diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8bd408231cc4..d2a8b0385aa1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,7 @@ name: CI
       - "**"
 permissions:
   contents: read
+  packages: write
 defaults:
   run:
     shell: bash
@@ -42,6 +43,7 @@ jobs:
       CI_JOB_NAME: "${{ matrix.name }}"
       CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
       HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}"
+      DOCKER_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
       SCCACHE_BUCKET: rust-lang-ci-sccache2
       TOOLSTATE_REPO: "https://github.com/rust-lang-nursery/rust-toolstate"
       CACHE_DOMAIN: ci-caches.rust-lang.org
@@ -162,6 +164,7 @@ jobs:
       CI_JOB_NAME: "${{ matrix.name }}"
       CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
       HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}"
+      DOCKER_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
       SCCACHE_BUCKET: rust-lang-ci-sccache2
       DEPLOY_BUCKET: rust-lang-ci2
       TOOLSTATE_REPO: "https://github.com/rust-lang-nursery/rust-toolstate"
@@ -552,6 +555,7 @@ jobs:
       CI_JOB_NAME: "${{ matrix.name }}"
       CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
       HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}"
+      DOCKER_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
       SCCACHE_BUCKET: rust-lang-ci-sccache2
       DEPLOY_BUCKET: rust-lang-ci2
       TOOLSTATE_REPO: "https://github.com/rust-lang-nursery/rust-toolstate"
diff --git a/src/ci/docker/run.sh b/src/ci/docker/run.sh
index 22a8dd165ee8..9cfca6b0aaaa 100755
--- a/src/ci/docker/run.sh
+++ b/src/ci/docker/run.sh
@@ -70,24 +70,29 @@ if [ -f "$docker_dir/$image/Dockerfile" ]; then
       cksum=$(sha512sum $hash_key | \
         awk '{print $1}')
 
-      url="https://$CACHE_DOMAIN/docker/$cksum"
+#      echo "Looking for ${cksum}"
+      echo ${DOCKER_TOKEN} | docker login ghcr.io --username kobzol --password-stdin
+#      docker manifest inspect tensorflow/tensorflow:latestx 2> /dev/null ; echo $?
+#      docker pull ghcr.io/kobzol/rust-ci:${cksum}
 
-      echo "Attempting to download $url"
-      rm -f /tmp/rustci_docker_cache
-      set +e
-      retry curl --max-time 600 -y 30 -Y 10 --connect-timeout 30 -f -L -C - \
-        -o /tmp/rustci_docker_cache "$url"
+#      url="https://$CACHE_DOMAIN/docker/$cksum"
 
-      docker_archive_hash=$(sha512sum /tmp/rustci_docker_cache | awk '{print $1}')
-      echo "Downloaded archive hash: ${docker_archive_hash}"
+#      echo "Attempting to download $url"
+#      rm -f /tmp/rustci_docker_cache
+#      set +e
+#      retry curl --max-time 600 -y 30 -Y 10 --connect-timeout 30 -f -L -C - \
+#        -o /tmp/rustci_docker_cache "$url"
 
-      echo "Loading images into docker"
+#      docker_archive_hash=$(sha512sum /tmp/rustci_docker_cache | awk '{print $1}')
+#      echo "Downloaded archive hash: ${docker_archive_hash}"
+
+#      echo "Loading images into docker"
       # docker load sometimes hangs in the CI, so time out after 10 minutes with TERM,
       # KILL after 12 minutes
-      loaded_images=$(/usr/bin/timeout -k 720 600 docker load -i /tmp/rustci_docker_cache \
-        | sed 's/.* sha/sha/')
-      set -e
-      printf "Downloaded containers:\n$loaded_images\n"
+#      loaded_images=$(/usr/bin/timeout -k 720 600 docker load -i /tmp/rustci_docker_cache \
+#        | sed 's/.* sha/sha/')
+#      set -e
+#      printf "Downloaded containers:\n$loaded_images\n"
     fi
 
     dockerfile="$docker_dir/$image/Dockerfile"
@@ -100,19 +105,22 @@ if [ -f "$docker_dir/$image/Dockerfile" ]; then
     echo "::group::Building docker image for $image"
     echo ${cksum}
 
-    export DOCKER_BUILDKIT=0
+#    export DOCKER_BUILDKIT=0
+    docker buildx create --use --driver docker-container
     retry docker \
+      buildx \
       build \
       --rm \
       -t rust-ci \
       -f "$dockerfile" \
+      --cache-from type=registry,ref=ghcr.io/kobzol/rust-ci:${cksum} \
+      --cache-to type=registry,ref=ghcr.io/kobzol/rust-ci:${cksum} \
+      --output=type=docker \
       "$context"
     echo "::endgroup::"
     docker images
-    docker tag rust-ci ghcr.io/kobzol/rust-ci:${cksum}
-
-    docker login --username kobzol --password ${GITHUB_TOKEN}
-    docker push ghcr.io/kobzol/rust-ci:${cksum}
+#    docker tag rust-ci ghcr.io/kobzol/rust-ci:${cksum}
+#    docker push ghcr.io/kobzol/rust-ci:${cksum}
 
     if [ "$CI" != "" ]; then
 #      s3url="s3://$SCCACHE_BUCKET/docker/$cksum"
diff --git a/src/ci/github-actions/ci.yml b/src/ci/github-actions/ci.yml
index f9d2df2323b3..7192756c8c7c 100644
--- a/src/ci/github-actions/ci.yml
+++ b/src/ci/github-actions/ci.yml
@@ -34,6 +34,7 @@ x--expand-yaml-anchors--remove:
     CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
     # commit of PR sha or commit sha. `GITHUB_SHA` is not accurate for PRs.
     HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+    DOCKER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   - &public-variables
     SCCACHE_BUCKET: rust-lang-ci-sccache2
@@ -301,6 +302,7 @@ on:
 
 permissions:
   contents: read
+  packages: write
 
 defaults:
   run: