diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
index 2fc247a..a701809 100644
--- a/.tangled/workflows/ci.yml
+++ b/.tangled/workflows/ci.yml
@@ -8,26 +8,29 @@ engine: "nixery"
 
 dependencies:
   nixpkgs:
-    - go
-    - gnugrep
-    - gawk
     - coreutils
     - docker
+    - gawk
+    - gnugrep
+    - go
+    - ko
 
 steps:
   - name: "Test with coverage"
     environment:
       CGO_ENABLED: "0"
+      GOCACHE: "/tangled/workspace/.cache/go-build"
+      GOMODCACHE: "/tangled/workspace/.cache/go-mod"
     command: |
       ./check-coverage
 
   - name: "Build and push image"
     environment:
       CGO_ENABLED: "0"
+      GOCACHE: "/tangled/workspace/.cache/go-build"
+      GOMODCACHE: "/tangled/workspace/.cache/go-mod"
       KO_DOCKER_REPO: "atcr.io/guid.foo/wicket"
     command: |
-      go install github.com/google/ko@latest
-      export PATH="$(go env GOPATH)/bin:$PATH"
       export VERSION="$(date -u +%Y%m%d%H%M%S)-$(git rev-parse --short HEAD)"
       echo "${ATCR_APP_PASSWORD}" | docker login atcr.io -u guid.foo --password-stdin
       ko build --bare --tags "latest,${VERSION}" .