diff --git a/.github/workflows/check-crypto-providers.yml b/.github/workflows/check-crypto-providers.yml
index 73b92ab5ac..0a61dc61ca 100644
--- a/.github/workflows/check-crypto-providers.yml
+++ b/.github/workflows/check-crypto-providers.yml
@@ -25,5 +25,7 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Run crypto provider check
         run: ./scripts/check_crypto_providers.sh
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 665833f397..ef19307254 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -46,6 +46,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: coverage
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Generate code coverage (including doc tests)
         env:
           # Override rust-toolchain.toml so cargo-llvm-cov runs on the dated
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 3cc6e1c268..e1c9e46c8c 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -66,6 +66,8 @@ jobs:
       with:
         cache-targets: true # cache build artifacts
         cache-bin: true # cache the ~/.cargo/bin directory
+        shared-key: fuzz
+        save-if: ${{ github.ref == 'refs/heads/main' }}
     - env:
         # Override rust-toolchain.toml so cargo-bolero runs on the dated nightly.
         RUSTUP_TOOLCHAIN: ${{ steps.nightly-version.outputs.version }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3ba3d0405f..67dd1cb302 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -92,6 +92,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: lint
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Run rustfmt
         env:
           FMT_PACKAGES: ${{ needs.setup.outputs.fmt-packages }}
@@ -139,6 +141,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: all-features
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Run clippy on ${{ matrix.platform }} ${{ matrix.rust_version }}
         shell: bash
         env:
diff --git a/.github/workflows/miri.yml b/.github/workflows/miri.yml
index ea92d30cc9..3361ba3a57 100644
--- a/.github/workflows/miri.yml
+++ b/.github/workflows/miri.yml
@@ -85,6 +85,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: miri
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - env:
           # Override rust-toolchain.toml so miri runs on the dated nightly
           # (miri is nightly-only) instead of the workspace MSRV.
diff --git a/.github/workflows/pr-metadata-docs-and-deps.yml b/.github/workflows/pr-metadata-docs-and-deps.yml
index e4bb00ab8d..403dd98780 100644
--- a/.github/workflows/pr-metadata-docs-and-deps.yml
+++ b/.github/workflows/pr-metadata-docs-and-deps.yml
@@ -107,6 +107,8 @@ jobs:
     - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
       with:
         cache-targets: true
+        shared-key: default
+        save-if: ${{ github.ref == 'refs/heads/main' }}
     - uses: dtolnay/rust-toolchain@stable
     - name: Check missing docs
       id: missing-docs
@@ -278,6 +280,8 @@ jobs:
     - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
       with:
         cache-targets: true
+        shared-key: default
+        save-if: ${{ github.ref == 'refs/heads/main' }}
     - uses: dtolnay/rust-toolchain@stable
     - uses: taiki-e/cache-cargo-install-action@7447f04c51f2ba27ca35e7f1e28fab848c5b3ba7 # 2.3.1
       with:
diff --git a/.github/workflows/pr-title-semver-check.yml b/.github/workflows/pr-title-semver-check.yml
index 5024f04e84..6c97606199 100644
--- a/.github/workflows/pr-title-semver-check.yml
+++ b/.github/workflows/pr-title-semver-check.yml
@@ -104,6 +104,8 @@ jobs:
         uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # 2.8.1
         with:
           cache-targets: true
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/release-proposal-dispatch.yml b/.github/workflows/release-proposal-dispatch.yml
index ce454a86c7..c59f657f0a 100644
--- a/.github/workflows/release-proposal-dispatch.yml
+++ b/.github/workflows/release-proposal-dispatch.yml
@@ -207,6 +207,8 @@ jobs:
       - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
         with:
           cache-targets: true
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: dtolnay/rust-toolchain@nightly
         with:
           toolchain: ${{ steps.nightly-version.outputs.version }}
diff --git a/.github/workflows/test-ffi.yml b/.github/workflows/test-ffi.yml
index 994472b9ec..024f8fafe3 100644
--- a/.github/workflows/test-ffi.yml
+++ b/.github/workflows/test-ffi.yml
@@ -114,6 +114,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: release
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: "Generate profiling FFI"
         shell: bash
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8673c56be6..878b904859 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -122,6 +122,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: all-features
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: "Remove nextest CI report"
         shell: bash
         run: rm -rf target/nextest/ci/junit.xml
@@ -295,6 +297,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Build CentOS 7 Docker image
         run: docker build -t libdatadog-centos7 -f tools/docker/Dockerfile.centos .
       - name: "cargo nextest run (centos7)"
@@ -377,6 +381,8 @@ jobs:
         with:
           cache-targets: true
           cache-bin: true
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # 3.10.0
       - name: Pre-fetch dependencies (requires network/certs on the runner)
@@ -426,6 +432,8 @@ jobs:
         with:
           cache-targets: true
           cache-bin: true
+          shared-key: wasm
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: "cargo check -p libdd-data-pipeline --target wasm32-unknown-unknown --no-default-features"
         run: cargo check -p libdd-data-pipeline --target wasm32-unknown-unknown --no-default-features
         env:
diff --git a/.github/workflows/verify-profiling-heap-sampler-bindings.yml b/.github/workflows/verify-profiling-heap-sampler-bindings.yml
index 6f4e10d5c0..68e222a0b4 100644
--- a/.github/workflows/verify-profiling-heap-sampler-bindings.yml
+++ b/.github/workflows/verify-profiling-heap-sampler-bindings.yml
@@ -32,6 +32,8 @@ jobs:
         with:
           cache-targets: true
           cache-bin: true
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Regenerate bindings
         # `LIBDD_PROFILING_HEAP_SAMPLER_REGEN=1` rewrites `src/generated/*`
         # in-place via bindgen. If the committed files were stale the
diff --git a/.github/workflows/verify-proto-files.yml b/.github/workflows/verify-proto-files.yml
index 4f0e8c19db..76999fcdbb 100644
--- a/.github/workflows/verify-proto-files.yml
+++ b/.github/workflows/verify-proto-files.yml
@@ -54,6 +54,8 @@ jobs:
         with:
           cache-targets: true # cache build artifacts
           cache-bin: true # cache the ~/.cargo/bin directory
+          shared-key: default
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: diff pb.rs
         working-directory: libdd-trace-protobuf
         run: |