diff --git a/.gitea/workflows/tests.yaml b/.gitea/workflows/tests.yaml
index 3eaea61..3ce53c2 100644
--- a/.gitea/workflows/tests.yaml
+++ b/.gitea/workflows/tests.yaml
@@ -26,6 +26,24 @@ jobs:
           coverage: xdebug
           ini-values: apc.enable_cli=1
 
+      # Authenticate to GitHub to raise API rate limit from 60 → 5,000 req/hour.
+      # Uses the same token that publish.yaml uses to sync to GitHub.
+      - name: Configure GitHub OAuth token
+        env:
+          GITHUB_TOKEN: ${{ secrets.SYNC_GITHUB_TOKEN }}
+        run: composer config --global github-oauth.github.com "$GITHUB_TOKEN"
+
+      # Cache Composer's download cache so repeated CI runs don't re-download
+      # packages at all. Keyed on composer.lock hash — cache busts automatically
+      # when dependencies change.
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ runner.os }}-${{ hashFiles('composer.lock') }}
+          restore-keys: |
+            composer-${{ runner.os }}-
+
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress