --console-script sbom2doc "sbom2doc==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/sbom2dot/Dockerfile.template b/tools/sbom2dot/Dockerfile.template
index 2d81648177..cf86835465 100644
--- a/tools/sbom2dot/Dockerfile.template
+++ b/tools/sbom2dot/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/sbom2dot" --console-script sbom2dot "sbom2dot==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/sbomasm/Dockerfile.template b/tools/sbomasm/Dockerfile.template
index b62bdd4b6f..59be601217 100644
--- a/tools/sbomasm/Dockerfile.template
+++ b/tools/sbomasm/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "interlynk-io/sbomasm" "v${version}" "sbomasm-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sbomasm" \
-    "https://github.com/interlynk-io/sbomasm/releases/download/v${version}/sbomasm-linux-${alt_arch}"
-chmod +x "${prefix}/bin/sbomasm"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/interlynk-io/sbomasm/releases/download/v${version}/sbomasm-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "interlynk-io/sbomasm" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sbomasm"
+
 
 "${prefix}/bin/sbomasm" completion bash >"${prefix}/share/bash-completion/completions/sbomasm"
 "${prefix}/bin/sbomasm" completion fish >"${prefix}/share/fish/vendor_completions.d/sbomasm.fish"
diff --git a/tools/sbomdiff/Dockerfile.template b/tools/sbomdiff/Dockerfile.template
index 6089cbf8f2..1364d52fcf 100644
--- a/tools/sbomdiff/Dockerfile.template
+++ b/tools/sbomdiff/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/sbomdiff" --console-script sbomdiff "sbomdiff==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/sbomex/Dockerfile.template b/tools/sbomex/Dockerfile.template
index b1940b32f5..b4e4e8722b 100644
--- a/tools/sbomex/Dockerfile.template
+++ b/tools/sbomex/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "interlynk-io/sbomex" "v${version}" "sbomex-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sbomex" \
-    "https://github.com/interlynk-io/sbomex/releases/download/v${version}/sbomex-linux-${alt_arch}"
-chmod +x "${prefix}/bin/sbomex"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/interlynk-io/sbomex/releases/download/v${version}/sbomex-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "interlynk-io/sbomex" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sbomex"
+
 
 "${prefix}/bin/sbomex" completion bash >"${prefix}/share/bash-completion/completions/sbomex"
 "${prefix}/bin/sbomex" completion fish >"${prefix}/share/fish/vendor_completions.d/sbomex.fish"
diff --git a/tools/sbomgr/Dockerfile.template b/tools/sbomgr/Dockerfile.template
index 74bf00ae3b..242b5a81f1 100644
--- a/tools/sbomgr/Dockerfile.template
+++ b/tools/sbomgr/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "interlynk-io/sbomgr" "v${version}" "sbomgr-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sbomgr" \
-    "https://github.com/interlynk-io/sbomgr/releases/download/v${version}/sbomgr-linux-${alt_arch}"
-chmod +x "${prefix}/bin/sbomgr"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/interlynk-io/sbomgr/releases/download/v${version}/sbomgr-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "interlynk-io/sbomgr" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sbomgr"
+
 
 "${prefix}/bin/sbomgr" completion bash >"${prefix}/share/bash-completion/completions/sbomgr"
 "${prefix}/bin/sbomgr" completion fish >"${prefix}/share/fish/vendor_completions.d/sbomgr.fish"
diff --git a/tools/sbomqs/Dockerfile.template b/tools/sbomqs/Dockerfile.template
index d4b73d2421..1390feff8f 100644
--- a/tools/sbomqs/Dockerfile.template
+++ b/tools/sbomqs/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "interlynk-io/sbomqs" "v${version}" "sbomqs-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sbomqs" \
-    "https://github.com/interlynk-io/sbomqs/releases/download/v${version}/sbomqs-linux-${alt_arch}"
-chmod +x "${prefix}/bin/sbomqs"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/interlynk-io/sbomqs/releases/download/v${version}/sbomqs-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "interlynk-io/sbomqs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sbomqs"
+
 
 "${prefix}/bin/sbomqs" completion bash >"${prefix}/share/bash-completion/completions/sbomqs"
 "${prefix}/bin/sbomqs" completion fish >"${prefix}/share/fish/vendor_completions.d/sbomqs.fish"
diff --git a/tools/sbomtools/Dockerfile.template b/tools/sbomtools/Dockerfile.template
index b1c80f7bd4..b4e7a37b78 100644
--- a/tools/sbomtools/Dockerfile.template
+++ b/tools/sbomtools/Dockerfile.template
@@ -12,7 +12,7 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 for BINARY in sbomgrep sbomls sbomrm sbomupdate; do
     shiv --output-file "${prefix}/bin/${BINARY}" --console-script "${BINARY}" "sbomtools==${version}"
 done
diff --git a/tools/sbt/Dockerfile.template b/tools/sbt/Dockerfile.template
index 46f43006a8..efc2984e57 100644
--- a/tools/sbt/Dockerfile.template
+++ b/tools/sbt/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "sbt/sbt" "v${version}" "sbt-${version}.tgz"
 mkdir -p "${prefix}/opt/sbt"
 curl --silent --show-error --location --fail "https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz" \
diff --git a/tools/scala/Dockerfile.template b/tools/scala/Dockerfile.template
index 716a6b9fd2..4c2a19f199 100644
--- a/tools/scala/Dockerfile.template
+++ b/tools/scala/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://downloads.lightbend.com/scala/${version}/scala-${version}.tgz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/opt/scala"
-curl --silent --show-error --location --fail "https://downloads.lightbend.com/scala/${version}/scala-${version}.tgz" \
-| tar --extract --gzip --directory="${prefix}/opt/scala" --strip-components=1 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/opt/scala" --strip-components=1 --no-same-owner
 ln --symbolic --relative --force "${prefix}/opt/scala/bin/scala" "${prefix}/bin/scala"
 EOF
\ No newline at end of file
diff --git a/tools/scc/Dockerfile.template b/tools/scc/Dockerfile.template
index f96b63a284..dd2cbdcccc 100644
--- a/tools/scc/Dockerfile.template
+++ b/tools/scc/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "boyter/scc" "v${version}" "scc_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/boyter/scc/releases/download/v${version}/scc_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading scc ${version}"
-curl --silent --show-error --location --fail "https://github.com/boyter/scc/releases/download/v${version}/scc_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "boyter/scc" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     scc
 EOF
\ No newline at end of file
diff --git a/tools/scorecard/Dockerfile.template b/tools/scorecard/Dockerfile.template
index 01fea4c02f..50bd7efc12 100644
--- a/tools/scorecard/Dockerfile.template
+++ b/tools/scorecard/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ossf/scorecard" "v${version}" "scorecard_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ossf/scorecard/releases/download/v${version}/scorecard_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ossf/scorecard/releases/download/v${version}/scorecard_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ossf/scorecard" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     scorecard-linux-${alt_arch}
 mv "${prefix}/bin/scorecard-linux-${alt_arch}" "${prefix}/bin/scorecard"
 "${prefix}/bin/scorecard" completion bash | sed 's|./scorecard|scorecard|g' >"${prefix}/share/bash-completion/completions/scorecard"
diff --git a/tools/sd/Dockerfile.template b/tools/sd/Dockerfile.template
index 5413230b4d..df2f362791 100644
--- a/tools/sd/Dockerfile.template
+++ b/tools/sd/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "chmln/sd" "v${version}" "sd-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/chmln/sd/releases/download/v${version}/sd-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/chmln/sd/releases/download/v${version}/sd-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "chmln/sd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner
 
 mv "${prefix}/bin/completions/sd.bash" "${prefix}/share/bash-completion/completions/sd"
 mv "${prefix}/bin/completions/sd.fish" "${prefix}/share/fish/vendor_completions.d/sd.fish"
diff --git a/tools/sealer/Dockerfile.template b/tools/sealer/Dockerfile.template
index 105681d260..3b8ff3ba3c 100644
--- a/tools/sealer/Dockerfile.template
+++ b/tools/sealer/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "sealerio/sealer" "v${version}" "sealer-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/sealerio/sealer/releases/download/v${version}/sealer-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sealerio/sealer/releases/download/v${version}/sealer-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sealerio/sealer" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 check-github-release-asset "sealerio/sealer" "v${version}" "seautil-v${version}-linux-${alt_arch}.tar.gz"
 curl --silent --show-error --location --fail "https://github.com/sealerio/sealer/releases/download/v${version}/seautil-v${version}-linux-${alt_arch}.tar.gz" \
diff --git a/tools/secretize/Dockerfile.template b/tools/secretize/Dockerfile.template
index 5056203114..8094187c26 100644
--- a/tools/secretize/Dockerfile.template
+++ b/tools/secretize/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "bbl/secretize" "${version}" "secretize-${version}-linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/bbl/secretize/releases/download/${version}/secretize-${version}-linux-amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/bbl/secretize/releases/download/${version}/secretize-${version}-linux-amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "bbl/secretize" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/semgrep/Dockerfile.template b/tools/semgrep/Dockerfile.template
index 32873ebc54..fe825b9719 100644
--- a/tools/semgrep/Dockerfile.template
+++ b/tools/semgrep/Dockerfile.template
@@ -13,6 +13,6 @@ COPY --link --from=shiv / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/semgrep
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/semgrep" --console-script semgrep "semgrep==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/semver/Dockerfile.template b/tools/semver/Dockerfile.template
index bb09a68a66..46aa2a8203 100644
--- a/tools/semver/Dockerfile.template
+++ b/tools/semver/Dockerfile.template
@@ -7,8 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/semver" \
-    "https://github.com/fsaintjacques/semver-tool/raw/${version}/src/semver"
-chmod +x "${prefix}/bin/semver"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/fsaintjacques/semver-tool/raw/${version}/src/semver"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/semver"
 EOF
\ No newline at end of file
diff --git a/tools/serverless/Dockerfile.template b/tools/serverless/Dockerfile.template
index 987ffdd7a0..8373c76108 100644
--- a/tools/serverless/Dockerfile.template
+++ b/tools/serverless/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/serverless
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "serverless@${version}"
diff --git a/tools/shdotenv/Dockerfile.template b/tools/shdotenv/Dockerfile.template
index e5dc025f47..011d6a2ccf 100644
--- a/tools/shdotenv/Dockerfile.template
+++ b/tools/shdotenv/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ko1nksm/shdotenv" "v${version}" "shdotenv"
-curl --silent --show-error --location --fail --output "${prefix}/bin/shdotenv" \
-    "https://github.com/ko1nksm/shdotenv/releases/download/v${version}/shdotenv"
-chmod +x "${prefix}/bin/shdotenv"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ko1nksm/shdotenv/releases/download/v${version}/shdotenv"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ko1nksm/shdotenv" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/shdotenv"
+
 EOF
\ No newline at end of file
diff --git a/tools/shell-gpt/Dockerfile.template b/tools/shell-gpt/Dockerfile.template
index 5d030b2dd0..637394261c 100644
--- a/tools/shell-gpt/Dockerfile.template
+++ b/tools/shell-gpt/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/sgpt" --console-script sgpt "shell-gpt==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/shellcheck/Dockerfile.template b/tools/shellcheck/Dockerfile.template
index 52f6d4366b..89cd8f27d5 100644
--- a/tools/shellcheck/Dockerfile.template
+++ b/tools/shellcheck/Dockerfile.template
@@ -10,10 +10,16 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --from=go-md2man / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "koalaman/shellcheck" "v${version}" "shellcheck-v${version}.linux.${arch}.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.linux.${arch}.tar.xz" \
-| tar --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.linux.${arch}.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "koalaman/shellcheck" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     shellcheck-v${version}/shellcheck
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/shellcheck.1.md" \
     "https://github.com/koalaman/shellcheck/raw/v${version}/shellcheck.1.md"
diff --git a/tools/shiv/Dockerfile.template b/tools/shiv/Dockerfile.template
index 188b4f07f9..f7c66dbc1a 100644
--- a/tools/shiv/Dockerfile.template
+++ b/tools/shiv/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "linkedin/shiv" "${version}" "shiv"
-curl --silent --show-error --location --fail --output "${prefix}/bin/shiv" \
-    "https://github.com/linkedin/shiv/releases/download/${version}/shiv"
-chmod +x "${prefix}/bin/shiv"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/linkedin/shiv/releases/download/${version}/shiv"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "linkedin/shiv" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/shiv"
+
 EOF
\ No newline at end of file
diff --git a/tools/shortnames/Dockerfile.template b/tools/shortnames/Dockerfile.template
index e9e2006384..2e4fc1a8b9 100644
--- a/tools/shortnames/Dockerfile.template
+++ b/tools/shortnames/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 curl --silent --show-error --location --fail --output "${prefix}/etc/containers/registries.conf.d/00-shortnames.conf" --create-dirs \
     "https://github.com/containers/shortnames/raw/v${version}/shortnames.conf"
 EOF
\ No newline at end of file
diff --git a/tools/sish/Dockerfile.template b/tools/sish/Dockerfile.template
index 84ba247d24..9e3b67a47c 100644
--- a/tools/sish/Dockerfile.template
+++ b/tools/sish/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "antoniomika/sish" "v${version}" "sish-${version}.linux-amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/antoniomika/sish/releases/download/v${version}/sish-${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/antoniomika/sish/releases/download/v${version}/sish-${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "antoniomika/sish" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     sish-${version}.linux-${alt_arch}/sish
 EOF
\ No newline at end of file
diff --git a/tools/skate/Dockerfile.template b/tools/skate/Dockerfile.template
index 267bd3d446..1de3fbfe24 100644
--- a/tools/skate/Dockerfile.template
+++ b/tools/skate/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/skate" "v${version}" "skate_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/skate/releases/download/v${version}/skate_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/skate/releases/download/v${version}/skate_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/skate" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "skate_${version}_Linux_${arch_suffix}/skate"
 
 "${prefix}/bin/skate" man >"${prefix}/share/man/man1/skate.1"
diff --git a/tools/skopeo/Dockerfile.template b/tools/skopeo/Dockerfile.template
index 5ef657289d..3feaa36fce 100644
--- a/tools/skopeo/Dockerfile.template
+++ b/tools/skopeo/Dockerfile.template
@@ -8,11 +8,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=go / /usr/local/
-COPY --link --from=go-md2man / /usr/local/
-ARG name
-ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     git \
@@ -35,10 +31,14 @@ apt-get -y install --no-install-recommends \
     iptables \
     bash
 EOF
+COPY --link --from=go / /usr/local/
+COPY --link --from=go-md2man / /usr/local/
 WORKDIR $GOPATH/src/github.com/containers/skopeo
+ARG name
+ARG version
 RUN git clone --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/containers/skopeo.git .
 ENV CGO_ENABLED=0
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 mkdir -p "${prefix}/share/man/man1"
 make -j$(nproc) bin/skopeo EXTRA_LDFLAGS="-s -w -extldflags '-static'" BUILDTAGS=containers_image_openpgp GO_DYN_FLAGS=
 make -j$(nproc) docs GOMD2MAN=go-md2man
diff --git a/tools/slides/Dockerfile.template b/tools/slides/Dockerfile.template
index 1c527b5073..676669d144 100644
--- a/tools/slides/Dockerfile.template
+++ b/tools/slides/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "maaslalani/slides" "v${version}" "slides_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/maaslalani/slides/releases/download/v${version}/slides_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/maaslalani/slides/releases/download/v${version}/slides_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "maaslalani/slides" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     slides
 EOF
\ No newline at end of file
diff --git a/tools/slirp4netns/Dockerfile.template b/tools/slirp4netns/Dockerfile.template
index a8cbf6fdd0..e7f821722c 100644
--- a/tools/slirp4netns/Dockerfile.template
+++ b/tools/slirp4netns/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "rootless-containers/slirp4netns" "v${version}" "slirp4netns-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/slirp4netns" \
-    "https://github.com/rootless-containers/slirp4netns/releases/download/v${version}/slirp4netns-${arch}"
-chmod +x "${prefix}/bin/slirp4netns"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rootless-containers/slirp4netns/releases/download/v${version}/slirp4netns-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "rootless-containers/slirp4netns" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/slirp4netns"
+
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/slirp4netns.1" \
     "https://github.com/rootless-containers/slirp4netns/raw/v${version}/slirp4netns.1"
 EOF
\ No newline at end of file
diff --git a/tools/sloop/Dockerfile.template b/tools/sloop/Dockerfile.template
index 03efab221c..3da2041811 100644
--- a/tools/sloop/Dockerfile.template
+++ b/tools/sloop/Dockerfile.template
@@ -16,7 +16,7 @@ ARG version
 ENV CGO_ENABLED=0 \
     GO111MODULE=auto \
     GOBIN=${prefix}/bin
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/salesforce/sloop .
 make -j$(nproc)
 EOF
\ No newline at end of file
diff --git a/tools/slsa-verifier/Dockerfile.template b/tools/slsa-verifier/Dockerfile.template
index fbb2a0a8bb..4e4549c97c 100644
--- a/tools/slsa-verifier/Dockerfile.template
+++ b/tools/slsa-verifier/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "slsa-framework/slsa-verifier" "v${version}" "slsa-verifier-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/slsa-verifier" \
-    "https://github.com/slsa-framework/slsa-verifier/releases/download/v${version}/slsa-verifier-linux-${alt_arch}"
-chmod +x "${prefix}/bin/slsa-verifier"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/slsa-framework/slsa-verifier/releases/download/v${version}/slsa-verifier-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "slsa-framework/slsa-verifier" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/slsa-verifier"
+
 EOF
\ No newline at end of file
diff --git a/tools/socat/Dockerfile.template b/tools/socat/Dockerfile.template
index 350b954828..591a408159 100644
--- a/tools/socat/Dockerfile.template
+++ b/tools/socat/Dockerfile.template
@@ -11,10 +11,17 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/socat
 ARG name
 ARG version
-RUN <<EOF
-check-download "http://www.dest-unreach.org/socat/download/socat-${version}.tar.gz"
-curl --silent --show-error --location --fail "http://www.dest-unreach.org/socat/download/socat-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="http://www.dest-unreach.org/socat/download/socat-${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 autoconf
 ./configure
 make -j$(nproc) LDFLAGS=-static
diff --git a/tools/soci-snapshotter/Dockerfile.template b/tools/soci-snapshotter/Dockerfile.template
index 326fff9639..ed7dee2a7c 100644
--- a/tools/soci-snapshotter/Dockerfile.template
+++ b/tools/soci-snapshotter/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "awslabs/soci-snapshotter" "v${version}" "soci-snapshotter-${version}-linux-${alt_arch}-static.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/awslabs/soci-snapshotter/releases/download/v${version}/soci-snapshotter-${version}-linux-${alt_arch}-static.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/awslabs/soci-snapshotter/releases/download/v${version}/soci-snapshotter-${version}-linux-${alt_arch}-static.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "awslabs/soci-snapshotter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     soci \
     soci-snapshotter-grpc
 EOF
\ No newline at end of file
diff --git a/tools/soft-serve/Dockerfile.template b/tools/soft-serve/Dockerfile.template
index bf860dbe34..3a0c31223b 100644
--- a/tools/soft-serve/Dockerfile.template
+++ b/tools/soft-serve/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/soft-serve" "v${version}" "soft-serve_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/soft-serve/releases/download/v${version}/soft-serve_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+url="https://github.com/charmbracelet/soft-serve/releases/download/v${version}/soft-serve_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "charmbracelet/soft-serve" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "soft-serve_${version}_Linux_${arch_suffix}/soft" \
     "soft-serve_${version}_Linux_${arch_suffix}/completions" \
     "soft-serve_${version}_Linux_${arch_suffix}/manpages"
diff --git a/tools/sonar-scanner/Dockerfile.template b/tools/sonar-scanner/Dockerfile.template
index 6a182f21ed..8f2e7ac8bb 100644
--- a/tools/sonar-scanner/Dockerfile.template
+++ b/tools/sonar-scanner/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${arch}" in
     x86_64)
         export arch_suffix=x64
@@ -24,8 +24,14 @@ echo "    Using ${arch_suffix}"
 
 url="https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${version}-linux-${arch_suffix}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/opt" "${filename}"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt" "${uniget_cache_download}/${filename}"
+
 mv "${prefix}/opt/sonar-scanner-${version}-linux-${arch_suffix}" "${prefix}/opt/sonar-scanner"
 sed -i 's/use_embedded_jre=true/use_embedded_jre=false/' "${prefix}/opt/sonar-scanner/bin/sonar-scanner"
 rm -rf "${prefix}/opt/sonar-scanner/jre"
diff --git a/tools/sonobuoy/Dockerfile.template b/tools/sonobuoy/Dockerfile.template
index 756f833ea5..bfa9636308 100644
--- a/tools/sonobuoy/Dockerfile.template
+++ b/tools/sonobuoy/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vmware-tanzu/sonobuoy" "v${version}" "sonobuoy_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/vmware-tanzu/sonobuoy/releases/download/v${version}/sonobuoy_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/vmware-tanzu/sonobuoy/releases/download/v${version}/sonobuoy_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "vmware-tanzu/sonobuoy" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     sonobuoy
 
 "${prefix}/bin/sonobuoy" completion bash >"${prefix}/share/bash-completion/completions/sonobuoy"
diff --git a/tools/sops/Dockerfile.template b/tools/sops/Dockerfile.template
index 4be98eeff8..84d15830a2 100644
--- a/tools/sops/Dockerfile.template
+++ b/tools/sops/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "getsops/sops" "v${version}" "sops-v${version}.linux.${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sops" \
-    "https://github.com/getsops/sops/releases/download/v${version}/sops-v${version}.linux.${alt_arch}"
-chmod +x "${prefix}/bin/sops"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/getsops/sops/releases/download/v${version}/sops-v${version}.linux.${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "getsops/sops" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sops"
+
 EOF
\ No newline at end of file
diff --git a/tools/sotp/Dockerfile.template b/tools/sotp/Dockerfile.template
index a318837f05..ed7c0ebc93 100644
--- a/tools/sotp/Dockerfile.template
+++ b/tools/sotp/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/getsops/sotp
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/getsops/sotp" "${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/getsops/sotp .
 go get -u ./...
diff --git a/tools/source-sans/Dockerfile.template b/tools/source-sans/Dockerfile.template
index 08af0c4154..d0db5eb19b 100644
--- a/tools/source-sans/Dockerfile.template
+++ b/tools/source-sans/Dockerfile.template
@@ -7,20 +7,24 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 mkdir -p "${prefix}/share/source-sans"
 
 url="https://github.com/adobe-fonts/source-sans/releases/download/${version}R/WOFF-source-sans-${version}R.zip"
-check-github-release-asset "adobe-fonts/source-sans" "${version}R" "WOFF-source-sans-${version}R.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/share/source-sans" "${filename}"
+check-github-release-asset "adobe-fonts/source-sans" "${version}R" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/share/source-sans" "${uniget_cache_download}/${filename}"
 
 url="https://github.com/adobe-fonts/source-sans/releases/download/${version}R/WOFF2-source-sans-${version}R.zip"
-check-github-release-asset "adobe-fonts/source-sans" "${version}R" "WOFF2-source-sans-${version}R.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/share/source-sans" "${filename}"
+check-github-release-asset "adobe-fonts/source-sans" "${version}R" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/share/source-sans" "${uniget_cache_download}/${filename}"
 
 rm -rf "${prefix}/share/source-sans/__MACOSX"
 find "${prefix}/share/source-sans" -type f -name \.DS_Store -delete
diff --git a/tools/spc/Dockerfile.template b/tools/spc/Dockerfile.template
index e02a7708ac..ef74bee208 100644
--- a/tools/spc/Dockerfile.template
+++ b/tools/spc/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "crazywhalecc/static-php-cli" "${version}" "spc-linux-${arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/crazywhalecc/static-php-cli/releases/download/${version}/spc-linux-${arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/crazywhalecc/static-php-cli/releases/download/${version}/spc-linux-${arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "crazywhalecc/static-php-cli" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/spc" completion bash >"${prefix}/share/bash-completion/completions/spc"
 "${prefix}/bin/spc" completion fish >"${prefix}/share/fish/vendor_completions.d/spc.fish"
diff --git a/tools/spdx-sbom-generator/Dockerfile.template b/tools/spdx-sbom-generator/Dockerfile.template
index 22709832cf..7936f3e301 100644
--- a/tools/spdx-sbom-generator/Dockerfile.template
+++ b/tools/spdx-sbom-generator/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "opensbom-generator/spdx-sbom-generator" "v${version}" "spdx-sbom-generator-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/opensbom-generator/spdx-sbom-generator/releases/download/v${version}/spdx-sbom-generator-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/opensbom-generator/spdx-sbom-generator/releases/download/v${version}/spdx-sbom-generator-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "opensbom-generator/spdx-sbom-generator" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/speex/Dockerfile.template b/tools/speex/Dockerfile.template
index be4e322729..cd03a1b23a 100644
--- a/tools/speex/Dockerfile.template
+++ b/tools/speex/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/speex
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "Speex-${version}" https://gitlab.xiph.org/xiph/speex .
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-shared --enable-static
diff --git a/tools/speexdsp/Dockerfile.template b/tools/speexdsp/Dockerfile.template
index 6ee83d17d0..9dea3fc6fa 100644
--- a/tools/speexdsp/Dockerfile.template
+++ b/tools/speexdsp/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/speexdsp
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "SpeexDSP-${version}" https://gitlab.xiph.org/xiph/speexdsp .
 ./autogen.sh
 ./configure --prefix="${prefix}" --enable-shared --enable-static
diff --git a/tools/spiffe-vault/Dockerfile.template b/tools/spiffe-vault/Dockerfile.template
index f7a1ddf623..959d5f7169 100644
--- a/tools/spiffe-vault/Dockerfile.template
+++ b/tools/spiffe-vault/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "philips-labs/spiffe-vault" "v${version}" "spiffe-vault_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/philips-labs/spiffe-vault/releases/download/v${version}/spiffe-vault_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/philips-labs/spiffe-vault/releases/download/v${version}/spiffe-vault_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "philips-labs/spiffe-vault" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/spin/Dockerfile.template b/tools/spin/Dockerfile.template
index 611f0d11e7..fee2be5a70 100644
--- a/tools/spin/Dockerfile.template
+++ b/tools/spin/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "fermyon/spin" "v${version}" "spin-v${version}-linux-${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/fermyon/spin/releases/download/v${version}/spin-v${version}-static-linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/fermyon/spin/releases/download/v${version}/spin-v${version}-static-linux-${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "fermyon/spin" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     spin
 EOF
\ No newline at end of file
diff --git a/tools/spire/Dockerfile.template b/tools/spire/Dockerfile.template
index 9a620d8a49..7dfebab5b7 100644
--- a/tools/spire/Dockerfile.template
+++ b/tools/spire/Dockerfile.template
@@ -5,20 +5,26 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
-
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 mkdir "${prefix}/share/spire/"
 
-check-github-release-asset "spiffe/spire" "v${version}" "spire-${version}-linux-${alt_arch}-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/spiffe/spire/releases/download/v${version}/spire-${version}-linux-${alt_arch}-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/spire/" --strip-components=1 --no-same-owner
+url="https://github.com/spiffe/spire/releases/download/v${version}/spire-${version}-linux-${alt_arch}-musl.tar.gz"
+filename="(basename "${url}")"
+check-github-release-asset "spiffe/spire" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/share/spire/" --strip-components=1 --no-same-owner
 
-check-github-release-asset "spiffe/spire" "v${version}" "spire-extras-${version}-linux-${alt_arch}-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/spiffe/spire/releases/download/v${version}/spire-extras-${version}-linux-${alt_arch}-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/spire/" --strip-components=1 --no-same-owner
+url="https://github.com/spiffe/spire/releases/download/v${version}/spire-extras-${version}-linux-${alt_arch}-musl.tar.gz"
+filename="(basename "${url}")"
+check-github-release-asset "spiffe/spire" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/share/spire/" --strip-components=1 --no-same-owner
 
 find "${prefix}/share/spire/bin" -type f -executable -exec mv {} "${prefix}/bin/" \;
 rmdir "${prefix}/share/spire/bin"
diff --git a/tools/ssh-key-confirmer/Dockerfile.template b/tools/ssh-key-confirmer/Dockerfile.template
index 39a43822f3..392715aee7 100644
--- a/tools/ssh-key-confirmer/Dockerfile.template
+++ b/tools/ssh-key-confirmer/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "benjojo/ssh-key-confirmer" "v${version}" "ssh-key-confirmer-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ssh-key-confirmer" \
-    "https://github.com/benjojo/ssh-key-confirmer/releases/download/v${version}/ssh-key-confirmer-${alt_arch}"
-chmod +x "${prefix}/bin/ssh-key-confirmer"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/benjojo/ssh-key-confirmer/releases/download/v${version}/ssh-key-confirmer-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "benjojo/ssh-key-confirmer" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ssh-key-confirmer"
+
 EOF
\ No newline at end of file
diff --git a/tools/ssh3/Dockerfile.template b/tools/ssh3/Dockerfile.template
index 2546c164eb..9fb54cf4b4 100644
--- a/tools/ssh3/Dockerfile.template
+++ b/tools/ssh3/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${arch}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "francoismichel/ssh3" "v${version}" "ssh3_${version}_linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/francoismichel/ssh3/releases/download/v${version}/ssh3_${version}_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/francoismichel/ssh3/releases/download/v${version}/ssh3_${version}_linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "francoismichel/ssh3" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     ssh3 \
     ssh3-server
 EOF
\ No newline at end of file
diff --git a/tools/sshocker/Dockerfile.template b/tools/sshocker/Dockerfile.template
index 98f22e8b1b..9e84802e13 100644
--- a/tools/sshocker/Dockerfile.template
+++ b/tools/sshocker/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "lima-vm/sshocker" "v${version}" "sshocker-Linux-${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/sshocker" \
-    "https://github.com/lima-vm/sshocker/releases/download/v${version}/sshocker-Linux-${arch}"
-chmod +x "${prefix}/bin/sshocker"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/lima-vm/sshocker/releases/download/v${version}/sshocker-Linux-${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "lima-vm/sshocker" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/sshocker"
+
 EOF
\ No newline at end of file
diff --git a/tools/stargz-snapshotter/Dockerfile.template b/tools/stargz-snapshotter/Dockerfile.template
index 434f92e343..0247625ee5 100644
--- a/tools/stargz-snapshotter/Dockerfile.template
+++ b/tools/stargz-snapshotter/Dockerfile.template
@@ -8,8 +8,14 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 COPY stargz-snapshotter.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
-check-github-release-asset "containerd/stargz-snapshotter" "v${version}" "stargz-snapshotter-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containerd/stargz-snapshotter/releases/download/v${version}/stargz-snapshotter-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containerd/stargz-snapshotter/releases/download/v${version}/stargz-snapshotter-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containerd/stargz-snapshotter" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/staticcheck/Dockerfile.template b/tools/staticcheck/Dockerfile.template
index 7e8aa6b01f..7da2cf97fb 100644
--- a/tools/staticcheck/Dockerfile.template
+++ b/tools/staticcheck/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dominikh/go-tools" "${version}" "staticcheck_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/dominikh/go-tools/releases/download/${version}/staticcheck_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dominikh/go-tools/releases/download/${version}/staticcheck_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dominikh/go-tools" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     staticcheck/staticcheck
 EOF
\ No newline at end of file
diff --git a/tools/stdin-spinner/Dockerfile.template b/tools/stdin-spinner/Dockerfile.template
index 5a73d05597..4b3716bbd9 100644
--- a/tools/stdin-spinner/Dockerfile.template
+++ b/tools/stdin-spinner/Dockerfile.template
@@ -13,7 +13,7 @@ ARG name
 ARG version
 ENV GOPATH=/go \
     GO111MODULE=auto
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/sgreben/stdin-spinner .
 go build -ldflags "-X main.version=${version}" -o "${prefix}/bin/stdin-spinner" .
 EOF
\ No newline at end of file
diff --git a/tools/stern/Dockerfile.template b/tools/stern/Dockerfile.template
index 4359b297e0..c232135be0 100644
--- a/tools/stern/Dockerfile.template
+++ b/tools/stern/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stern/stern" "v${version}" "stern_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/stern/stern/releases/download/v${version}/stern_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stern/stern/releases/download/v${version}/stern_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stern/stern" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     stern
 "${prefix}/bin/stern" --completion bash >"${prefix}/share/bash-completion/completions/stern"
 "${prefix}/bin/stern" --completion fish >"${prefix}/share/fish/vendor_completions.d/stern.fish"
diff --git a/tools/stress-ng/Dockerfile.template b/tools/stress-ng/Dockerfile.template
index 9d1e5f47e2..2e4655f20f 100644
--- a/tools/stress-ng/Dockerfile.template
+++ b/tools/stress-ng/Dockerfile.template
@@ -7,11 +7,11 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=make / /usr/local/
 WORKDIR /tmp/stress-ng
-RUN <<EOF
+ARG name
+ARG version
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "V${version}" https://github.com/ColinIanKing/stress-ng .
 make clean
 STATIC=1 make -j$(nproc)
diff --git a/tools/structurizr-cli/Dockerfile.template b/tools/structurizr-cli/Dockerfile.template
index 004c8b13cc..fa34ba977c 100644
--- a/tools/structurizr-cli/Dockerfile.template
+++ b/tools/structurizr-cli/Dockerfile.template
@@ -7,12 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "structurizr/cli" "v${version}" "structurizr-cli-${version}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/structurizr/cli/releases/download/v${version}/structurizr-cli-${version}.zip"
 filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
+
+check-github-release-asset "structurizr/cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/opt/structurizr-cli"
-unzip -q -o -d "${prefix}/opt/structurizr-cli" "${filename}"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/opt/structurizr-cli" "${uniget_cache_download}/${filename}"
+
 ln --symbolic --relative --force "${prefix}/opt/structurizr-cli/structurizr.sh" "${prefix}/bin/structurizr"
 EOF
\ No newline at end of file
diff --git a/tools/su-exec/Dockerfile.template b/tools/su-exec/Dockerfile.template
index 5f6cb23bce..2429c46e59 100644
--- a/tools/su-exec/Dockerfile.template
+++ b/tools/su-exec/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/github.com/ncopa/su-exec
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/ncopa/su-exec "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/ncopa/su-exec .
 make -j$(nproc) su-exec-static
diff --git a/tools/supdock/Dockerfile.template b/tools/supdock/Dockerfile.template
index e08a883013..10f4225d5d 100644
--- a/tools/supdock/Dockerfile.template
+++ b/tools/supdock/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "segersniels/supdock" "${version}" "supdock-${arch_suffix}-linux"
+url="https://github.com/segersniels/supdock/releases/download/${version}/supdock-${arch_suffix}-linux"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "segersniels/supdock" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/supdock"
 
-echo "### Downloading supdock"
-curl --silent --show-error --location --fail --output "${prefix}/bin/supdock" \
-    "https://github.com/segersniels/supdock/releases/download/${version}/supdock-${arch_suffix}-linux"
-chmod +x "${prefix}/bin/supdock"
 EOF
\ No newline at end of file
diff --git a/tools/switcher/Dockerfile.template b/tools/switcher/Dockerfile.template
index 22bd01ad1f..52405a3dc3 100644
--- a/tools/switcher/Dockerfile.template
+++ b/tools/switcher/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/danielfoehrKn/kubeswitch/releases/download/${version}/switcher_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "danielfoehrKn/kubeswitch" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/switcher"
 
-RUN <<EOF
-check-github-release-asset "danielfoehrKn/kubeswitch" "${version}" "switcher_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/switcher" \
-    "https://github.com/danielfoehrKn/kubeswitch/releases/download/${version}/switcher_linux_${alt_arch}"
-chmod +x "${prefix}/bin/switcher"
 
 curl --silent --show-error --location --fail --output "${prefix}/bin/switch.sh" \
     "https://github.com/danielfoehrKn/kubeswitch/releases/download/${version}/switch.sh"
diff --git a/tools/syft/Dockerfile.template b/tools/syft/Dockerfile.template
index 2a075cb4a4..8b11db572e 100644
--- a/tools/syft/Dockerfile.template
+++ b/tools/syft/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "anchore/syft" "v${version}" "syft_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "anchore/syft" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     syft
 "${prefix}/bin/syft" completion bash | sed -E 's/^(\s*complete.*)/\1 syft/'            >"${prefix}/share/bash-completion/completions/syft"
 "${prefix}/bin/syft" completion fish | sed -E 's/complete -c  -e/complete -c syft -e/' >"${prefix}/share/fish/vendor_completions.d/syft.fish"
diff --git a/tools/sysbox/Dockerfile.template b/tools/sysbox/Dockerfile.template
index 405a03ed17..0e7e168e62 100644
--- a/tools/sysbox/Dockerfile.template
+++ b/tools/sysbox/Dockerfile.template
@@ -8,11 +8,15 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 WORKDIR /tmp/sysbox
-RUN <<EOF
-curl --silent --show-error --location --fail --remote-name \
-    "https://downloads.nestybox.com/sysbox/releases/v${version}/sysbox-ce_${version}-0.linux_${alt_arch}.deb"
-ar x "sysbox-ce_${version}-0.linux_${alt_arch}.deb"
-tar --extract --xz --file data.tar.xz
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://downloads.nestybox.com/sysbox/releases/v${version}/sysbox-ce_${version}-0.linux_${alt_arch}.deb"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+ar x "${uniget_cache_download}/${filename}"
+tar --file=data.tar.xz --extract --xz
 
 for type in fs runc mgr; do
     mv "usr/bin/sysbox-${type}" "${prefix}/bin/"
diff --git a/tools/systemd-docker/Dockerfile.template b/tools/systemd-docker/Dockerfile.template
index 9aee7d6a5c..a5fefbdec4 100644
--- a/tools/systemd-docker/Dockerfile.template
+++ b/tools/systemd-docker/Dockerfile.template
@@ -11,16 +11,9 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/oxin-ros/systemd-docker
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/oxin-ros/systemd-docker" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/oxin-ros/systemd-docker .
 sed -i -E "s/^(\s+Version:\s+)\"([^\"]+)\",$/\1\"${version}\",/" cmd/exec.go
 go build -o "${prefix}/bin/systemd-docker" .
-EOF
-
-# completion
-#RUN <<EOF
-#"${prefix}/bin/systemd-docker" completion bash >"${prefix}/share/bash-completion/completions/systemd-docker"
-#"${prefix}/bin/systemd-docker" completion fish >"${prefix}/share/fish/vendor_completions.d/systemd-docker.fish"
-#"${prefix}/bin/systemd-docker" completion zsh >"${prefix}/share/zsh/vendor-completions/_systemd-docker"
-#EOF
\ No newline at end of file
+EOF
\ No newline at end of file
diff --git a/tools/tailspin/Dockerfile.template b/tools/tailspin/Dockerfile.template
index c2ce8dc96c..9a2d448330 100644
--- a/tools/tailspin/Dockerfile.template
+++ b/tools/tailspin/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local/
 WORKDIR /tmp/github.com/bensadeh/tailspin
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/bensadeh/tailspin .
 export CARGO_HOME=/usr/local/cargo
 export RUSTUP_HOME=/usr/local/rustup
diff --git a/tools/talosctl/Dockerfile.template b/tools/talosctl/Dockerfile.template
index 025ff1b989..2054ea2b74 100644
--- a/tools/talosctl/Dockerfile.template
+++ b/tools/talosctl/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "siderolabs/talos" "v${version}" "talosctl-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/talosctl" \
-    "https://github.com/siderolabs/talos/releases/download/v${version}/talosctl-linux-${alt_arch}"
-chmod +x "${prefix}/bin/talosctl"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/siderolabs/talos/releases/download/v${version}/talosctl-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "siderolabs/talos" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/talosctl"
+
 
 "${prefix}/bin/talosctl" completion bash >"${prefix}/share/bash-completion/completions/talosctl"
 "${prefix}/bin/talosctl" completion fish >"${prefix}/share/fish/vendor_completions.d/talosctl.fish"
diff --git a/tools/task/Dockerfile.template b/tools/task/Dockerfile.template
index 6bbcff78d0..b398eac7c4 100644
--- a/tools/task/Dockerfile.template
+++ b/tools/task/Dockerfile.template
@@ -5,15 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/go-task/task/releases/download/v${version}/task_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
 
-RUN <<EOF
-check-github-release-asset "go-task/task" "v${version}" "task_linux_${alt_arch}.tar.gz"
+check-github-release-asset "go-task/task" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-curl --silent --show-error --location --fail "https://github.com/go-task/task/releases/download/v${version}/task_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     task
 curl --silent --show-error --location --fail "https://github.com/go-task/task/releases/download/v${version}/task_linux_${alt_arch}.tar.gz" \
 | tar --extract --gzip --directory="${prefix}/share" --strip-components=2 --no-same-owner \
diff --git a/tools/tasker/Dockerfile.template b/tools/tasker/Dockerfile.template
index 8944022192..063622b291 100644
--- a/tools/tasker/Dockerfile.template
+++ b/tools/tasker/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/github.com/stevegrubb/tasker
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/stevegrubb/tasker .
 ./autogen.sh
 ./configure --prefix="${prefix}" --disable-shared --enable-static
diff --git a/tools/tea/Dockerfile.template b/tools/tea/Dockerfile.template
index 7fd28b03d2..31bae0e11f 100644
--- a/tools/tea/Dockerfile.template
+++ b/tools/tea/Dockerfile.template
@@ -7,10 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/tea" \
-    "https://gitea.com/gitea/tea/releases/download/v${version}/tea-${version}-linux-${alt_arch}"
-chmod +x "${prefix}/bin/tea"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitea.com/gitea/tea/releases/download/v${version}/tea-${version}-linux-${alt_arch}"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/tea"
 
 curl --silent --show-error --location --fail --output "${prefix}/share/bash-completion/completions/tea" \
     "https://gitea.com/gitea/tea/raw/tag/v${version}/contrib/autocomplete.sh"
diff --git a/tools/tejolote/Dockerfile.template b/tools/tejolote/Dockerfile.template
index 280aad8600..8671bb0e47 100644
--- a/tools/tejolote/Dockerfile.template
+++ b/tools/tejolote/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/tejolote" "v${version}" "tejolote-${alt_arch}-linux"
-curl --silent --show-error --location --fail --output "${prefix}/bin/tejolote" \
-    "https://github.com/kubernetes-sigs/tejolote/releases/download/v${version}/tejolote-${alt_arch}-linux"
-chmod +x "${prefix}/bin/tejolote"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/tejolote/releases/download/v${version}/tejolote-${alt_arch}-linux"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/tejolote" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/tejolote"
+
 
 "${prefix}/bin/tejolote" completion bash >"${prefix}/share/bash-completion/completions/tejolote"
 "${prefix}/bin/tejolote" completion fish >"${prefix}/share/fish/vendor_completions.d/tejolote.fish"
diff --git a/tools/telegraf/Dockerfile.template b/tools/telegraf/Dockerfile.template
index c0ff813fa5..d94be01ef7 100644
--- a/tools/telegraf/Dockerfile.template
+++ b/tools/telegraf/Dockerfile.template
@@ -7,10 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://dl.influxdata.com/telegraf/releases/telegraf-${version}_linux_${alt_arch}.tar.gz"
+filename="(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
 mkdir -p "${prefix}/share/telegraf"
-curl --silent --show-error --location --fail "https://dl.influxdata.com/telegraf/releases/telegraf-${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/telegraf" --strip-components=2 --no-same-owner
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/share/telegraf" --strip-components=2 --no-same-owner
 mv "${prefix}/share/telegraf/usr/bin/telegraf" "${prefix}/bin/telegraf"
 mv "${prefix}/share/telegraf/usr/lib/telegraf/scripts" "${prefix}/share/telegraf/"
 rm -rf \
diff --git a/tools/teleport/Dockerfile.template b/tools/teleport/Dockerfile.template
index a5d3c3bc98..4438e6033c 100644
--- a/tools/teleport/Dockerfile.template
+++ b/tools/teleport/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://cdn.teleport.dev/teleport-v${version}-linux-${alt_arch}-bin.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://cdn.teleport.dev/teleport-v${version}-linux-${alt_arch}-bin.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     teleport/tctl \
     teleport/teleport \
     teleport/tbot \
diff --git a/tools/teller/Dockerfile.template b/tools/teller/Dockerfile.template
index 888acdbc0a..6f5e2d4398 100644
--- a/tools/teller/Dockerfile.template
+++ b/tools/teller/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tellerops/teller" "v${version}" "teller-${arch}-linux.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/tellerops/teller/releases/download/v${version}/teller-${arch}-linux.tar.xz" \
-| tar --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tellerops/teller/releases/download/v${version}/teller-${arch}-linux.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tellerops/teller" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "teller-${arch}-linux/teller"
 EOF
\ No newline at end of file
diff --git a/tools/tempo-cli/Dockerfile.template b/tools/tempo-cli/Dockerfile.template
index e0af355a76..5b3b7bb52b 100644
--- a/tools/tempo-cli/Dockerfile.template
+++ b/tools/tempo-cli/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/tempo" "v${version}" "tempo_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/grafana/tempo/releases/download/v${version}/tempo_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/grafana/tempo/releases/download/v${version}/tempo_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/tempo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     tempo-cli
 EOF
diff --git a/tools/tempo/Dockerfile.template b/tools/tempo/Dockerfile.template
index e4221a8354..dd3ec2ef64 100644
--- a/tools/tempo/Dockerfile.template
+++ b/tools/tempo/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "grafana/tempo" "v${version}" "tempo_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/grafana/tempo/releases/download/v${version}/tempo_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/grafana/tempo/releases/download/v${version}/tempo_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "grafana/tempo" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     tempo \
     tempo-query
 EOF
diff --git a/tools/termgraph/Dockerfile.template b/tools/termgraph/Dockerfile.template
index b6608b1378..f355d6d77b 100644
--- a/tools/termgraph/Dockerfile.template
+++ b/tools/termgraph/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/termgraph" --console-script termgraph "termgraph==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/terminalizer/Dockerfile.template b/tools/terminalizer/Dockerfile.template
index 1f4cc34b4a..6ce0260b32 100644
--- a/tools/terminalizer/Dockerfile.template
+++ b/tools/terminalizer/Dockerfile.template
@@ -17,7 +17,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/terminalizer
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "terminalizer@${version}"
diff --git a/tools/tern/Dockerfile.template b/tools/tern/Dockerfile.template
index c6fe3194eb..2eeebf0785 100644
--- a/tools/tern/Dockerfile.template
+++ b/tools/tern/Dockerfile.template
@@ -8,17 +8,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=python / /usr/local/
-COPY --link --from=shiv / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     clang
 EOF
+COPY --link --from=python / /usr/local/
+COPY --link --from=shiv / /usr/local/
+WORKDIR /tmp/tern
 ARG name
 ARG version
-WORKDIR /tmp/tern
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 pip install "cython<3.0.0" wheel
 shiv --output-file "${prefix}/bin/tern" --console-script tern "tern==${version}" --no-build-isolation
 EOF
\ No newline at end of file
diff --git a/tools/terraform-backend-git/Dockerfile.template b/tools/terraform-backend-git/Dockerfile.template
index 9397b13eba..e5bc79e3af 100644
--- a/tools/terraform-backend-git/Dockerfile.template
+++ b/tools/terraform-backend-git/Dockerfile.template
@@ -8,11 +8,18 @@ SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
 
-RUN <<EOF
-check-github-release-asset "plumber-cd/terraform-backend-git" "v${version}" "terraform-backend-git-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/terraform-backend-git" \
-    "https://github.com/plumber-cd/terraform-backend-git/releases/download/v${version}/terraform-backend-git-linux-${alt_arch}"
-chmod +x "${prefix}/bin/terraform-backend-git"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/plumber-cd/terraform-backend-git/releases/download/v${version}/terraform-backend-git-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "plumber-cd/terraform-backend-git" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/terraform-backend-git"
+
 
 "${prefix}/bin/terraform-backend-git" completion bash >"${prefix}/share/bash-completion/completions/terraform-backend-git"
 "${prefix}/bin/terraform-backend-git" completion fish >"${prefix}/share/fish/vendor_completions.d/terraform-backend-git.fish"
diff --git a/tools/terraform-docs/Dockerfile.template b/tools/terraform-docs/Dockerfile.template
index 3c092b2ba3..de14c74062 100644
--- a/tools/terraform-docs/Dockerfile.template
+++ b/tools/terraform-docs/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "terraform-docs/terraform-docs" "v${version}" "terraform-docs-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/terraform-docs/terraform-docs/releases/download/v${version}/terraform-docs-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/terraform-docs/terraform-docs/releases/download/v${version}/terraform-docs-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "terraform-docs/terraform-docs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     terraform-docs
 
 "${prefix}/bin/terraform-docs" completion bash >"${prefix}/share/bash-completion/completions/terraform-docs"
diff --git a/tools/terraform/Dockerfile.template b/tools/terraform/Dockerfile.template
index 3d5f5e4bc5..666d4053a2 100644
--- a/tools/terraform/Dockerfile.template
+++ b/tools/terraform/Dockerfile.template
@@ -7,11 +7,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --remote-name "https://releases.hashicorp.com/terraform/${version}/terraform_${version}_linux_${alt_arch}.zip"
-unzip -q -o -d "/tmp" "terraform_${version}_linux_${alt_arch}.zip"
-rm "terraform_${version}_linux_${alt_arch}.zip"
-mv "/tmp/terraform" "${prefix}/bin"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://releases.hashicorp.com/terraform/${version}/terraform_${version}_linux_${alt_arch}.zip"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
+    terraform
 EOF
 COPY <<EOF /uniget_bootstrap/etc/profile.d/terraform.sh.go-template
 complete -C {{ .Target }}/bin/terraform terraform
diff --git a/tools/terragrunt/Dockerfile.template b/tools/terragrunt/Dockerfile.template
index 349529a387..c8a4166e13 100644
--- a/tools/terragrunt/Dockerfile.template
+++ b/tools/terragrunt/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "gruntwork-io/terragrunt" "v${version}" "terragrunt_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/terragrunt" \
-    "https://github.com/gruntwork-io/terragrunt/releases/download/v${version}/terragrunt_linux_${alt_arch}"
-chmod +x "${prefix}/bin/terragrunt"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/gruntwork-io/terragrunt/releases/download/v${version}/terragrunt_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "gruntwork-io/terragrunt" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/terragrunt"
+
 EOF
\ No newline at end of file
diff --git a/tools/tetragon/Dockerfile.template b/tools/tetragon/Dockerfile.template
index 2e6bf43382..e01b78c8af 100644
--- a/tools/tetragon/Dockerfile.template
+++ b/tools/tetragon/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "cilium/tetragon" "v${version}" "tetra-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/cilium/tetragon/releases/download/v${version}/tetra-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/cilium/tetragon/releases/download/v${version}/tetra-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "cilium/tetragon" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 "${prefix}/bin/tetra" completion bash >"${prefix}/share/bash-completion/completions/tetra"
 "${prefix}/bin/tetra" completion fish >"${prefix}/share/fish/vendor_completions.d/tetra.fish"
diff --git a/tools/textlint/Dockerfile.template b/tools/textlint/Dockerfile.template
index 473edc9055..59255ff7e9 100644
--- a/tools/textlint/Dockerfile.template
+++ b/tools/textlint/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/textlint
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "textlint@${version}"
diff --git a/tools/tig/Dockerfile.template b/tools/tig/Dockerfile.template
index eab449c246..8f899e9f23 100644
--- a/tools/tig/Dockerfile.template
+++ b/tools/tig/Dockerfile.template
@@ -5,7 +5,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     curl \
@@ -17,12 +17,21 @@ EOF
 WORKDIR /tmp/tig
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/jonas/tig/releases/download/tig-${version}/tig-${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/jonas/tig/releases/download/tig-${version}/tig-${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "jonas/tig" "tig-${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
 ./configure
+
 make -j$(nproc) prefix="${prefix}"
 make install install-doc-man prefix="${prefix}"
+
 cp contrib/tig-completion.bash "${prefix}/share/bash-completion/completions/tig"
 cp contrib/tig-completion.zsh "${prefix}/share/zsh/vendor-completions/_tig"
 EOF
\ No newline at end of file
diff --git a/tools/timoni/Dockerfile.template b/tools/timoni/Dockerfile.template
index fb39ecbb6c..b10f99670d 100644
--- a/tools/timoni/Dockerfile.template
+++ b/tools/timoni/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "stefanprodan/timoni" "v${version}" "timoni_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/stefanprodan/timoni/releases/download/v${version}/timoni_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/stefanprodan/timoni/releases/download/v${version}/timoni_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "stefanprodan/timoni" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     timoni
 
 "${prefix}/bin/timoni" completion bash >"${prefix}/share/bash-completion/completions/timoni"
diff --git a/tools/tini/Dockerfile.template b/tools/tini/Dockerfile.template
index 841c5a511c..fd1916eb0c 100644
--- a/tools/tini/Dockerfile.template
+++ b/tools/tini/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "krallin/tini" "v${version}" "tini-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/tini" \
-    "https://github.com/krallin/tini/releases/download/v${version}/tini-${alt_arch}"
-chmod +x "${prefix}/bin/tini"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/krallin/tini/releases/download/v${version}/tini-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "krallin/tini" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/tini"
+
 EOF
\ No newline at end of file
diff --git a/tools/tinygo/Dockerfile.template b/tools/tinygo/Dockerfile.template
index 98de46d99b..2fde3b5dd5 100644
--- a/tools/tinygo/Dockerfile.template
+++ b/tools/tinygo/Dockerfile.template
@@ -7,9 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "tinygo-org/tinygo" "v${version}" "tinygo${version}.linux-${alt_arch}.tar.gz"
-
 mkdir -p "${prefix}/opt"
 curl --silent --show-error --location --fail "https://github.com/tinygo-org/tinygo/releases/download/v${version}/tinygo${version}.linux-${alt_arch}.tar.gz" \
 | tar --extract --gzip --directory="${prefix}/opt/" --no-same-owner
diff --git a/tools/tkn/Dockerfile.template b/tools/tkn/Dockerfile.template
index ef9977cab8..5f617f90d7 100644
--- a/tools/tkn/Dockerfile.template
+++ b/tools/tkn/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tektoncd/cli/releases/download/v${version}/tkn_${version}_Linux_x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tektoncd/cli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "tektoncd/cli" "v${version}" "tkn_${version}_Linux_x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/tektoncd/cli/releases/download/v${version}/tkn_${version}_Linux_x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     tkn
 "${prefix}/bin/tkn" completion bash >"${prefix}/share/bash-completion/completions/tkn"
 "${prefix}/bin/tkn" completion fish >"${prefix}/share/fish/vendor_completions.d/tkn.fish"
@@ -20,8 +24,15 @@ curl --silent --show-error --location --fail "https://github.com/tektoncd/cli/re
 ln -s "${prefix}/bin/tkn" "${prefix}/bin/kubectl-tkn"
 EOF
 
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/tektoncd/cli/archive/refs/tags/v${version}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/man/man1/" --strip-components=4 --no-same-owner \
-    cli-${version}/docs/man/man1/
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tektoncd/cli/archive/refs/tags/v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/share/man/man1/" --strip-components=4 --no-same-owner \
+    "cli-${version}/docs/man/man1/"
 EOF
\ No newline at end of file
diff --git a/tools/tlsx/Dockerfile.template b/tools/tlsx/Dockerfile.template
index 3e52e2c950..86bd332017 100644
--- a/tools/tlsx/Dockerfile.template
+++ b/tools/tlsx/Dockerfile.template
@@ -7,11 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "projectdiscovery/tlsx" "v${version}" "tlsx_${version}_linux_${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/projectdiscovery/tlsx/releases/download/v${version}/tlsx_${version}_linux_${alt_arch}.zip"
-filename="$(basename "${url}")"
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}" \
+filename="$( basename "${url}" )"
+
+check-github-release-asset "projectdiscovery/tlsx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
     tlsx
 EOF
\ No newline at end of file
diff --git a/tools/tml/Dockerfile.template b/tools/tml/Dockerfile.template
index 3476a2b2ed..a55b45ae49 100644
--- a/tools/tml/Dockerfile.template
+++ b/tools/tml/Dockerfile.template
@@ -11,7 +11,7 @@ ARG name
 ARG version
 COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/liamg/tml
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/liamg/tml .
 go build -o "${prefix}/bin/tml"  -ldflags "-X github.com/liamg/tml/version.Version=${version}" ./tml
 EOF
\ No newline at end of file
diff --git a/tools/toolong/Dockerfile.template b/tools/toolong/Dockerfile.template
index 5170d71f4e..37b1694e72 100644
--- a/tools/toolong/Dockerfile.template
+++ b/tools/toolong/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/tl" --console-script tl "toolong==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/tracee/Dockerfile.template b/tools/tracee/Dockerfile.template
index 30580b6d35..34a9190e6d 100644
--- a/tools/tracee/Dockerfile.template
+++ b/tools/tracee/Dockerfile.template
@@ -8,11 +8,9 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=go / /usr/local/
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
 apk update
-apk add \
+apk add --update-cache \
     clang \
     linux-headers \
     elfutils-dev \
@@ -21,10 +19,12 @@ apk add \
     zlib-dev \
     zlib-static
 EOF
+COPY --link --from=go / /usr/local/
+COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/aquasecurity/tracee
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/aquasecurity/tracee" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/aquasecurity/tracee .
 STATIC=1 make all
diff --git a/tools/traefik/Dockerfile.template b/tools/traefik/Dockerfile.template
index d1e3089016..1d34346454 100644
--- a/tools/traefik/Dockerfile.template
+++ b/tools/traefik/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "traefik/traefik" "v${version}" "traefik_v${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/traefik/traefik/releases/download/v${version}/traefik_v${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/traefik/traefik/releases/download/v${version}/traefik_v${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "traefik/traefik" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     traefik
 curl --silent --show-error --location --fail --output "${prefix}/etc/systemd/system/traefik.service.go-template" \
     "https://github.com/traefik/traefik/raw/v${version}/contrib/systemd/traefik.service"
diff --git a/tools/trillian/Dockerfile.template b/tools/trillian/Dockerfile.template
index 9e568e494f..2b1b947e00 100644
--- a/tools/trillian/Dockerfile.template
+++ b/tools/trillian/Dockerfile.template
@@ -13,7 +13,7 @@ ARG name
 ARG version
 COPY trillian_log_server.service.go-template /uniget_bootstrap/etc/systemd/system/
 COPY trillian_log_signer.service.go-template /uniget_bootstrap/etc/systemd/system/
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/google/trillian .
 export CGO_ENABLED=0
 go build -ldflags "-w -s" -o "${prefix}/bin/trillian_log_server" ./cmd/trillian_log_server
diff --git a/tools/trivy-operator/Dockerfile.template b/tools/trivy-operator/Dockerfile.template
index ff15f2cc30..d78c97ccb3 100644
--- a/tools/trivy-operator/Dockerfile.template
+++ b/tools/trivy-operator/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,9 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "aquasecurity/trivy-operator" "v${version}" "trivy-operator_linux_${arch_suffix}.tar.gz"
+url="https://github.com/aquasecurity/trivy-operator/releases/download/v${version}/trivy-operator_linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-curl --silent --show-error --location --fail "https://github.com/aquasecurity/trivy-operator/releases/download/v${version}/trivy-operator_linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "aquasecurity/trivy-operator" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     trivy-operator
 EOF
\ No newline at end of file
diff --git a/tools/trivy/Dockerfile.template b/tools/trivy/Dockerfile.template
index eb8d0b56cb..840a60d770 100644
--- a/tools/trivy/Dockerfile.template
+++ b/tools/trivy/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=cosign / /usr/local/
 ARG TARGETPLATFORM
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -27,24 +27,27 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "aquasecurity/trivy" "v${version}" "trivy_${version}_Linux-${arch_suffix}.tar.gz"
+url="https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_Linux-${arch_suffix}.tar.gz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "aquasecurity/trivy" "v${version}" "${filename}"
 
 echo "### Downloading trivy ${version}"
-curl --silent --show-error --location --fail --remote-name \
-      "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_Linux-${arch_suffix}.tar.gz"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
 echo "### Checking keyless signature for trivy ${version}"
-curl --silent --show-error --location --fail --remote-name \
-      "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_Linux-${arch_suffix}.tar.gz.pem"
-curl --silent --show-error --location --fail --remote-name \
-      "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_Linux-${arch_suffix}.tar.gz.sig"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.pem" \
+      "${url}.pem"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}.sig" \
+      "${url}.sig"
 SHA="$(
     git ls-remote --tags https://github.com/aquasecurity/trivy "v${version}" \
     | cut -f1
 )"
 COSIGN_EXPERIMENTAL=1 cosign verify-blob \
-    --cert "trivy_${version}_Linux-${arch_suffix}.tar.gz.pem" \
-    --signature "trivy_${version}_Linux-${arch_suffix}.tar.gz.sig" \
+    --cert "${uniget_cache_download}/${filename}.pem" \
+    --signature "${uniget_cache_download}/${filename}.sig" \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity "https://github.com/aquasecurity/trivy/.github/workflows/reusable-release.yaml@refs/tags/v${version}" \
     --certificate-github-workflow-name Release \
@@ -52,13 +55,13 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob \
     --certificate-github-workflow-repository "aquasecurity/trivy" \
     --certificate-github-workflow-sha "${SHA}" \
     --certificate-github-workflow-trigger push \
-    "trivy_${version}_Linux-${arch_suffix}.tar.gz"
+    "${uniget_cache_download}/${filename}"
 
 echo "### Installing trivy ${version}"
-tar --extract --gzip --directory="${prefix}/bin" --file "trivy_${version}_Linux-${arch_suffix}.tar.gz" \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" \
     trivy \
     contrib
-rm -f "trivy_${version}_Linux-${arch_suffix}.tar.gz"
 
 echo "### Installing trivy ${version} completion"
 "${prefix}/bin/trivy" completion bash >"${prefix}/share/bash-completion/completions/trivy"
@@ -70,7 +73,7 @@ mkdir -p "${prefix}/share/trivy"
 mv "${prefix}/bin/contrib" "${prefix}/share/trivy/"
 EOF
 
-RUN <<EOF
+RUN <<EOF # no download cache
 echo "### Installing SonarQube template for trivy ${version}"
 curl --silent --show-error --location --fail --output "${prefix}/share/trivy/contrib/sonarqube.tpl" \
       https://github.com/mendhak/trivy-template-output-to-sonarqube/raw/master/sonarqube.tpl
diff --git a/tools/try/Dockerfile.template b/tools/try/Dockerfile.template
index c55a9e660d..0dd928398f 100644
--- a/tools/try/Dockerfile.template
+++ b/tools/try/Dockerfile.template
@@ -8,15 +8,21 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --from=make / /usr/local/
-COPY --from=pandoc / /usr/local/
+COPY --link --from=make / /usr/local/
+COPY --link --from=pandoc / /usr/local/
+WORKDIR /tmp/walk
 ARG name
 ARG version
-WORKDIR /tmp/walk
-RUN <<EOF
-check-download "https://github.com/binpash/try/archive/refs/tags/v${version}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/binpash/try/archive/refs/tags/v${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/binpash/try/archive/refs/tags/v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
 
 cp try "${prefix}/bin/"
 cp completions/try.bash "${prefix}/share/bash-completion/completions/walk"
diff --git a/tools/tshark/Dockerfile.template b/tools/tshark/Dockerfile.template
index 57a6330202..fc65ad8b66 100644
--- a/tools/tshark/Dockerfile.template
+++ b/tools/tshark/Dockerfile.template
@@ -8,10 +8,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-COPY --link --from=speexdsp / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     cmake \
     glib-dev \
     glib-static \
@@ -31,13 +29,22 @@ apk add --update-cache --no-cache \
     zlib-dev \
     zlib-static
 EOF
+COPY --link --from=make / /usr/local/
+COPY --link --from=speexdsp / /usr/local/
 WORKDIR /tmp/wireshark
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://gitlab.com/wireshark/wireshark/-/archive/v${version}/wireshark-v${version}.tar.gz"
-curl --silent --show-error --location --fail "https://gitlab.com/wireshark/wireshark/-/archive/v${version}/wireshark-v${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.com/wireshark/wireshark/-/archive/v${version}/wireshark-v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1 --no-same-owner
+
 #export CMAKE_EXE_LINKER_FLAGS="-static -lintl"
 #export CMAKE_STATIC_LINKER_FLAGS="-static -lintl"
 cmake . \
diff --git a/tools/ttyd/Dockerfile.template b/tools/ttyd/Dockerfile.template
index 700f832416..29906a1b8d 100644
--- a/tools/ttyd/Dockerfile.template
+++ b/tools/ttyd/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tsl0922/ttyd" "${version}" "ttyd.${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ttyd" \
-    "https://github.com/tsl0922/ttyd/releases/download/${version}/ttyd.${arch}"
-chmod +x "${prefix}/bin/ttyd"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tsl0922/ttyd/releases/download/${version}/ttyd.${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tsl0922/ttyd" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ttyd"
+
 EOF
\ No newline at end of file
diff --git a/tools/tuf/Dockerfile.template b/tools/tuf/Dockerfile.template
index 246fdb6bec..f66dea7fc9 100644
--- a/tools/tuf/Dockerfile.template
+++ b/tools/tuf/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "theupdateframework/go-tuf" "v${version}" "tuf-client_${version}_linux_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/theupdateframework/go-tuf/releases/download/v${version}/tuf-client_${version}_linux_amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/theupdateframework/go-tuf/releases/download/v${version}/tuf-client_${version}_linux_amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "theupdateframework/go-tuf" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     tuf-client
 
 check-github-release-asset "theupdateframework/go-tuf" "v${version}" "tuf_${version}_linux_amd64.tar.gz"
diff --git a/tools/tunnelto/Dockerfile.template b/tools/tunnelto/Dockerfile.template
index d5ce1a8cad..875505f6be 100644
--- a/tools/tunnelto/Dockerfile.template
+++ b/tools/tunnelto/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "agrinman/tunnelto" "${version}" "tunnelto-linux.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/agrinman/tunnelto/releases/download/${version}/tunnelto-linux.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/agrinman/tunnelto/releases/download/${version}/tunnelto-linux.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "agrinman/tunnelto" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/typst/Dockerfile.template b/tools/typst/Dockerfile.template
index a8e0947de5..47e658396c 100644
--- a/tools/typst/Dockerfile.template
+++ b/tools/typst/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "typst/typst" "v${version}" "typst-${arch}-unknown-linux-musl.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/typst/typst/releases/download/v${version}/typst-${arch}-unknown-linux-musl.tar.xz" \
-| tar --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/typst/typst/releases/download/v${version}/typst-${arch}-unknown-linux-musl.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "typst/typst" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "typst-${arch}-unknown-linux-musl/typst"
 EOF
\ No newline at end of file
diff --git a/tools/tz/Dockerfile.template b/tools/tz/Dockerfile.template
index f1c87b1d26..e4708643ae 100644
--- a/tools/tz/Dockerfile.template
+++ b/tools/tz/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "oz/tz" "v${version}" "tz-v${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/oz/tz/releases/download/v${version}/tz-v${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/oz/tz/releases/download/v${version}/tz-v${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "oz/tz" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     tz
 EOF
\ No newline at end of file
diff --git a/tools/uidmap/Dockerfile.template b/tools/uidmap/Dockerfile.template
index 6a67eb1fd1..01fdf498f4 100644
--- a/tools/uidmap/Dockerfile.template
+++ b/tools/uidmap/Dockerfile.template
@@ -11,9 +11,17 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/uidmap
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail https://github.com/shadow-maint/shadow/releases/download/v${version}/shadow-${version}.tar.xz \
-| tar -xJ --strip-components 1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/shadow-maint/shadow/releases/download/v${version}/shadow-${version}.tar.xz"
+filename="$(basename "${url}")"
+
+check-github-release-asset "shadow-maint/shadow" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --strip-components 1
+
 ./configure --prefix="${prefix}" --enable-static --disable-shared
 make -j$(nproc) LDFLAGS=--static
 cp src/newuidmap "${prefix}/bin"
diff --git a/tools/umoci/Dockerfile.template b/tools/umoci/Dockerfile.template
index 660557d383..6c4e1577ff 100644
--- a/tools/umoci/Dockerfile.template
+++ b/tools/umoci/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "opencontainers/umoci" "v${version}" "umoci.${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/umoci" \
-    "https://github.com/opencontainers/umoci/releases/download/v${version}/umoci.${alt_arch}"
-chmod +x "${prefix}/bin/umoci"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/opencontainers/umoci/releases/download/v${version}/umoci.${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "opencontainers/umoci" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/umoci"
+
 EOF
\ No newline at end of file
diff --git a/tools/uniget-build/init.sh b/tools/uniget-build/init.sh
index f1111f5766..cd925d867b 100644
--- a/tools/uniget-build/init.sh
+++ b/tools/uniget-build/init.sh
@@ -25,6 +25,7 @@ export prefix=/uniget_bootstrap
 
 mkdir -p \
     "${prefix}${uniget_cache}" \
+    "${prefix}${uniget_cache_download}" \
     "${prefix}${uniget_contrib}" \
     "${prefix}${uniget_manifests}" \
     "${prefix}/etc/profile.d" \
diff --git a/tools/uniget/Dockerfile.template b/tools/uniget/Dockerfile.template
index 2a60107af8..4bc85b915f 100644
--- a/tools/uniget/Dockerfile.template
+++ b/tools/uniget/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "uniget-org/cli" "v${version}" "uniget_Linux_${arch}.tar.gz"
 curl --silent --show-error --location --fail \
     "https://github.com/uniget-org/cli/releases/download/v${version}/uniget_Linux_${arch}.tar.gz" \
diff --git a/tools/updatecli/Dockerfile.template b/tools/updatecli/Dockerfile.template
index 8802f411de..14ee458bc1 100644
--- a/tools/updatecli/Dockerfile.template
+++ b/tools/updatecli/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,10 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "updatecli/updatecli" "v${version}" "updatecli_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/updatecli/updatecli/releases/download/v${version}/updatecli_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-curl --silent --show-error --location --fail "https://github.com/updatecli/updatecli/releases/download/v${version}/updatecli_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "updatecli/updatecli" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     updatecli \
     manpages \
     completions
diff --git a/tools/upx/Dockerfile.template b/tools/upx/Dockerfile.template
index 05a9ea5c45..ae2435a56f 100644
--- a/tools/upx/Dockerfile.template
+++ b/tools/upx/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "upx/upx" "v${version}" "upx-${version}-${alt_arch}_linux.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/upx/upx/releases/download/v${version}/upx-${version}-${alt_arch}_linux.tar.xz" \
-| tar --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/upx/upx/releases/download/v${version}/upx-${version}-${alt_arch}_linux.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "upx/upx" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "upx-${version}-${alt_arch}_linux/upx" \
     "upx-${version}-${alt_arch}_linux/upx.1"
 mv "${prefix}/bin/upx.1" "${prefix}/share/man/man1/"
diff --git a/tools/util-linux/Dockerfile.template b/tools/util-linux/Dockerfile.template
index 4a9b0e5598..7e36149058 100644
--- a/tools/util-linux/Dockerfile.template
+++ b/tools/util-linux/Dockerfile.template
@@ -5,7 +5,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     git \
@@ -24,7 +24,7 @@ EOF
 WORKDIR /tmp/util-linux
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://github.com/util-linux/util-linux "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/util-linux/util-linux .
 ./autogen.sh
diff --git a/tools/vale/Dockerfile.template b/tools/vale/Dockerfile.template
index da0ad4e9e5..70fca51e05 100644
--- a/tools/vale/Dockerfile.template
+++ b/tools/vale/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "errata-ai/vale" "v${version}" "vale_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/errata-ai/vale/releases/download/v${version}/vale_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/errata-ai/vale/releases/download/v${version}/vale_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "errata-ai/vale" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     vale
 EOF
\ No newline at end of file
diff --git a/tools/vault/Dockerfile.template b/tools/vault/Dockerfile.template
index c6f0fcb3d8..c1f8b393c0 100644
--- a/tools/vault/Dockerfile.template
+++ b/tools/vault/Dockerfile.template
@@ -5,16 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
-
 COPY <<vault.sh /uniget_bootstrap/share/bash-completion/completions/
 complete -C /bin/vault vault
 vault.sh
 
-RUN <<EOF
-curl --silent --show-error --location --fail --remote-name "https://releases.hashicorp.com/vault/${version}/vault_${version}_linux_${alt_arch}.zip"
-unzip -q -o -d "${prefix}/bin" "vault_${version}_linux_${alt_arch}.zip"
-rm "vault_${version}_linux_${alt_arch}.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://releases.hashicorp.com/vault/${version}/vault_${version}_linux_${alt_arch}.zip"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 EOF
\ No newline at end of file
diff --git a/tools/vcluster/Dockerfile.template b/tools/vcluster/Dockerfile.template
index 0ae4831709..4265cb8737 100644
--- a/tools/vcluster/Dockerfile.template
+++ b/tools/vcluster/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "loft-sh/vcluster" "v${version}" "vcluster-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/vcluster" \
-    "https://github.com/loft-sh/vcluster/releases/download/v${version}/vcluster-linux-${alt_arch}"
-chmod +x "${prefix}/bin/vcluster"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/loft-sh/vcluster/releases/download/v${version}/vcluster-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "loft-sh/vcluster" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/vcluster"
+
 
 "${prefix}/bin/vcluster" completion bash >"${prefix}/share/bash-completion/completions/vcluster"
 "${prefix}/bin/vcluster" completion fish >"${prefix}/share/fish/vendor_completions.d/vcluster.fish"
diff --git a/tools/vendir/Dockerfile.template b/tools/vendir/Dockerfile.template
index 97578d8a41..9da8f07320 100644
--- a/tools/vendir/Dockerfile.template
+++ b/tools/vendir/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "carvel-dev/vendir" "v${version}" "vendir-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/vendir" \
-    "https://github.com/carvel-dev/vendir/releases/download/v${version}/vendir-linux-${alt_arch}"
-chmod +x "${prefix}/bin/vendir"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/carvel-dev/vendir/releases/download/v${version}/vendir-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "carvel-dev/vendir" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/vendir"
+
 EOF
\ No newline at end of file
diff --git a/tools/venom/Dockerfile.template b/tools/venom/Dockerfile.template
index 61ab5ccbe6..b90f79cf64 100644
--- a/tools/venom/Dockerfile.template
+++ b/tools/venom/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ovh/venom" "v${version}" "venom.linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/venom" \
-    "https://github.com/ovh/venom/releases/download/v${version}/venom.linux-${alt_arch}"
-chmod +x "${prefix}/bin/venom"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ovh/venom/releases/download/v${version}/venom.linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ovh/venom" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/venom"
+
 
 "${prefix}/bin/venom" completion bash >"${prefix}/share/bash-completion/completions/venom"
 "${prefix}/bin/venom" completion fish >"${prefix}/share/fish/vendor_completions.d/venom.fish"
diff --git a/tools/vexctl/Dockerfile.template b/tools/vexctl/Dockerfile.template
index 90a944230c..2c5dfdd557 100644
--- a/tools/vexctl/Dockerfile.template
+++ b/tools/vexctl/Dockerfile.template
@@ -14,7 +14,7 @@ WORKDIR /go/src/github.com/openvex/vexctl
 ARG name
 ARG version
 ENV CGO_ENABLED=0
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone https://github.com/openvex/vexctl "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/openvex/vexctl .
 make -j$(nproc) vex
diff --git a/tools/vexy/Dockerfile.template b/tools/vexy/Dockerfile.template
index 438a63a23b..dafb30331d 100644
--- a/tools/vexy/Dockerfile.template
+++ b/tools/vexy/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/vexy" --console-script vexy "vexy==${version}"
 EOF
diff --git a/tools/vgrep/Dockerfile.template b/tools/vgrep/Dockerfile.template
index 98ea10d37c..2c8cb334cc 100644
--- a/tools/vgrep/Dockerfile.template
+++ b/tools/vgrep/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="${arch}"
@@ -20,8 +20,15 @@ case "${alt_arch}" in
         exit 1
         ;;
 esac
-check-github-release-asset "vrothberg/vgrep" "v${version}" "vgrep_${version}_Linux_${arch_suffix}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/vgrep" \
-    "https://github.com/vrothberg/vgrep/releases/download/v${version}/vgrep_${version}_Linux_${arch_suffix}"
-chmod +x "${prefix}/bin/vgrep"
+
+url="https://github.com/vrothberg/vgrep/releases/download/v${version}/vgrep_${version}_Linux_${arch_suffix}"
+filename="$(basename "${url}")"
+
+check-github-release-asset "vrothberg/vgrep" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/vgrep"
 EOF
\ No newline at end of file
diff --git a/tools/vhs/Dockerfile.template b/tools/vhs/Dockerfile.template
index 45504abf44..1928a894d2 100644
--- a/tools/vhs/Dockerfile.template
+++ b/tools/vhs/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,11 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "charmbracelet/vhs" "v${version}" "vhs_${version}_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/charmbracelet/vhs/releases/download/v${version}/vhs_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading and installing vhs ${version}"
-curl --silent --show-error --location --fail "https://github.com/charmbracelet/vhs/releases/download/v${version}/vhs_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+check-github-release-asset "charmbracelet/vhs" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "vhs_${version}_Linux_${arch_suffix}/vhs" \
     "vhs_${version}_Linux_${arch_suffix}/manpages" \
     "vhs_${version}_Linux_${arch_suffix}/completions"
diff --git a/tools/viking/Dockerfile.template b/tools/viking/Dockerfile.template
index eeafa90e75..f424b62e3d 100644
--- a/tools/viking/Dockerfile.template
+++ b/tools/viking/Dockerfile.template
@@ -1,24 +1,13 @@
 #syntax=docker/dockerfile:1.10.0@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
 
-#FROM ghcr.io/uniget-org/tools/make:latest AS make
-#FROM ghcr.io/uniget-org/tools/go:latest AS go
-#FROM ghcr.io/uniget-org/tools/rust:latest AS rust
-#FROM ghcr.io/uniget-org/tools/python:latest AS python
-#FROM ghcr.io/uniget-org/tools/shiv:latest AS shiv
-#FROM ghcr.io/uniget-org/tools/nodejs:latest AS nodejs
-#FROM ghcr.io/uniget-org/tools/npm:latest AS npm
-
 FROM ghcr.io/uniget-org/images/ubuntu:24.04 AS prepare
-#FROM ghcr.io/uniget-org/images/build-essential:24.04 AS prepare
 COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-
-# tarball
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -34,130 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "d3witt/viking" "v${version}" "viking_Linux_${arch_suffix}.tar.gz"
-#check-download ""
-curl --silent --show-error --location --fail "https://github.com/d3witt/viking/releases/download/v${version}/viking_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
-    viking
-EOF
-
-# executable
-#RUN <<EOF
-#echo "### Setting architecture string for ${TARGETPLATFORM}"
-#case "${arch}" in
-#    x86_64)
-#        export arch_suffix="${arch}"
-#        ;;
-#    aarch64)
-#        export arch_suffix="${alt_arch}"
-#        ;;
-#    *)
-#        echo "ERROR: Unsupported architecture ${arch}."
-#        exit 1
-#        ;;
-#esac
-#echo "    Using ${arch_suffix}"
-#
-#check-github-release-asset "foo/bar" "v${version}" "foo-${version}-linux-amd64.tar.gz"
-#check-download ""
-#curl --silent --show-error --location --fail --output "${prefix}/bin/foo" \
-#    ""
-#chmod +x "${prefix}/bin/foo"
-#EOF
-
-# zip
-#RUN <<EOF
-#echo "### Setting architecture string for ${TARGETPLATFORM}"
-#case "${arch}" in
-#    x86_64)
-#        export arch_suffix="${arch}"
-#        ;;
-#    aarch64)
-#        export arch_suffix="${alt_arch}"
-#        ;;
-#    *)
-#        echo "ERROR: Unsupported architecture ${arch}."
-#        exit 1
-#        ;;
-#esac
-#echo "    Using ${arch_suffix}"
-#
-#check-github-release-asset "foo/bar" "v${version}" "foo-${version}-linux-amd64.tar.gz"
-#check-download ""
-#url=""
-#filename="$(basename "${url}")"
-#curl --silent --show-error --location --fail --remote-name "${url}"
-#unzip -q -o -d "${prefix}/bin" "${filename}"
-#EOF
-
-# go
-#COPY --link --from=go / /usr/local/
-#COPY --link --from=make / /usr/local/
-#WORKDIR /go/src/github.com/foo/bar
-#RUN <<EOF
-#check-clone "https://github.com/foo/bar" "v${version}"
-#git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/foo/bar .
-#make
-#cp foo "${prefix}/bin/"
-#EOF
+url="https://github.com/d3witt/viking/releases/download/v${version}/viking_Linux_${arch_suffix}.tar.gz"
+filename="(basename "${url}")"
 
-# rust
-#COPY --link --from=rust / /usr/local/
-#WORKDIR /tmp/github.com/foo/bar
-#RUN <<EOF
-#git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/foo/bar .
-#export CARGO_HOME=/usr/local/cargo
-#export RUSTUP_HOME=/usr/local/rustup
-#export RUSTFLAGS='-C target-feature=+crt-static'
-#cargo build --release --target "${arch}-unknown-linux-gnu"
-#cp "target/${arch}-unknown-linux-gnu/release/foo" "${prefix}/bin/"
-#EOF
+check-github-release-asset "d3witt/viking" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-# python
-#COPY --link --from=python / /usr/local/
-#COPY --link --from=shiv / /usr/local/
-#RUN <<EOF
-#apt-get update
-#apt-get -y install --no-install-recommends \
-#    python3-pip \
-#    python3-venv \
-#    python-is-python3
-#EOF
-#RUN <<EOF
-#shiv --output-file "${prefix}/bin/foo" --console-script foo "foo==${version}"
-#EOF
-
-# node
-#COPY --link --from=nodejs / /usr/local/
-#COPY --link --from=npm / /usr/local/
-#WORKDIR /uniget_bootstrap/libexec/foo
-#ARG name
-#ARG version
-#RUN <<EOF
-#npm install \
-#    --omit=dev \
-#    "foo@${version}"
-#ln --symbolic --relative --force "${prefix}/libexec/foo/node_modules/.bin/foo" "${prefix}/bin/"
-#EOF
-
-# c
-#COPY --link --from=make / /usr/local/
-#WORKDIR /tmp/foo
-#RUN <<EOF
-#git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/foo/bar .
-#./configure --prefix="${prefix}"
-#make LDFLAGS=-static
-#make install
-#EOF
-
-# dummy for testing
-#RUN <<EOF
-#touch "${prefix}/foo"
-#EOF
-
-# completion
-#RUN <<EOF
-#"${prefix}/bin/foo" completion bash >"${prefix}/share/bash-completion/completions/foo"
-#"${prefix}/bin/foo" completion fish >"${prefix}/share/fish/vendor_completions.d/foo.fish"
-#"${prefix}/bin/foo" completion zsh >"${prefix}/share/zsh/vendor-completions/_foo"
-#EOF
\ No newline at end of file
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+    viking
+EOF
\ No newline at end of file
diff --git a/tools/visidata/Dockerfile.template b/tools/visidata/Dockerfile.template
index 4b60578d15..54b62aaf57 100644
--- a/tools/visidata/Dockerfile.template
+++ b/tools/visidata/Dockerfile.template
@@ -8,11 +8,11 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/visidata" --console-script visidata "visidata==${version}"
 ln --symbolic --relative --force "${prefix}/bin/visidata" "${prefix}/bin/vd"
 EOF
\ No newline at end of file
diff --git a/tools/vland/Dockerfile.template b/tools/vland/Dockerfile.template
index 661d533dd8..18ceb303e6 100644
--- a/tools/vland/Dockerfile.template
+++ b/tools/vland/Dockerfile.template
@@ -7,8 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail --output "${prefix}/bin/vland" \
-    "https://github.com/parke/vland/raw/${version}/vland"
-chmod +x "${prefix}/bin/vland"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/parke/vland/raw/${version}/vland"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/vland"
 EOF
\ No newline at end of file
diff --git a/tools/vscode-cli/Dockerfile.template b/tools/vscode-cli/Dockerfile.template
index 46283eb3e9..72db74cb19 100644
--- a/tools/vscode-cli/Dockerfile.template
+++ b/tools/vscode-cli/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,13 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-download "https://update.code.visualstudio.com/${version}/cli-linux-${arch_suffix}/stable"
+url="https://update.code.visualstudio.com/${version}/cli-linux-${arch_suffix}/stable"
+filename="(basename "${url}")"
 
-curl --silent --show-error --location --fail "https://update.code.visualstudio.com/${version}/cli-linux-${arch_suffix}/stable" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/vulnerability-operator/Dockerfile.template b/tools/vulnerability-operator/Dockerfile.template
index e4b17d741a..f5bc88ed48 100644
--- a/tools/vulnerability-operator/Dockerfile.template
+++ b/tools/vulnerability-operator/Dockerfile.template
@@ -10,9 +10,8 @@ SHELL [ "bash", "-clo", "errexit" ]
 COPY --link --from=cosign / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 check-github-release-asset "ckotzbauer/vulnerability-operator" "${version}" "vulnerability-operator_${version}_linux_${alt_arch}.tar.gz"
-
 echo "### Downloading vulnerability-operator ${version}"
 curl --silent --show-error --location --fail --remote-name "https://github.com/ckotzbauer/vulnerability-operator/releases/download/${version}/vulnerability-operator_${version}_linux_${alt_arch}.tar.gz"
 
@@ -32,6 +31,6 @@ COSIGN_EXPERIMENTAL=1 cosign verify-blob "vulnerability-operator_${version}_linu
     --certificate-github-workflow-trigger workflow_dispatch
 
 echo "### Extracting vulnerability-operator ${version}"
-tar --extract --gzip --file "vulnerability-operator_${version}_linux_${alt_arch}.tar.gz" --directory="${prefix}/bin/" --no-same-owner \
+tar --extract --gzip --file="vulnerability-operator_${version}_linux_${alt_arch}.tar.gz" --directory="${prefix}/bin/" --no-same-owner \
     vulnerability-operator
 EOF
diff --git a/tools/wagi/Dockerfile.template b/tools/wagi/Dockerfile.template
index 3c5e5bf8a1..6cf894ef9b 100644
--- a/tools/wagi/Dockerfile.template
+++ b/tools/wagi/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="${alt_arch}"
@@ -20,8 +20,15 @@ case "${alt_arch}" in
         exit 1
         ;;
 esac
-check-github-release-asset "deislabs/wagi" "v${version}" "wagi-v${version}-linux-${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/deislabs/wagi/releases/download/v${version}/wagi-v${version}-linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+
+url="https://github.com/deislabs/wagi/releases/download/v${version}/wagi-v${version}-linux-${arch_suffix}.tar.gz"
+filename="(basename "${url}")"
+
+check-github-release-asset "deislabs/wagi" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     wagi
 EOF
\ No newline at end of file
diff --git a/tools/wait-for/Dockerfile.template b/tools/wait-for/Dockerfile.template
index 326c645972..d278f455da 100644
--- a/tools/wait-for/Dockerfile.template
+++ b/tools/wait-for/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "dnnrly/wait-for" "v${version}" "wait-for_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/dnnrly/wait-for/releases/download/v${version}/wait-for_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/dnnrly/wait-for/releases/download/v${version}/wait-for_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "dnnrly/wait-for" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     wait-for
 EOF
\ No newline at end of file
diff --git a/tools/wait/Dockerfile.template b/tools/wait/Dockerfile.template
index 4705947f64..9bda81cc34 100644
--- a/tools/wait/Dockerfile.template
+++ b/tools/wait/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ufoscout/docker-compose-wait" "${version}" "wait_${arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/wait" \
-    "https://github.com/ufoscout/docker-compose-wait/releases/download/${version}/wait_${arch}"
-chmod +x "${prefix}/bin/wait"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ufoscout/docker-compose-wait/releases/download/${version}/wait_${arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ufoscout/docker-compose-wait" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/wait"
+
 EOF
\ No newline at end of file
diff --git a/tools/walk/Dockerfile.template b/tools/walk/Dockerfile.template
index 4501263fea..b1235adee5 100644
--- a/tools/walk/Dockerfile.template
+++ b/tools/walk/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "antonmedv/walk" "v${version}" "walk_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/walk" \
-    "https://github.com/antonmedv/walk/releases/download/v${version}/walk_linux_${alt_arch}"
-chmod +x "${prefix}/bin/walk"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/antonmedv/walk/releases/download/v${version}/walk_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "antonmedv/walk" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/walk"
+
 EOF
\ No newline at end of file
diff --git a/tools/warp/Dockerfile.template b/tools/warp/Dockerfile.template
index af3b629292..8cf7aec978 100644
--- a/tools/warp/Dockerfile.template
+++ b/tools/warp/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,11 +23,15 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "minio/warp" "v${version}" "warp_Linux_${arch_suffix}.tar.gz"
+url="https://github.com/minio/warp/releases/download/v${version}/warp_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
 
-echo "### Downloading warp ${version}"
-curl --silent --show-error --location --fail "https://github.com/minio/warp/releases/download/v${version}/warp_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+check-github-release-asset "minio/warp" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     warp
 
 cat <<"EOT" >"${prefix}/share/bash-completion/completions/warp"
diff --git a/tools/wasmedge/Dockerfile.template b/tools/wasmedge/Dockerfile.template
index c061a94b1e..217a6ee9f1 100644
--- a/tools/wasmedge/Dockerfile.template
+++ b/tools/wasmedge/Dockerfile.template
@@ -7,8 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "WasmEdge/WasmEdge" "${version}" "WasmEdge-${version}-manylinux2014_${arch}.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/WasmEdge/WasmEdge/releases/download/${version}/WasmEdge-${version}-manylinux2014_${arch}.tar.xz" \
-| tar --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/WasmEdge/WasmEdge/releases/download/${version}/WasmEdge-${version}-manylinux2014_${arch}.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "WasmEdge/WasmEdge" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}" --strip-components=1 --no-same-owner
 EOF
\ No newline at end of file
diff --git a/tools/wasmer/Dockerfile.template b/tools/wasmer/Dockerfile.template
index 257bd1c944..06315fd956 100644
--- a/tools/wasmer/Dockerfile.template
+++ b/tools/wasmer/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 case "${alt_arch}" in
     amd64)
         export arch_suffix="${alt_arch}"
@@ -20,8 +20,15 @@ case "${alt_arch}" in
         exit 1
         ;;
 esac
-check-github-release-asset "wasmerio/wasmer" "v${version}" "wasmer-linux-${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/wasmerio/wasmer/releases/download/v${version}/wasmer-linux-${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}" --no-same-owner \
+
+url="https://github.com/wasmerio/wasmer/releases/download/v${version}/wasmer-linux-${arch_suffix}.tar.gz"
+filename="(basename "${url}")"
+
+check-github-release-asset "wasmerio/wasmer" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}" --no-same-owner \
     bin
 EOF
\ No newline at end of file
diff --git a/tools/wasmi/Dockerfile.template b/tools/wasmi/Dockerfile.template
index 2ea8fa9535..d676846770 100644
--- a/tools/wasmi/Dockerfile.template
+++ b/tools/wasmi/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=rust / /usr/local
 WORKDIR /tmp/github.com/wasmi-labs/wasmi
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/wasmi-labs/wasmi .
 sed -i -E "s/^version = \"[0-9]+\.[0-9]+\.[0-9]+(-[a-z]+\.[0-9]+)?\"/version = \"${version}\"/" crates/cli/Cargo.toml
 export CARGO_HOME=/usr/local/cargo
diff --git a/tools/wasmtime/Dockerfile.template b/tools/wasmtime/Dockerfile.template
index 2fc11a4b7c..b427c7a8d1 100644
--- a/tools/wasmtime/Dockerfile.template
+++ b/tools/wasmtime/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "bytecodealliance/wasmtime" "v${version}" "wasmtime-v${version}-${arch}-linux.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/bytecodealliance/wasmtime/releases/download/v${version}/wasmtime-v${version}-${arch}-linux.tar.xz" \
-| tar --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/bytecodealliance/wasmtime/releases/download/v${version}/wasmtime-v${version}-${arch}-linux.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "bytecodealliance/wasmtime" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "wasmtime-v${version}-${arch}-linux/wasmtime"
 EOF
\ No newline at end of file
diff --git a/tools/watchexec/Dockerfile.template b/tools/watchexec/Dockerfile.template
index d0c1aa950f..70e8d2a2ea 100644
--- a/tools/watchexec/Dockerfile.template
+++ b/tools/watchexec/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "watchexec/watchexec" "v${version}" "watchexec-${version}-${arch}-unknown-linux-musl.tar.xz"
-curl --silent --show-error --location --fail "https://github.com/watchexec/watchexec/releases/download/v${version}/watchexec-${version}-${arch}-unknown-linux-musl.tar.xz" \
-| tar --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/watchexec/watchexec/releases/download/v${version}/watchexec-${version}-${arch}-unknown-linux-musl.tar.xz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "watchexec/watchexec" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --xz --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "watchexec-${version}-${arch}-unknown-linux-musl/watchexec" \
     "watchexec-${version}-${arch}-unknown-linux-musl/watchexec.1"
 
diff --git a/tools/watchtower/Dockerfile.template b/tools/watchtower/Dockerfile.template
index 85ab42ccc1..5d96020ac7 100644
--- a/tools/watchtower/Dockerfile.template
+++ b/tools/watchtower/Dockerfile.template
@@ -5,14 +5,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containrrr/watchtower/releases/download/v${version}/watchtower_linux_amd64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containrrr/watchtower" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "containrrr/watchtower" "v${version}" "watchtower_linux_amd64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containrrr/watchtower/releases/download/v${version}/watchtower_linux_amd64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     watchtower
 
 "${prefix}/bin/watchtower" completion bash >"${prefix}/share/bash-completion/completions/watchtower"
diff --git a/tools/webdavfs/Dockerfile.template b/tools/webdavfs/Dockerfile.template
index 474b08cbd4..8bcd9df459 100644
--- a/tools/webdavfs/Dockerfile.template
+++ b/tools/webdavfs/Dockerfile.template
@@ -11,7 +11,7 @@ COPY --link --from=go / /usr/local/
 WORKDIR /go/src/github.com/miquels/webdavfs
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/miquels/webdavfs" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/miquels/webdavfs .
 export CGO_ENABLED=0
diff --git a/tools/webhook-tester/Dockerfile.template b/tools/webhook-tester/Dockerfile.template
index eed8799993..7208eb0b04 100644
--- a/tools/webhook-tester/Dockerfile.template
+++ b/tools/webhook-tester/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "tarampampam/webhook-tester" "v${version}" "webhook-tester-linux-amd64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/webhook-tester" \
-    "https://github.com/tarampampam/webhook-tester/releases/download/v${version}/webhook-tester-linux-amd64"
-chmod +x "${prefix}/bin/webhook-tester"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/tarampampam/webhook-tester/releases/download/v${version}/webhook-tester-linux-amd64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "tarampampam/webhook-tester" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/webhook-tester"
+
 EOF
\ No newline at end of file
diff --git a/tools/webhook/Dockerfile.template b/tools/webhook/Dockerfile.template
index 376ee3dd66..86eafb7679 100644
--- a/tools/webhook/Dockerfile.template
+++ b/tools/webhook/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/adnanh/webhook
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/adnanh/webhook" "${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://github.com/adnanh/webhook .
 export CGO_ENABLED=0
diff --git a/tools/webhookd/Dockerfile.template b/tools/webhookd/Dockerfile.template
index fabbbb493d..7a9f019e77 100644
--- a/tools/webhookd/Dockerfile.template
+++ b/tools/webhookd/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ncarlier/webhookd" "v${version}" "webhookd-linux-${alt_arch}.tgz"
-curl --silent --show-error --location --fail "https://github.com/ncarlier/webhookd/releases/download/v${version}/webhookd-linux-${alt_arch}.tgz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ncarlier/webhookd/releases/download/v${version}/webhookd-linux-${alt_arch}.tgz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ncarlier/webhookd" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     webhookd
 EOF
\ No newline at end of file
diff --git a/tools/websocat/Dockerfile.template b/tools/websocat/Dockerfile.template
index f3cb405963..0dfbbbb297 100644
--- a/tools/websocat/Dockerfile.template
+++ b/tools/websocat/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "vi/websocat" "v${version}" "websocat.x86_64-unknown-linux-musl"
-curl --silent --show-error --location --fail --output "${prefix}/bin/websocat" \
-    "https://github.com/vi/websocat/releases/download/v${version}/websocat.x86_64-unknown-linux-musl"
-chmod +x "${prefix}/bin/websocat"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/vi/websocat/releases/download/v${version}/websocat.x86_64-unknown-linux-musl"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "vi/websocat" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/websocat"
+
 EOF
\ No newline at end of file
diff --git a/tools/wg/Dockerfile.template b/tools/wg/Dockerfile.template
index 3dcb646032..c9608db65f 100644
--- a/tools/wg/Dockerfile.template
+++ b/tools/wg/Dockerfile.template
@@ -7,15 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     linux-headers
 EOF
 COPY --link --from=make / /usr/local/
 WORKDIR /tmp/wireguard-tools
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 check-clone https://git.zx2c4.com/wireguard-tools "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://git.zx2c4.com/wireguard-tools .
 cd src
diff --git a/tools/whalebrew/Dockerfile.template b/tools/whalebrew/Dockerfile.template
index 7d07bd3ed0..46418df32d 100644
--- a/tools/whalebrew/Dockerfile.template
+++ b/tools/whalebrew/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "whalebrew/whalebrew" "${version}" "whalebrew-Linux-x86_64"
-curl --silent --show-error --location --fail --output "${prefix}/bin/whalebrew" \
-    "https://github.com/whalebrew/whalebrew/releases/download/${version}/whalebrew-Linux-x86_64"
-chmod +x "${prefix}/bin/whalebrew"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/whalebrew/whalebrew/releases/download/${version}/whalebrew-Linux-x86_64"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "whalebrew/whalebrew" "${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/whalebrew"
+
 
 "${prefix}/bin/whalebrew" completion bash >"${prefix}/share/bash-completion/completions/whalebrew"
 "${prefix}/bin/whalebrew" completion fish >"${prefix}/share/fish/vendor_completions.d/whalebrew.fish"
diff --git a/tools/win-gpg-agent/Dockerfile.template b/tools/win-gpg-agent/Dockerfile.template
index d185745c46..3280494fef 100644
--- a/tools/win-gpg-agent/Dockerfile.template
+++ b/tools/win-gpg-agent/Dockerfile.template
@@ -5,14 +5,17 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rupor-github/win-gpg-agent/releases/download/v${version}/win-gpg-agent.zip"
+filename="$(basename "${url}")"
+
+check-github-release-asset "rupor-github/win-gpg-agent" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "rupor-github/win-gpg-agent" "v${version}" "win-gpg-agent.zip"
-curl --silent --show-error --location --fail --remote-name "https://github.com/rupor-github/win-gpg-agent/releases/download/v${version}/win-gpg-agent.zip"
-unzip -q -o -d "/tmp" "win-gpg-agent.zip"
-rm "win-gpg-agent.zip"
-mv "/tmp/sorelay.exe" "${prefix}/bin"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
+    sorelay.exe
 EOF
\ No newline at end of file
diff --git a/tools/win-ssh-agent/Dockerfile.template b/tools/win-ssh-agent/Dockerfile.template
index d6a648c797..45256b5763 100644
--- a/tools/win-ssh-agent/Dockerfile.template
+++ b/tools/win-ssh-agent/Dockerfile.template
@@ -5,16 +5,19 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/rupor-github/wsl-ssh-agent/releases/download/v${version}/wsl-ssh-agent.zip"
+filename="$(basename "${url}")"
+
+check-github-release-asset "rupor-github/wsl-ssh-agent" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
 
-RUN <<EOF
-check-github-release-asset "rupor-github/wsl-ssh-agent" "v${version}" "wsl-ssh-agent.zip"
-curl --silent --show-error --location --fail --remote-name "https://github.com/rupor-github/wsl-ssh-agent/releases/download/v${version}/wsl-ssh-agent.zip"
-unzip -q -o -d "/tmp" "wsl-ssh-agent.zip"
-rm "wsl-ssh-agent.zip"
-mv "/tmp/npiperelay.exe" "${prefix}/bin"
-mv "/tmp/wsl-ssh-agent-gui.exe" "${prefix}/bin"
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}" \
+    npiperelay.exe \
+    wsl-ssh-agent-gui.exe
 EOF
 COPY wsl-ssh-agent-forward.sh /uniget_bootstrap/etc/profile.d/
\ No newline at end of file
diff --git a/tools/wireguard-go/Dockerfile.template b/tools/wireguard-go/Dockerfile.template
index 93663d067c..9b93f3b590 100644
--- a/tools/wireguard-go/Dockerfile.template
+++ b/tools/wireguard-go/Dockerfile.template
@@ -13,7 +13,7 @@ COPY --link --from=make / /usr/local/
 WORKDIR /go/src/git.zx2c4.com/wireguard-go
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone https://git.zx2c4.com/wireguard-go "${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "${version}" https://git.zx2c4.com/wireguard-go .
 make -j$(nproc)
diff --git a/tools/witness/Dockerfile.template b/tools/witness/Dockerfile.template
index e6fe395694..7ae91a39e3 100644
--- a/tools/witness/Dockerfile.template
+++ b/tools/witness/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "in-toto/witness" "v${version}" "witness_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/in-toto/witness/releases/download/v${version}/witness_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/in-toto/witness/releases/download/v${version}/witness_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "in-toto/witness" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     witness
 
 "${prefix}/bin/witness" completion bash >"${prefix}/share/bash-completion/completions/witness"
diff --git a/tools/wksctl/Dockerfile.template b/tools/wksctl/Dockerfile.template
index 6d6c79b6cf..51a9f6906b 100644
--- a/tools/wksctl/Dockerfile.template
+++ b/tools/wksctl/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "weaveworks/wksctl" "v${version}" "wksctl-${version}-linux-x86_64.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/weaveworks/wksctl/releases/download/v${version}/wksctl-${version}-linux-x86_64.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/share/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/weaveworks/wksctl/releases/download/v${version}/wksctl-${version}-linux-x86_64.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "weaveworks/wksctl" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/share/" --no-same-owner
 mv "${prefix}/share/wksctl" "${prefix}/bin/"
 mv "${prefix}/share/examples" "${prefix}/share/wksctl/"
 "${prefix}/bin/wksctl" bash-completions >"${prefix}/share/bash-completion/completions/wksctl"
diff --git a/tools/woke/Dockerfile.template b/tools/woke/Dockerfile.template
index 79e3d0cde7..1662fbce44 100644
--- a/tools/woke/Dockerfile.template
+++ b/tools/woke/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "get-woke/woke" "v${version}" "woke-${version}-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/get-woke/woke/releases/download/v${version}/woke-${version}-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/get-woke/woke/releases/download/v${version}/woke-${version}-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "get-woke/woke" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "woke-${version}-linux-${alt_arch}/woke"
 EOF
\ No newline at end of file
diff --git a/tools/wolfictl/Dockerfile.template b/tools/wolfictl/Dockerfile.template
index 923586ff03..0a49561038 100644
--- a/tools/wolfictl/Dockerfile.template
+++ b/tools/wolfictl/Dockerfile.template
@@ -8,12 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=go / /usr/local/
 COPY --link --from=make / /usr/local/
 WORKDIR /go/src/github.com/wolfi-dev/wolfictl
-RUN <<EOF
+ARG name
+ARG version
+RUN --mount=type=cache,target=/root/go/pkg/mod <<EOF
 check-clone "https://github.com/wolfi-dev/wolfictl" "v${version}"
 git clone -q --config advice.detachedHead=false --depth 1 --branch "v${version}" https://github.com/wolfi-dev/wolfictl .
 go install golang.org/x/tools/cmd/goimports@latest
diff --git a/tools/woodpecker/Dockerfile.template b/tools/woodpecker/Dockerfile.template
index a3b5aceee4..fe1b6d4edd 100644
--- a/tools/woodpecker/Dockerfile.template
+++ b/tools/woodpecker/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "woodpecker-ci/woodpecker" "v${version}" "woodpecker-server_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/woodpecker-ci/woodpecker/releases/download/v${version}/woodpecker-server_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/woodpecker-ci/woodpecker/releases/download/v${version}/woodpecker-server_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "woodpecker-ci/woodpecker" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner
 
 check-github-release-asset "woodpecker-ci/woodpecker" "v${version}" "woodpecker-agent_linux_${alt_arch}.tar.gz"
 curl --silent --show-error --location --fail "https://github.com/woodpecker-ci/woodpecker/releases/download/v${version}/woodpecker-agent_linux_${alt_arch}.tar.gz" \
diff --git a/tools/wordcloud/Dockerfile.template b/tools/wordcloud/Dockerfile.template
index f056b5b594..308fb3961a 100644
--- a/tools/wordcloud/Dockerfile.template
+++ b/tools/wordcloud/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/wordcloud_cli" --console-script wordcloud_cli "wordcloud==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/wsl-open/Dockerfile.template b/tools/wsl-open/Dockerfile.template
index 14710c7e53..7e0f05038f 100644
--- a/tools/wsl-open/Dockerfile.template
+++ b/tools/wsl-open/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/4U6U57/wsl-open/raw/v${version}/wsl-open.sh"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/wsl-open"
 
-RUN <<EOF
-check-download "https://github.com/4U6U57/wsl-open/raw/v${version}/wsl-open.sh"
-curl --silent --show-error --location --fail --output "${prefix}/bin/wsl-open" \
-    "https://github.com/4U6U57/wsl-open/raw/v${version}/wsl-open.sh"
-chmod +x "${prefix}/bin/wsl-open"
 
 check-download "https://github.com/4U6U57/wsl-open/raw/v${version}/wsl-open.1"
 curl --silent --show-error --location --fail --output "${prefix}/share/man/man1/wsl-open.1" \
diff --git a/tools/wslu/Dockerfile.template b/tools/wslu/Dockerfile.template
index f0f59c5bfc..9c28e7c8a7 100644
--- a/tools/wslu/Dockerfile.template
+++ b/tools/wslu/Dockerfile.template
@@ -11,9 +11,17 @@ COPY --link --from=make / /usr/local/
 WORKDIR /tmp/wslu
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail "https://github.com/wslutilities/wslu/archive/refs/tags/v${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/wslutilities/wslu/archive/refs/tags/v${version}.tar.gz"
+filename="$(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 make -j$(nproc) all
 make install "DESTDIR=${prefix}" "PREFIX="
 EOF
\ No newline at end of file
diff --git a/tools/xcaddy/Dockerfile.template b/tools/xcaddy/Dockerfile.template
index 686f916765..955fafc235 100644
--- a/tools/xcaddy/Dockerfile.template
+++ b/tools/xcaddy/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "caddyserver/xcaddy" "v${version}" "xcaddy_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/caddyserver/xcaddy/releases/download/v${version}/xcaddy_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/caddyserver/xcaddy/releases/download/v${version}/xcaddy_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "caddyserver/xcaddy" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     xcaddy
 EOF
\ No newline at end of file
diff --git a/tools/xdg-utils/Dockerfile.template b/tools/xdg-utils/Dockerfile.template
index 1c5c984079..dac8241eec 100644
--- a/tools/xdg-utils/Dockerfile.template
+++ b/tools/xdg-utils/Dockerfile.template
@@ -7,21 +7,28 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
 apt-get update
 apt-get -y install --no-install-recommends \
     xsltproc \
     xmlto \
     lynx
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/xdg-utils
 ARG name
 ARG version
-RUN <<EOF
-check-download "https://gitlab.freedesktop.org/xdg/xdg-utils/-/archive/v${version}/xdg-utils-v${version}.tar.gz"
-curl --silent --show-error --location --fail "https://gitlab.freedesktop.org/xdg/xdg-utils/-/archive/v${version}/xdg-utils-v${version}.tar.gz" \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://gitlab.freedesktop.org/xdg/xdg-utils/-/archive/v${version}/xdg-utils-v${version}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 ./configure --prefix="${prefix}"
 make -j$(nproc)
 make install
diff --git a/tools/xh/Dockerfile.template b/tools/xh/Dockerfile.template
index fe34bcc15e..e2f7e390f6 100644
--- a/tools/xh/Dockerfile.template
+++ b/tools/xh/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "ducaale/xh" "v${version}" "xh-v${version}-${arch}-unknown-linux-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/ducaale/xh/releases/download/v${version}/xh-v${version}-${arch}-unknown-linux-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/ducaale/xh/releases/download/v${version}/xh-v${version}-${arch}-unknown-linux-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "ducaale/xh" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     "xh-v${version}-${arch}-unknown-linux-musl/xh" \
     "xh-v${version}-${arch}-unknown-linux-musl/completions" \
     "xh-v${version}-${arch}-unknown-linux-musl/doc/xh.1"
diff --git a/tools/xmlstarlet/Dockerfile.template b/tools/xmlstarlet/Dockerfile.template
index d8a41b3ca6..4a1a23775a 100644
--- a/tools/xmlstarlet/Dockerfile.template
+++ b/tools/xmlstarlet/Dockerfile.template
@@ -7,9 +7,8 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-COPY --link --from=make / /usr/local/
-RUN <<EOF
-apk add --update-cache --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk <<EOF
+apk add --update-cache \
     ghostscript \
     libxml2-dev \
     libxml2-static \
@@ -24,12 +23,21 @@ apk add --update-cache --no-cache \
     libgpg-error-dev \
     libgpg-error-static
 EOF
+COPY --link --from=make / /usr/local/
 WORKDIR /tmp/xmlstarlet
 ARG name
 ARG version
-RUN <<EOF
-curl --silent --show-error --location --fail https://sourceforge.net/projects/xmlstar/files/xmlstarlet/${version}/xmlstarlet-${version}.tar.gz/download \
-| tar --extract --gzip --strip-components=1
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://sourceforge.net/projects/xmlstar/files/xmlstarlet/${version}/xmlstarlet-${version}.tar.gz/download"
+filename="(basename "${url}")"
+
+check-download "${url}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --strip-components=1
+
 ./configure --prefix="${prefix}" --enable-static-libs --enable-build-docs
 make LDFLAGS="-static" LIBS="-llzma -lgcrypt -lgpg-error"
 make install DESTDIR="${prefix}" prefix=""
diff --git a/tools/xq/Dockerfile.template b/tools/xq/Dockerfile.template
index ee9d5b313b..5a736b5732 100644
--- a/tools/xq/Dockerfile.template
+++ b/tools/xq/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "sibprogrammer/xq" "v${version}" "xq_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/sibprogrammer/xq/releases/download/v${version}/xq_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/sibprogrammer/xq/releases/download/v${version}/xq_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "sibprogrammer/xq" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     xq
 EOF
\ No newline at end of file
diff --git a/tools/xurls/Dockerfile.template b/tools/xurls/Dockerfile.template
index e0d9d6ef59..6c2ac87bed 100644
--- a/tools/xurls/Dockerfile.template
+++ b/tools/xurls/Dockerfile.template
@@ -7,9 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mvdan/xurls" "v${version}" "xurls_v${version}_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/xurls" \
-    "https://github.com/mvdan/xurls/releases/download/v${version}/xurls_v${version}_linux_${alt_arch}"
-chmod +x "${prefix}/bin/xurls"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mvdan/xurls/releases/download/v${version}/xurls_v${version}_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mvdan/xurls" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/xurls"
+
 EOF
\ No newline at end of file
diff --git a/tools/yamale/Dockerfile.template b/tools/yamale/Dockerfile.template
index 8f43db4a28..1f6b299897 100644
--- a/tools/yamale/Dockerfile.template
+++ b/tools/yamale/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/yamale" --console-script yamale "yamale==${version}"
 EOF
\ No newline at end of file
diff --git a/tools/yamlfmt/Dockerfile.template b/tools/yamlfmt/Dockerfile.template
index 1cbe08f890..acd468346f 100644
--- a/tools/yamlfmt/Dockerfile.template
+++ b/tools/yamlfmt/Dockerfile.template
@@ -7,7 +7,7 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 echo "### Setting architecture string for ${TARGETPLATFORM}"
 case "${arch}" in
     x86_64)
@@ -23,8 +23,14 @@ case "${arch}" in
 esac
 echo "    Using ${arch_suffix}"
 
-check-github-release-asset "google/yamlfmt" "v${version}" "yamlfmt_${version}_Linux_${arch_suffix}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/google/yamlfmt/releases/download/v${version}/yamlfmt_${version}_Linux_${arch_suffix}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+url="https://github.com/google/yamlfmt/releases/download/v${version}/yamlfmt_${version}_Linux_${arch_suffix}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "google/yamlfmt" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     yamlfmt
 EOF
\ No newline at end of file
diff --git a/tools/yamllint/Dockerfile.template b/tools/yamllint/Dockerfile.template
index 9f6d663920..b885fa4a9e 100644
--- a/tools/yamllint/Dockerfile.template
+++ b/tools/yamllint/Dockerfile.template
@@ -12,6 +12,6 @@ COPY --link --from=python / /usr/local/
 COPY --link --from=shiv / /usr/local/
 ARG name
 ARG version
-RUN <<EOF
+RUN --mount=type=cache,target=/root/.cache/pip <<EOF
 shiv --output-file "${prefix}/bin/yamllint" --console-script yamllint "yamllint==${version}"
 EOF
diff --git a/tools/yarn/Dockerfile.template b/tools/yarn/Dockerfile.template
index 9dd2bd87f9..b3ee0c37f4 100644
--- a/tools/yarn/Dockerfile.template
+++ b/tools/yarn/Dockerfile.template
@@ -8,14 +8,12 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-ARG name
-ARG version
 COPY --link --from=nodejs / /usr/local/
 COPY --link --from=npm / /usr/local/
 WORKDIR /uniget_bootstrap/libexec/yarn
 ARG name
 ARG version
-RUN <<EOF
+RUN <<EOF # no download cache
 npm install \
     --omit=dev \
     "yarn@${version}"
diff --git a/tools/yasu/Dockerfile.template b/tools/yasu/Dockerfile.template
index 633dd47bce..dd1c7a714a 100644
--- a/tools/yasu/Dockerfile.template
+++ b/tools/yasu/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "crazy-max/yasu" "v${version}" "yasu_${version}_linux_${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/crazy-max/yasu/releases/download/v${version}/yasu_${version}_linux_${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/crazy-max/yasu/releases/download/v${version}/yasu_${version}_linux_${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "crazy-max/yasu" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin" --no-same-owner \
     ./yasu
 EOF
\ No newline at end of file
diff --git a/tools/yh/Dockerfile.template b/tools/yh/Dockerfile.template
index 5a692b2dfd..705316e916 100644
--- a/tools/yh/Dockerfile.template
+++ b/tools/yh/Dockerfile.template
@@ -7,11 +7,14 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "andreazorzetto/yh" "v${version}" "yh-linux-amd64.zip"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
 url="https://github.com/andreazorzetto/yh/releases/download/v${version}/yh-linux-amd64.zip"
-filename="$(basename "${url}")"
-echo "Downloading ${filename} from ${url}."
-curl --silent --show-error --location --fail --remote-name "${url}"
-unzip -q -o -d "${prefix}/bin" "${filename}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "andreazorzetto/yh" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+unzip -t "${uniget_cache_download}/${filename}"
+unzip -q -o -d "${prefix}/bin" "${uniget_cache_download}/${filename}"
 EOF
\ No newline at end of file
diff --git a/tools/youki/Dockerfile.template b/tools/youki/Dockerfile.template
index ee686eab2b..b35f08a218 100644
--- a/tools/youki/Dockerfile.template
+++ b/tools/youki/Dockerfile.template
@@ -7,9 +7,15 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "containers/youki" "v${version}" "youki-${version}-${arch}-musl.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/containers/youki/releases/download/v${version}/youki-${version}-${arch}-musl.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/containers/youki/releases/download/v${version}/youki-${version}-${arch}-musl.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "containers/youki" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     youki
 EOF
\ No newline at end of file
diff --git a/tools/yq/Dockerfile.template b/tools/yq/Dockerfile.template
index b04c4cc1ca..bddd7be75a 100644
--- a/tools/yq/Dockerfile.template
+++ b/tools/yq/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "mikefarah/yq" "v${version}" "yq_linux_${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/yq" \
-    "https://github.com/mikefarah/yq/releases/download/v${version}/yq_linux_${alt_arch}"
-chmod +x "${prefix}/bin/yq"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/mikefarah/yq/releases/download/v${version}/yq_linux_${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "mikefarah/yq" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/yq"
+
 "${prefix}/bin/yq" shell-completion bash >"${prefix}/share/bash-completion/completions/yq"
 "${prefix}/bin/yq" shell-completion fish >"${prefix}/share/fish/vendor_completions.d/yq.fish"
 "${prefix}/bin/yq" shell-completion zsh >"${prefix}/share/zsh/vendor-completions/_yq"
diff --git a/tools/ytt/Dockerfile.template b/tools/ytt/Dockerfile.template
index c925c80edf..e12e6182d7 100644
--- a/tools/ytt/Dockerfile.template
+++ b/tools/ytt/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "carvel-dev/ytt" "v${version}" "ytt-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/ytt" \
-    "https://github.com/carvel-dev/ytt/releases/download/v${version}/ytt-linux-${alt_arch}"
-chmod +x "${prefix}/bin/ytt"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/carvel-dev/ytt/releases/download/v${version}/ytt-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "carvel-dev/ytt" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/ytt"
+
 "${prefix}/bin/ytt" completion bash >"${prefix}/share/bash-completion/completions/ytt"
 "${prefix}/bin/ytt" completion fish >"${prefix}/share/fish/vendor_completions.d/ytt.fish"
 "${prefix}/bin/ytt" completion zsh >"${prefix}/share/zsh/vendor-completions/_ytt"
diff --git a/tools/zed/Dockerfile.template b/tools/zed/Dockerfile.template
index 917dd7ad84..e5e8eb4e0e 100644
--- a/tools/zed/Dockerfile.template
+++ b/tools/zed/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "brimdata/zed" "v${version}" "zed-v${version}.linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/brimdata/zed/releases/download/v${version}/zed-v${version}.linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/brimdata/zed/releases/download/v${version}/zed-v${version}.linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "brimdata/zed" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --no-same-owner \
     zed \
     zq
 EOF
\ No newline at end of file
diff --git a/tools/zeitgeist/Dockerfile.template b/tools/zeitgeist/Dockerfile.template
index c771e837a0..5df7c43142 100644
--- a/tools/zeitgeist/Dockerfile.template
+++ b/tools/zeitgeist/Dockerfile.template
@@ -7,11 +7,18 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "kubernetes-sigs/zeitgeist" "v${version}" "zeitgeist-${alt_arch}-linux"
-curl --silent --show-error --location --fail --output "${prefix}/bin/zeitgeist" \
-    "https://github.com/kubernetes-sigs/zeitgeist/releases/download/v${version}/zeitgeist-${alt_arch}-linux"
-chmod +x "${prefix}/bin/zeitgeist"
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/kubernetes-sigs/zeitgeist/releases/download/v${version}/zeitgeist-${alt_arch}-linux"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "kubernetes-sigs/zeitgeist" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/zeitgeist"
+
 "${prefix}/bin/zeitgeist" completion bash >"${prefix}/share/bash-completion/completions/zeitgeist"
 "${prefix}/bin/zeitgeist" completion fish >"${prefix}/share/fish/vendor_completions.d/zeitgeist.fish"
 "${prefix}/bin/zeitgeist" completion zsh >"${prefix}/share/zsh/vendor-completions/_zeitgeist"
diff --git a/tools/zitadel/Dockerfile.template b/tools/zitadel/Dockerfile.template
index dc94e6bc36..8f0cccbd8b 100644
--- a/tools/zitadel/Dockerfile.template
+++ b/tools/zitadel/Dockerfile.template
@@ -7,10 +7,16 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
 SHELL [ "bash", "-clo", "errexit" ]
 ARG name
 ARG version
-RUN <<EOF
-check-github-release-asset "zitadel/zitadel" "v${version}" "zitadel-linux-${alt_arch}.tar.gz"
-curl --silent --show-error --location --fail "https://github.com/zitadel/zitadel/releases/download/v${version}/zitadel-linux-${alt_arch}.tar.gz" \
-| tar --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/zitadel/zitadel/releases/download/v${version}/zitadel-linux-${alt_arch}.tar.gz"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "zitadel/zitadel" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+tar --file="${uniget_cache_download}/${filename}" --list
+tar --file="${uniget_cache_download}/${filename}" --extract --gzip --directory="${prefix}/bin/" --strip-components=1 --no-same-owner \
     zitadel-linux-${alt_arch}/zitadel
 
 "${prefix}/bin/zitadel" completion bash >"${prefix}/share/bash-completion/completions/zitadel"
diff --git a/tools/zot/Dockerfile.template b/tools/zot/Dockerfile.template
index f58e7017cc..f1cbbd8b3e 100644
--- a/tools/zot/Dockerfile.template
+++ b/tools/zot/Dockerfile.template
@@ -5,15 +5,20 @@ COPY --from=ghcr.io/uniget-org/tools/uniget-build:latest \
     /etc/profile.d/ \
     /etc/profile.d/
 SHELL [ "bash", "-clo", "errexit" ]
-
 ARG name
 ARG version
+RUN --mount=type=cache,target=/var/cache/uniget/download <<EOF
+url="https://github.com/project-zot/zot/releases/download/v${version}/zot-linux-${alt_arch}"
+filename="$( basename "${url}" )"
+
+check-github-release-asset "project-zot/zot" "v${version}" "${filename}"
+curl --silent --show-error --location --fail --output "${uniget_cache_download}/${filename}" \
+    "${url}"
+
+install --mode=0755 \
+    "${uniget_cache_download}/${filename}" \
+    "${prefix}/bin/zot"
 
-RUN <<EOF
-check-github-release-asset "project-zot/zot" "v${version}" "zot-linux-${alt_arch}"
-curl --silent --show-error --location --fail --output "${prefix}/bin/zot" \
-    "https://github.com/project-zot/zot/releases/download/v${version}/zot-linux-${alt_arch}"
-chmod +x "${prefix}/bin/zot"
 "${prefix}/bin/zot" completion bash >"${prefix}/share/bash-completion/completions/zot"
 "${prefix}/bin/zot" completion fish >"${prefix}/share/fish/vendor_completions.d/zot.fish"
 "${prefix}/bin/zot" completion zsh >"${prefix}/share/zsh/vendor-completions/_zot"