diff --git a/.github/actions/save-ccache/action.yml b/.github/actions/save-ccache/action.yml
new file mode 100644
index 0000000..c2f1c43
--- /dev/null
+++ b/.github/actions/save-ccache/action.yml
@@ -0,0 +1,29 @@
+name: Save ccache
+description: >
+  Replaces the cache stored under the key instead of adding an entry per commit, so the
+  caches of the repository stay below its quota. The job needs the actions: write permission.
+
+inputs:
+  key:
+    description: Cache key, the same one given to actions/cache/restore
+    required: true
+  path:
+    description: Directory of the ccache
+    default: .ccache
+
+runs:
+  using: composite
+  steps:
+    - name: Delete the previous cache
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        CACHE_KEY: ${{ inputs.key }}
+      # cache keys are immutable, there is nothing to delete the first time
+      run: gh cache delete "$CACHE_KEY" --repo "$GITHUB_REPOSITORY" || true
+
+    - name: Save the cache
+      uses: actions/cache/save@v4
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 44ea14a..d4d29a8 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -21,6 +21,7 @@ concurrency:
 
 permissions:
   contents: read
+  actions: write # replace the ccache entries
 
 jobs:
   build:
@@ -130,7 +131,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           path: .ccache
-          key: ccache-deb-${{ matrix.name }}-${{ matrix.arch }}_${{ github.sha }}
+          key: ccache-deb-${{ matrix.name }}-${{ matrix.arch }}
           restore-keys: |
             ccache-deb-${{ matrix.name }}-${{ matrix.arch }}_
 
@@ -156,12 +157,11 @@ jobs:
               bash -euxc "./docker/build.sh"
 
       - name: Save ccache
-        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        # Pull requests only read the cache, pushes to main and manual runs replace it.
         if: ${{ !cancelled() && github.event_name != 'pull_request' }}
-        uses: actions/cache/save@v4
+        uses: ./.github/actions/save-ccache
         with:
-          path: .ccache
-          key: ccache-deb-${{ matrix.name }}-${{ matrix.arch }}_${{ github.sha }}
+          key: ccache-deb-${{ matrix.name }}-${{ matrix.arch }}
 
       - name: Upload deb package
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index ffce175..002726a 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -18,6 +18,7 @@ concurrency:
 
 permissions:
   contents: read
+  actions: write # replace the ccache entries
 
 jobs:
   build:
@@ -65,7 +66,7 @@ jobs:
       uses: actions/cache/restore@v4
       with:
         path: .ccache
-        key: ccache-${{ matrix.os }}_${{ github.sha }}
+        key: ccache-${{ matrix.os }}
         restore-keys: |
           ccache-${{ matrix.os }}_
 
@@ -105,12 +106,11 @@ jobs:
       run: ccache --show-stats
 
     - name: Save ccache
-      # Pull requests only read the cache, pushes to main and manual runs populate it.
+      # Pull requests only read the cache, pushes to main and manual runs replace it.
       if: ${{ !cancelled() && github.event_name != 'pull_request' }}
-      uses: actions/cache/save@v4
+      uses: ./.github/actions/save-ccache
       with:
-        path: .ccache
-        key: ccache-${{ matrix.os }}_${{ github.sha }}
+        key: ccache-${{ matrix.os }}
 
     - name: Repair wheel with delocate
       run: |
diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 979baf7..3f6446e 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -18,6 +18,7 @@ concurrency:
 
 permissions:
   contents: read
+  actions: write # replace the ccache entries
 
 jobs:
   msys2-mingw64:
@@ -149,7 +150,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           path: .ccache
-          key: ccache-windows_${{ github.sha }}
+          key: ccache-windows
           restore-keys: |
             ccache-windows_
 
@@ -194,12 +195,11 @@ jobs:
         run: ccache --show-stats
 
       - name: Save ccache
-        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        # Pull requests only read the cache, pushes to main and manual runs replace it.
         if: ${{ !cancelled() && github.event_name != 'pull_request' }}
-        uses: actions/cache/save@v4
+        uses: ./.github/actions/save-ccache
         with:
-          path: .ccache
-          key: ccache-windows_${{ github.sha }}
+          key: ccache-windows
 
       - name: Repair wheel with delvewheel
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 792dc67..ce7e72f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -30,6 +30,7 @@ concurrency:
 
 permissions:
   contents: read
+  actions: write # replace the ccache entries
 
 jobs:
   linux:
@@ -79,7 +80,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           path: .ccache
-          key: ccache-linux-test_${{ github.sha }}
+          key: ccache-linux-test
           restore-keys: |
             ccache-linux-test_
 
@@ -120,12 +121,11 @@ jobs:
         run: ccache --show-stats
 
       - name: Save ccache
-        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        # Pull requests only read the cache, pushes to main and manual runs replace it.
         if: ${{ !cancelled() && github.event_name != 'pull_request' }}
-        uses: actions/cache/save@v4
+        uses: ./.github/actions/save-ccache
         with:
-          path: .ccache
-          key: ccache-linux-test_${{ github.sha }}
+          key: ccache-linux-test
 
       - name: Setup test environment
         run: |
@@ -333,7 +333,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           path: .ccache
-          key: ccache-windows_${{ github.sha }}
+          key: ccache-windows
           restore-keys: |
             ccache-windows_
 
@@ -386,12 +386,11 @@ jobs:
         run: ccache --show-stats
 
       - name: Save ccache
-        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        # Pull requests only read the cache, pushes to main and manual runs replace it.
         if: ${{ !cancelled() && github.event_name != 'pull_request' }}
-        uses: actions/cache/save@v4
+        uses: ./.github/actions/save-ccache
         with:
-          path: .ccache
-          key: ccache-windows_${{ github.sha }}
+          key: ccache-windows
 
       - name: Run unit tests
         shell: bash
@@ -443,7 +442,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           path: .ccache
-          key: ccache-${{ matrix.os }}_${{ github.sha }}
+          key: ccache-${{ matrix.os }}
           restore-keys: |
             ccache-${{ matrix.os }}_
 
@@ -483,12 +482,11 @@ jobs:
         run: ccache --show-stats
 
       - name: Save ccache
-        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        # Pull requests only read the cache, pushes to main and manual runs replace it.
         if: ${{ !cancelled() && github.event_name != 'pull_request' }}
-        uses: actions/cache/save@v4
+        uses: ./.github/actions/save-ccache
         with:
-          path: .ccache
-          key: ccache-${{ matrix.os }}_${{ github.sha }}
+          key: ccache-${{ matrix.os }}
 
       - name: Run unit tests
         run: |