diff --git a/.github/actions/setup-nativelink-cloud/action.yaml b/.github/actions/setup-nativelink-cloud/action.yaml
index 5165e4dd3f1..f259a5d15a0 100644
--- a/.github/actions/setup-nativelink-cloud/action.yaml
+++ b/.github/actions/setup-nativelink-cloud/action.yaml
@@ -77,7 +77,7 @@ inputs:
 
 outputs:
   enabled:
-    description: "'true' when a user.bazelrc was written, else 'false'."
+    description: "'true' when remote cache or execution is enabled, else 'false'."
     value: ${{ steps.configure.outputs.enabled }}
 
 runs:
diff --git a/.github/workflows/native-bazel.yaml b/.github/workflows/native-bazel.yaml
index fd60d6eb788..b63f5d02f87 100644
--- a/.github/workflows/native-bazel.yaml
+++ b/.github/workflows/native-bazel.yaml
@@ -49,15 +49,8 @@ jobs:
       - name: Free disk space
         uses: ./.github/actions/free-disk
 
-      - name: Setup Bazel
-        uses: >- # v0.19.0
-          bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86
-        with:
-          bazelisk-cache: true
-          repository-cache: true
-          disk-cache: ${{ github.workflow }}-${{ matrix.os }}-bazel-${{ matrix.bazel_version }}
-
       - name: Setup NativeLink Cloud
+        id: setup-nativelink-cloud
         uses: ./.github/actions/setup-nativelink-cloud
         with:
           ci-mode: ${{ vars.NATIVELINK_CI_MODE }}
@@ -72,6 +65,19 @@ jobs:
           # non-Linux runners, so macOS lanes fall back to cache.
           exec: ${{ runner.os == 'Linux' && 'on' || 'off' }}
 
+      - name: Setup Bazel
+        uses: >- # v0.19.0
+          bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86
+        with:
+          bazelisk-cache: true
+          repository-cache: true
+          # Enable the disk cache when we don't have a usable remote cache.
+          # The Bazel 8 lane runs --lockfile_mode=off and gets ~2.6% hits on
+          # the Bazel-9-keyed remote cache, so it is effectively cache-cold;
+          # give it a persistent disk cache (keyed per bazel_version by the
+          # action) so repeat runs reuse its own compile outputs.
+          disk-cache: ${{ steps.setup-nativelink-cloud.outputs.enabled == 'false' || matrix.bazel_version == '8.7.0' }}
+
       - name: Show Bazel version
         run: bazel --version
 
@@ -119,15 +125,8 @@ jobs:
         with:
           compose-file: src/bin/docker-compose.store-tester.yaml
 
-      - name: Setup Bazel
-        uses: >- # v0.19.0
-          bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86
-        with:
-          bazelisk-cache: true
-          repository-cache: true
-          disk-cache: ${{ github.workflow }}-ubuntu-24.04
-
       - name: Setup NativeLink Cloud
+        id: setup-nativelink-cloud
         uses: ./.github/actions/setup-nativelink-cloud
         with:
           ci-mode: ${{ vars.NATIVELINK_CI_MODE }}
@@ -142,6 +141,16 @@ jobs:
           # non-Linux runners, so macOS lanes fall back to cache.
           exec: ${{ runner.os == 'Linux' && 'on' || 'off' }}
 
+      - name: Setup Bazel
+        uses: >- # v0.19.0
+          bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86
+        with:
+          bazelisk-cache: true
+          repository-cache: true
+          # Only enable when we don't have remote cache, otherwise it just gets very slow
+          # and enormous
+          disk-cache: ${{ steps.setup-nativelink-cloud.outputs.enabled == 'false'}}
+
       - name: Run Store tester with sentinel
         run: |
           bazel run //:redis_store_tester \