diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index a29c8da7b..4d7c97fba 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -13,6 +13,7 @@ env:
   CCACHE_BASEDIR: ${{ github.workspace }}
   CCACHE_COMPRESS: true
   CCACHE_MAXSIZE: 150M
+  EVICT_CCACHE_AGE: 1200s
   CC: gcc
   OS_NAME: linux
 
@@ -68,6 +69,10 @@ jobs:
         with:
           name: Lint Results
           path: src/frontends/android/app/build/reports/lint-results*.xml
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 2a21f0c4e..8ed484b01 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -17,6 +17,7 @@ env:
   CCACHE_BASEDIR: ${{ github.workspace }}
   CCACHE_COMPRESS: true
   CCACHE_MAXSIZE: 100M
+  EVICT_CCACHE_AGE: 1200s
   OS_NAME: linux
 
 jobs:
@@ -101,6 +102,10 @@ jobs:
           ccache -z
       - run: ./scripts/test.sh build-deps
       - run: ccache -sv
+      - if: fromJSON(env.STORE_DEPS_CACHE)
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
@@ -121,6 +126,10 @@ jobs:
       - run: ccache -z
       - run: ./scripts/test.sh
       - run: ccache -sv
+      - if: fromJSON(env.STORE_CACHE)
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
@@ -207,6 +216,10 @@ jobs:
           echo "TESTS_ACTIVE_TRANSFORMS=$HOME/active-transforms.log" >> $GITHUB_ENV
       - run: ./scripts/test.sh build-deps
       - run: ccache -sv
+      - if: fromJSON(env.STORE_DEPS_CACHE)
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
@@ -236,7 +249,6 @@ jobs:
       - name: Verify active transforms
         run: |
           test ! -f $ACTIVE_TRANSFORMS_REF || diff -us --color=always $ACTIVE_TRANSFORMS_REF $TESTS_ACTIVE_TRANSFORMS
-      - run: ccache -sv
       - if: ${{ failure() }}
         uses: actions/upload-artifact@v6
         with:
@@ -279,6 +291,10 @@ jobs:
           ccache -z
       - run: ./scripts/test.sh build-deps
       - run: ccache -sv
+      - if: fromJSON(env.STORE_DEPS_CACHE)
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
@@ -299,6 +315,10 @@ jobs:
       - run: ccache -z
       - run: ./scripts/test.sh
       - run: ccache -sv
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
@@ -342,6 +362,10 @@ jobs:
       - run: ./scripts/test.sh deps
       - run: ./scripts/test.sh
       - run: ccache -sv
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index c74d73a8d..3a5118452 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -14,6 +14,7 @@ env:
   CCACHE_BASEDIR: ${{ github.workspace }}
   CCACHE_COMPRESS: true
   CCACHE_MAXSIZE: 100M
+  EVICT_CCACHE_AGE: 1200s
   OS_NAME: macos
 
 jobs:
@@ -52,6 +53,10 @@ jobs:
           ccache -z
       - uses: ./.github/actions/default
       - run: ccache -sv
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index d6c02698b..f28facbe9 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -13,6 +13,7 @@ env:
   CCACHE_BASEDIR: ${{ github.workspace }}
   CCACHE_COMPRESS: true
   CCACHE_MAXSIZE: 100M
+  EVICT_CCACHE_AGE: 1200s
   OS_NAME: linux
 
 jobs:
@@ -68,6 +69,10 @@ jobs:
             -Dsonar.cfamily.threads=2
             -Dsonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
       - run: ccache -sv
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/tkm.yml b/.github/workflows/tkm.yml
index 7eb2d6b1a..44fe35e95 100644
--- a/.github/workflows/tkm.yml
+++ b/.github/workflows/tkm.yml
@@ -15,6 +15,7 @@ env:
   CCACHE_COMPILERCHECK: content
   CCACHE_COMPRESS: true
   CCACHE_MAXSIZE: 100M
+  EVICT_CCACHE_AGE: 1200s
 
 jobs:
   pre-check:
@@ -52,6 +53,7 @@ jobs:
             -e CCACHE_COMPILERCHECK \
             -e CCACHE_COMPRESS \
             -e CCACHE_MAXSIZE \
+            -e EVICT_CCACHE_AGE \
             strongswan-tkm \
             bash -c "ccache -z; \
             echo '### build charon-tkm'; \
@@ -75,6 +77,8 @@ jobs:
             make -j check TESTS_RUNNERS=tkm TESTS_TKM=1 || exit 1; \
             cat /tmp/tkm.log; \
             ccache -sv; \
+            ccache --evict-older-than $EVICT_CCACHE_AGE; \
+            ccache -sv; \
             "
       # delete old cache entry as we currently can't update it any other way
       - env:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 177ce7c8a..039085458 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -16,6 +16,7 @@ env:
   # since the compilers are newly installed every time, we have to use this to
   # avoid cache misses
   CCACHE_COMPILERCHECK: content
+  EVICT_CCACHE_AGE: 1200s
   MONOLITHIC: yes
 
 jobs:
@@ -53,6 +54,10 @@ jobs:
           ccache -sz
       - uses: ./.github/actions/default
       - run: ccache -sv
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}
@@ -114,6 +119,10 @@ jobs:
         # sometimes streaming/threading tests hang completely
         timeout-minutes: 30
       - run: ccache -sv
+      - if: github.event_name == 'push'
+        run: |
+          ccache --evict-older-than ${{ env.EVICT_CCACHE_AGE }}
+          ccache -sv
       # delete old cache entry as we currently can't update it any other way
       - env:
           GH_TOKEN: ${{ github.token }}