> Treat cache mounts like shared volumes: never bake secrets into them and periodically invalidate them with --build-arg CACHE_BUST=$(date +%s) when dependencies change.

Kind of a bummer. If build tools were better, this would never be necessary.