diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b8f2d7070d1..442257aee758 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -171,11 +171,25 @@ jobs:
     steps:
       - name: "Checking out repository"
         uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v2.5.0
+      # Attempt to restore from caches unconditionally.
+      # Note: these will first try to grab a cache entry for this exact commit
+      #       then they will fall back to the latest for any commit.
+      # We're pretty limited on repository cache space (10GB) relative to cache
+      # entry size (~2.5GB), so this usage is pretty optimistic.
+      - name: "Fetching cache (git submodules)"
+        uses: actions/cache/restore@58c146cc91c5b9e778e71775dfe9bf1442ad9a12 # v3.2.3
         with:
-          submodules: false
-      # Update submodules directly using our preferred options. Fetching git
-      # history and source files for large dependencies is particularly slow on
-      # Windows, so we'd rather not rely on the 'checkout' action for this.
+          path: .git/modules
+          key: gitmodules_all_windows_${{ github.sha }}
+          restore-keys: gitmodules_all_windows
+      - name: "Fetching cache (CMake/ccache)"
+        uses: actions/cache/restore@58c146cc91c5b9e778e71775dfe9bf1442ad9a12 # v3.2.3
+        with:
+          path: ${{ github.workspace }}/.ccache
+          key: ccache_all_windows_${{ github.sha }}
+          restore-keys: ccache_all_windows
+      # Fetch dependencies.
+      # TODO(scotttodd): Move some of these into a Docker image / add to PATH.
       - name: "Updating git submodules"
         run: git submodule update --init --jobs 8 --depth 1
       - name: "Setting up Python"
@@ -187,12 +201,37 @@ jobs:
           python3 -m venv .venv
           .venv/Scripts/activate.bat
           python3 -m pip install -r runtime/bindings/python/iree/runtime/build_requirements.txt
+      - name: "Installing requirements"
+        run: choco install ccache --yes
       - name: "Configuring MSVC"
         uses: ilammy/msvc-dev-cmd@7315a94840631165970262a99c72cfb48a65d25d # v1.12.0
+      # Finally: build and run tests.
       - name: "Building IREE"
+        env:
+          IREE_READ_REMOTE_CCACHE: 0
+          IREE_WRITE_REMOTE_CCACHE: 0
+          IREE_READ_LOCAL_CCACHE: 1
+          IREE_WRITE_LOCAL_CCACHE: ${{ needs.setup.outputs.write-caches }}
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          # A full build is around 2.5GB, but uploads/downloads are slow and
+          # we have a limit of 10GB per repository
+          CCACHE_MAXSIZE: 3G
         run: ./build_tools/cmake/build_all.sh "${BUILD_DIR}"
       - name: "Testing IREE"
         run: ./build_tools/cmake/ctest_all.sh "${BUILD_DIR}"
+      # Write caches (if configured to) after all other steps are finished.
+      - name: "Saving cache (git submodules)"
+        if: needs.setup.outputs.write-caches == 'true'
+        uses: actions/cache/save@58c146cc91c5b9e778e71775dfe9bf1442ad9a12 # v3.2.3
+        with:
+          path: .git/modules
+          key: gitmodules_all_windows_${{ github.sha }}
+      - name: "Saving cache (CMake/ccache)"
+        if: needs.setup.outputs.write-caches == 'true'
+        uses: actions/cache/save@58c146cc91c5b9e778e71775dfe9bf1442ad9a12 # v3.2.3
+        with:
+          path: ${{ github.workspace }}/.ccache
+          key: ccache_all_windows_${{ github.sha }}
 
   build_test_all_bazel:
     needs: setup
diff --git a/build_tools/cmake/build_all.sh b/build_tools/cmake/build_all.sh
index aa438abce19c..391d22a46ef3 100755
--- a/build_tools/cmake/build_all.sh
+++ b/build_tools/cmake/build_all.sh
@@ -73,6 +73,6 @@ echo "Building sample deps"
 echo "------------------"
 "$CMAKE_BIN" --build "${BUILD_DIR}" --target iree-sample-deps -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/build_and_test_asan.sh b/build_tools/cmake/build_and_test_asan.sh
index 6e3cebd44e61..b5e21f233bad 100755
--- a/build_tools/cmake/build_and_test_asan.sh
+++ b/build_tools/cmake/build_and_test_asan.sh
@@ -64,7 +64,7 @@ echo "Building microbenchmark suites"
 echo "------------------"
 "${CMAKE_BIN?}" --build "${BUILD_DIR?}" --target iree-microbenchmark-suites -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
 
diff --git a/build_tools/cmake/build_and_test_tsan.sh b/build_tools/cmake/build_and_test_tsan.sh
index fadef80f238e..d3205f4aa1fb 100755
--- a/build_tools/cmake/build_and_test_tsan.sh
+++ b/build_tools/cmake/build_and_test_tsan.sh
@@ -72,7 +72,7 @@ echo "Building sample deps"
 echo "------------------"
 "$CMAKE_BIN" --build "${BUILD_DIR?}" --target iree-sample-deps -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
 
diff --git a/build_tools/cmake/build_android.sh b/build_tools/cmake/build_android.sh
index cb4d271bd621..c44438625110 100755
--- a/build_tools/cmake/build_android.sh
+++ b/build_tools/cmake/build_android.sh
@@ -94,6 +94,6 @@ echo "Building sample deps for device"
 echo "------------------"
 "${CMAKE_BIN}" --build "${BUILD_DIR}" --target iree-sample-deps -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/build_host_tools.sh b/build_tools/cmake/build_host_tools.sh
index a6e4973d64f2..6929b0f892a0 100755
--- a/build_tools/cmake/build_host_tools.sh
+++ b/build_tools/cmake/build_host_tools.sh
@@ -51,6 +51,6 @@ declare -a CMAKE_ARGS=(
 "${CMAKE_BIN}" "${CMAKE_ARGS[@]}"
 "${CMAKE_BIN}" --build "${BUILD_DIR}" --target install -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/build_runtime.sh b/build_tools/cmake/build_runtime.sh
index 68c08be8bf64..13f2223aa10f 100755
--- a/build_tools/cmake/build_runtime.sh
+++ b/build_tools/cmake/build_runtime.sh
@@ -76,6 +76,6 @@ case "${BUILD_PRESET}" in
     ;;
 esac
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/build_runtime_emscripten.sh b/build_tools/cmake/build_runtime_emscripten.sh
index 5aa1770a136c..0598e23613ec 100755
--- a/build_tools/cmake/build_runtime_emscripten.sh
+++ b/build_tools/cmake/build_runtime_emscripten.sh
@@ -54,6 +54,6 @@ echo "Building sample deps"
 echo "------------------"
 "${CMAKE_BIN?}" --build . --target iree-sample-deps -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/build_runtime_small.sh b/build_tools/cmake/build_runtime_small.sh
index 7bf4163311d9..c78ec3d799d7 100755
--- a/build_tools/cmake/build_runtime_small.sh
+++ b/build_tools/cmake/build_runtime_small.sh
@@ -25,6 +25,6 @@ source build_tools/cmake/setup_ccache.sh
   -DIREE_BUILD_COMPILER=OFF
 "${CMAKE_BIN?}" --build "${BUILD_DIR}" -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/build_tracing.sh b/build_tools/cmake/build_tracing.sh
index 3610bef2e01c..2d39092d89a6 100755
--- a/build_tools/cmake/build_tracing.sh
+++ b/build_tools/cmake/build_tracing.sh
@@ -29,6 +29,6 @@ source build_tools/cmake/setup_ccache.sh
   -DIREE_BUILD_COMPILER=OFF
 "${CMAKE_BIN?}" --build "${BUILD_DIR}" -- -k 0
 
-if (( IREE_READ_REMOTE_CCACHE == 1 )); then
+if (( IREE_USE_CCACHE == 1 )); then
   ccache --show-stats
 fi
diff --git a/build_tools/cmake/setup_ccache.sh b/build_tools/cmake/setup_ccache.sh
index dd5a23463bb8..1af9ef053e7e 100644
--- a/build_tools/cmake/setup_ccache.sh
+++ b/build_tools/cmake/setup_ccache.sh
@@ -4,22 +4,57 @@
 # See https://llvm.org/LICENSE.txt for license information.
 # SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 
-# This file must be *sourced* not executed.
+# ccache (https://ccache.dev/) setup, with read/write + local/remote options.
+#
+# Defaults to only reading from the shared remote cache (hosted on GCS) used by
+# our Linux CI. The postsubmit CI writes to the cache, for presubmit CI and
+# local builds to read from.
+#
+# Local caches can also be used to interface with external remote caches
+# (like https://github.com/actions/cache) by
+#   1. downloading the cache directory
+#   2. sourcing with IREE_READ_LOCAL_CCACHE=1 IREE_WRITE_LOCAL_CCACHE=[0,1]
+#   3. building with CMake
+#   4. uploading the cache directory (if writing)
+#
+# Note: this file must be *sourced* not executed.
 
 set -euo pipefail
 
+# Configuration environment variables.
 IREE_READ_REMOTE_CCACHE="${IREE_READ_REMOTE_CCACHE:-1}"
 IREE_WRITE_REMOTE_CCACHE="${IREE_WRITE_REMOTE_CCACHE:-0}"
+IREE_READ_LOCAL_CCACHE="${IREE_READ_LOCAL_CCACHE:-0}"
+IREE_WRITE_LOCAL_CCACHE="${IREE_WRITE_LOCAL_CCACHE:-0}"
+
 if (( ${IREE_WRITE_REMOTE_CCACHE} == 1 && ${IREE_READ_REMOTE_CCACHE} != 1 )); then
   echo "Can't have 'IREE_WRITE_REMOTE_CCACHE' (${IREE_WRITE_REMOTE_CCACHE})" \
        " set without 'IREE_READ_REMOTE_CCACHE' (${IREE_READ_REMOTE_CCACHE})"
 fi
+if (( ${IREE_WRITE_LOCAL_CCACHE} == 1 && ${IREE_READ_LOCAL_CCACHE} != 1 )); then
+  echo "Can't have 'IREE_WRITE_LOCAL_CCACHE' (${IREE_WRITE_LOCAL_CCACHE})" \
+       " set without 'IREE_READ_LOCAL_CCACHE' (${IREE_READ_LOCAL_CCACHE})"
+fi
+
+if (( IREE_READ_REMOTE_CCACHE == 1 || IREE_READ_LOCAL_CCACHE == 1 )); then
+  export IREE_USE_CCACHE=1
+  export CMAKE_C_COMPILER_LAUNCHER=$(which ccache)
+  export CMAKE_CXX_COMPILER_LAUNCHER=$(which ccache)
+  $(which ccache) --zero-stats
+else
+  export IREE_USE_CCACHE=0
+fi
+
+if (( IREE_READ_LOCAL_CCACHE == 1 && IREE_WRITE_LOCAL_CCACHE == 0 )); then
+  export CCACHE_READONLY=1
+fi
+
+if (( IREE_READ_REMOTE_CCACHE == 1 && IREE_READ_LOCAL_CCACHE == 0 )); then
+  export CCACHE_REMOTE_ONLY=1
+fi
 
 if (( IREE_READ_REMOTE_CCACHE == 1 )); then
   export CCACHE_REMOTE_STORAGE="http://storage.googleapis.com/iree-sccache/ccache"
-  export CCACHE_REMOTE_ONLY=1
-  export CMAKE_C_COMPILER_LAUNCHER=ccache
-  export CMAKE_CXX_COMPILER_LAUNCHER=ccache
   if (( IREE_WRITE_REMOTE_CCACHE == 1 )); then
     set +x # Don't leak the token (even though it's short-lived)
     export CCACHE_REMOTE_STORAGE="${CCACHE_REMOTE_STORAGE}|bearer-token=${IREE_CCACHE_GCP_TOKEN}"