diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5bb85b97..98e24d0b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -173,7 +173,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: app/src/main/assets/linuxfs
-          key: preloads-${{ env.PRELOAD_CACHE_VERSION }}-${{ hashFiles('app/src/main/cpp/fakeinput_steam.cpp', 'tools/linuxfs/preload/*.c', 'tools/linuxfs/build-x86-preloads.sh', 'tools/linuxfs/fex/*', 'tools/linuxfs/clipboard/*.c', 'tools/linuxfs/ssbs/*.c', 'tools/proot/fastpath/*.c', 'tools/linuxfs/overlay/usr/local/bin/*', 'tools/linuxfs/overlay/usr/bin/**', 'tools/linuxfs/desktop/*', 'tools/gamescope/release.env', 'tools/wlroots/release.env', 'tools/linuxfs/uruntime.env', 'tools/linuxfs/licenses/*', 'tools/mangoapp/*', 'tools/msitools/**') }}
+          key: preloads-${{ env.PRELOAD_CACHE_VERSION }}-${{ hashFiles('app/src/main/cpp/fakeinput_steam.cpp', 'tools/linuxfs/preload/*.c', 'tools/linuxfs/build-x86-preloads.sh', 'tools/linuxfs/fex/*', 'tools/linuxfs/clipboard/*.c', 'tools/linuxfs/ssbs/*.c', 'tools/proot/fastpath/*.c', 'tools/linuxfs/overlay/usr/local/bin/*', 'tools/linuxfs/overlay/usr/bin/**', 'tools/linuxfs/desktop/*', 'tools/gamescope/release.env', 'tools/wlroots/release.env', 'tools/linuxfs/uruntime.env', 'tools/linuxfs/licenses/*', 'tools/mangoapp/*', 'tools/msitools/**', 'tools/linuxfs/debian-image.env') }}
 
       - name: Build libfakeinput.so and libblsession.so (glibc aarch64)
         if: steps.preloads.outputs.cache-hit != 'true'
@@ -275,6 +275,33 @@ jobs:
           install -Dm644 tools/linuxfs/desktop/firefox-droiddeck.js "$D/usr/lib/firefox/defaults/pref/droiddeck.js"
           ls -lR "$D"
 
+      # The Debian 11 image the preloads are compiled in comes from a release on this repo
+      # (published once by ci-debian-image.yml, pinned in tools/linuxfs/debian-image.env): the
+      # public registry mirrors rate-limit the shared runner addresses and failed builds on a
+      # busy evening. Only if that download fails is the image pulled, with retries.
+      - name: Fetch the Debian image the preloads build in
+        if: steps.preloads.outputs.cache-hit != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          . tools/linuxfs/debian-image.env
+          image=public.ecr.aws/docker/library/debian:bullseye
+          if gh release download "$DEBIAN_IMAGE_TAG" -R "$GITHUB_REPOSITORY" -p "$DEBIAN_IMAGE_ASSET" -O /tmp/debian-image.tar.zst \
+             && { [ -z "$DEBIAN_IMAGE_SHA256" ] || echo "$DEBIAN_IMAGE_SHA256  /tmp/debian-image.tar.zst" | sha256sum -c -; }; then
+            zstd -dc /tmp/debian-image.tar.zst | docker load
+            rm -f /tmp/debian-image.tar.zst
+          else
+            echo "::warning::the hosted Debian image could not be fetched; pulling from the registry instead"
+            for attempt in 1 2 3 4 5; do
+              docker pull "$image" && break
+              [ "$attempt" -lt 5 ] || { echo "::error::could not pull $image after $attempt attempts"; exit 1; }
+              echo "pull attempt $attempt failed (registry busy?); retrying in $((attempt * 30)) s"
+              sleep $((attempt * 30))
+            done
+          fi
+          docker image ls "$image"
+
       - name: Build the x86 preloads FEX guests load (glibc 2.31)
         if: steps.preloads.outputs.cache-hit != 'true'
         run: |
diff --git a/.github/workflows/ci-debian-image.yml b/.github/workflows/ci-debian-image.yml
new file mode 100644
index 00000000..1d7826f8
--- /dev/null
+++ b/.github/workflows/ci-debian-image.yml
@@ -0,0 +1,48 @@
+name: Publish the CI Debian image
+
+# Pulls the Debian 11 image the x86 preloads build in, once, and publishes it as a release asset
+# on this repo so build.yml never depends on a registry mirror's rate limit. Run it again (with a
+# new tag) only to refresh the image; tools/linuxfs/debian-image.env names the one builds use.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish to'
+        required: true
+        default: 'ci-debian-bullseye-r1'
+  push:
+    branches: [ci/cache-debian-image]
+    paths: ['.github/workflows/ci-debian-image.yml']
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Pull, save and publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag || 'ci-debian-bullseye-r1' }}
+        run: |
+          set -euo pipefail
+          image=public.ecr.aws/docker/library/debian:bullseye
+          for attempt in 1 2 3 4 5 6; do
+            docker pull "$image" && break
+            [ "$attempt" -lt 6 ] || { echo "::error::could not pull $image"; exit 1; }
+            echo "pull attempt $attempt failed (registry busy?); retrying in $((attempt * 30)) s"
+            sleep $((attempt * 30))
+          done
+          docker image inspect "$image" --format 'image id {{.Id}} created {{.Created}}'
+          docker save "$image" | zstd -19 -T0 -o debian-bullseye.tar.zst
+          sha256sum debian-bullseye.tar.zst | tee SHA256SUMS
+          ls -l debian-bullseye.tar.zst
+          if ! gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$TAG" -R "$GITHUB_REPOSITORY" --title "CI Debian 11 image ($TAG)" --latest=false \
+              --notes "The debian:bullseye image build.yml compiles the x86 preloads in (glibc 2.31), saved with docker save and compressed with zstd. Pulled from public.ecr.aws/docker/library/debian:bullseye on $(date -u +%Y-%m-%d); image id $(docker image inspect "$image" --format '{{.Id}}'). Pinned in tools/linuxfs/debian-image.env."
+          fi
+          gh release upload "$TAG" -R "$GITHUB_REPOSITORY" debian-bullseye.tar.zst SHA256SUMS --clobber
+          { echo "Published \`$TAG\`:"; echo; echo '```'; cat SHA256SUMS; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
diff --git a/tools/linuxfs/debian-image.env b/tools/linuxfs/debian-image.env
new file mode 100644
index 00000000..32243394
--- /dev/null
+++ b/tools/linuxfs/debian-image.env
@@ -0,0 +1,8 @@
+# The Debian 11 image the x86 preloads are compiled in (glibc 2.31, what Steam's Linux runtime
+# has). Published once by .github/workflows/ci-debian-image.yml to a release on this repo; the
+# build downloads it from there instead of pulling from a public registry mirror, whose
+# anonymous rate limit the shared runners keep hitting. Debian 11 is frozen upstream, so a
+# refresh is only ever a new -rN release with the three lines below updated.
+DEBIAN_IMAGE_TAG=ci-debian-bullseye-r1
+DEBIAN_IMAGE_ASSET=debian-bullseye.tar.zst
+DEBIAN_IMAGE_SHA256=112aed723ccd2dc81d69a0ed8bb76b823ea28049fa56f72776f25d680bb36a00