diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml
index 007020c4..60cc03fb 100644
--- a/.github/workflows/container-ci.yml
+++ b/.github/workflows/container-ci.yml
@@ -256,7 +256,13 @@ jobs:
             id=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT/jobs" \
                    --paginate --jq ".jobs[] | select(.name == \"$1\") | .id" | head -n 1)
             [ -n "$id" ] || { echo "::warning::no job named '$1' in this run attempt"; return 1; }
-            gh api "repos/$GITHUB_REPOSITORY/actions/jobs/$id/logs" \
+            # Job logs carry ANSI colour codes, which newer gh releases refuse
+            # to print ("terminal escape sequences"), and older ones lack the
+            # override flag. Fetch them with curl; only 64-hex digest lines
+            # survive the grep. -L follows the signed redirect without
+            # forwarding the token to the other host.
+            curl -fsSL --proto '=https' -H "Authorization: Bearer $GH_TOKEN" \
+              "${GITHUB_API_URL:-https://api.github.com}/repos/$GITHUB_REPOSITORY/actions/jobs/$id/logs" \
               | sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' \
               | sed -n '/^FS-FINGERPRINT-BEGIN$/,/^FS-FINGERPRINT-END$/p' \
               | grep -E '^[0-9a-f]{64}  '
diff --git a/Containerfile b/Containerfile
index 16e7a64c..5cf199d5 100644
--- a/Containerfile
+++ b/Containerfile
@@ -87,11 +87,15 @@ LABEL org.opencontainers.image.licenses="MPL-2.0"
 LABEL org.opencontainers.image.version="1.5.0"
 LABEL org.opencontainers.image.vendor="hyperpolymath"
 
+# Wolfi's apk commit hook runs ldconfig, whose aux-cache records the build
+# host's inode numbers and timestamps. Drop it so two builds of one commit
+# give the same layer; ld.so.cache itself is deterministic and kept.
 RUN apk add --no-cache \
     ca-certificates \
     libssl3 \
     gmp \
-    libstdc++
+    libstdc++ \
+    && rm -f /var/cache/ldconfig/aux-cache
 
 WORKDIR /app