diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml
index 2bae00b47..3d2518a65 100644
--- a/.github/actions/setup-rust/action.yml
+++ b/.github/actions/setup-rust/action.yml
@@ -1,10 +1,10 @@
 name: "Setup Rust"
 description: "Sets up the correct Rust version and caching via sccache and a GCP backend"
 inputs:
-  sccache_enabled:
-    description: "Enable or disable the sccache service"
+  cache_backend:
+    description: "Choose between sccache or github"
     required: false
-    default: 'true'
+    default: 'sccache'
   targets:
     description: "Additional targets to install"
     required: false
@@ -12,7 +12,8 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - if: ${{ inputs.sccache_enabled == 'true' }}
+    # Setup sccache, works well for most Rust components
+    - if: ${{ inputs.cache_backend == 'sccache' }}
       id: auth
       uses: google-github-actions/auth@v2
       with:
@@ -20,16 +21,26 @@ runs:
         service_account: "github-actions@github-iam-387915.iam.gserviceaccount.com"
         export_environment_variables: true
         create_credentials_file: true
-    - if: ${{ inputs.sccache_enabled == 'true' }}
+    - if: ${{ inputs.cache_backend == 'sccache' }}
       run: |
         echo "SCCACHE_GCS_BUCKET=firezone-staging-sccache" >> $GITHUB_ENV
         echo "SCCACHE_GCS_RW_MODE=READ_WRITE" >> $GITHUB_ENV
       shell: bash
-    - if: ${{ inputs.sccache_enabled == 'true' }}
+    - if: ${{ inputs.cache_backend == 'sccache' }}
       uses: mozilla-actions/sccache-action@v0.0.4
-    - if: ${{ inputs.sccache_enabled == 'true' }}
+    - if: ${{ inputs.cache_backend == 'sccache' }}
       run: echo "RUSTC_WRAPPER=$SCCACHE_PATH" >> $GITHUB_ENV
       shell: bash
+
+    # Setup GH actions cache, works better for Tauri clients and some libs
+    - if: ${{ inputs.cache_backend == 'github' }}
+      uses: Swatinem/rust-cache@v2
+      with:
+        save-if: ${{ github.ref_name == 'main' }}
+        key: ${{ runner.os }}-${{ runner.arch }}
+        workspaces: ./rust
+
+    # Common to either cache backend
     - name: Extract Rust version
       run: |
         RUST_TOOLCHAIN=$(grep 'channel' rust-toolchain.toml | awk -F '"' '{print $2}')
diff --git a/.github/workflows/_rust.yml b/.github/workflows/_rust.yml
index 9c726113d..8dc70b731 100644
--- a/.github/workflows/_rust.yml
+++ b/.github/workflows/_rust.yml
@@ -96,6 +96,8 @@ jobs:
         with:
           node-version: '20'
       - uses: ./.github/actions/setup-rust
+        with:
+          cache_backend: github
       - uses: ./.github/actions/setup-tauri
       - name: pnpm install
         run: |
@@ -140,6 +142,8 @@ jobs:
         with:
           node-version: '20'
       - uses: ./.github/actions/setup-rust
+        with:
+          cache_backend: github
       - uses: ./.github/actions/setup-tauri
       - name: Install pnpm deps
         run: pnpm install
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index e595c5c5b..15e0e9896 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -267,6 +267,8 @@ jobs:
         with:
           node-version: '20'
       - uses: ./.github/actions/setup-rust
+        with:
+          cache_backend: github
       - uses: ./.github/actions/setup-tauri
       - name: Install pnpm deps
         run: pnpm install
diff --git a/rust/connlib/clients/apple/build-rust.sh b/rust/connlib/clients/apple/build-rust.sh
index 11980fddf..b357afee6 100755
--- a/rust/connlib/clients/apple/build-rust.sh
+++ b/rust/connlib/clients/apple/build-rust.sh
@@ -29,8 +29,21 @@ for var in $(env | awk -F= '{print $1}'); do
         [[ "$var" != "SRCROOT" ]] &&
         [[ "$var" != "TARGETED_DEVICE_FAMILY" ]] &&
         [[ "$var" != "RUSTC_WRAPPER" ]] &&
+        [[ "$var" != "RUST_TOOLCHAIN" ]] &&
         [[ "$var" != "SCCACHE_GCS_BUCKET" ]] &&
         [[ "$var" != "SCCACHE_GCS_RW_MODE" ]] &&
+        [[ "$var" != "GOOGLE_CLOUD_PROJECT" ]] &&
+        [[ "$var" != "GCP_PROJECT" ]] &&
+        [[ "$var" != "GCLOUD_PROJECT" ]] &&
+        [[ "$var" != "CLOUDSDK_PROJECT" ]] &&
+        [[ "$var" != "CLOUDSDK_CORE_PROJECT" ]] &&
+        [[ "$var" != "GOOGLE_GHA_CREDS_PATH" ]] &&
+        [[ "$var" != "GOOGLE_APPLICATION_CREDENTIALS" ]] &&
+        [[ "$var" != "CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE" ]] &&
+        [[ "$var" != "ACTIONS_CACHE_URL" ]] &&
+        [[ "$var" != "ACTIONS_RUNTIME_TOKEN" ]] &&
+        [[ "$var" != "CARGO_INCREMENTAL" ]] &&
+        [[ "$var" != "CARGO_TERM_COLOR" ]] &&
         [[ "$var" != "CONNLIB_TARGET_DIR" ]]; then
         unset $var
     fi