diff --git a/build.gradle.kts b/build.gradle.kts
index ede7420..b43f36c 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -163,6 +163,7 @@ tasks.register<GenerateDataFromManPages>("generateDataFromManPages") {
   systemdSourceCodeRoot = file("./systemd-build/build/")
   generatedJsonFileLocation =
     file(sourceSets["main"].output.resourcesDir?.getAbsolutePath() + "/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata")
+  renderedXIncludesDir = project.layout.buildDirectory.dir("tmp/rendered-xincludes").get().asFile
 }
 /*
  * Lexing / Parsing and Grammar Tasks
@@ -226,6 +227,7 @@ tasks.register("mergePodmanDocumentation") {
   val semanticDataDir = file("${sourceSets["main"].output.resourcesDir?.getAbsolutePath()}/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata")
   val podmanJsonFile = file("./src/main/resources/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/podman/podman-sectionToKeywordMapFromDoc.json")
   val targetJsonFile = file("${semanticDataDir}/sectionToKeywordMapFromDoc.json")
+  val undocumentedJsonFile = file("${semanticDataDir}/undocumentedSectionToKeywordMap.json")
 
   inputs.file(podmanJsonFile)
 
@@ -261,7 +263,6 @@ tasks.register("mergePodmanDocumentation") {
     targetJsonFile.writeText(output)
 
     // Merge undocumented keywords (deprecated/moved options)
-    val undocumentedJsonFile = file("${semanticDataDir}/undocumentedSectionToKeywordMap.json")
     @Suppress("UNCHECKED_CAST")
     val undocData = slurper.parse(undocumentedJsonFile) as MutableMap<String, Any>
     @Suppress("UNCHECKED_CAST")
diff --git a/buildSrc/src/main/groovy/GenerateDataFromManPages.groovy b/buildSrc/src/main/groovy/GenerateDataFromManPages.groovy
index af78b0c..e10e86a 100644
--- a/buildSrc/src/main/groovy/GenerateDataFromManPages.groovy
+++ b/buildSrc/src/main/groovy/GenerateDataFromManPages.groovy
@@ -56,6 +56,13 @@ class GenerateDataFromManPages extends DefaultTask {
   @OutputDirectory
   File generatedJsonFileLocation
 
+  /**
+   * Scratch directory for XInclude-rendered XML. Supplied at configuration time so the task
+   * does not access Task.project at execution time (deprecated and configuration-cache hostile).
+   */
+  @Internal
+  File renderedXIncludesDir
+
   /**
    * Map that stores for each file name, the name of an option attribute
    */
@@ -455,7 +462,7 @@ class GenerateDataFromManPages extends DefaultTask {
     xmlContent = processXIncludesWithRegex(xmlContent, sourceFile.parentFile)
 
 
-    File outputDir = project.layout.buildDirectory.dir("tmp/rendered-xincludes").get().asFile
+    File outputDir = renderedXIncludesDir
     if (!outputDir.exists()) {
       outputDir.mkdirs()
     }
diff --git a/ci/Build-Environment.Dockerfile b/ci/Build-Environment.Dockerfile
index b5e12f8..1dc9265 100644
--- a/ci/Build-Environment.Dockerfile
+++ b/ci/Build-Environment.Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:24.04
 
 RUN apt-get update
 
@@ -6,15 +6,31 @@ RUN apt-get install -y git openjdk-21-jdk-headless
 
 WORKDIR /tmp
 
+# Ubuntu 24.04 ships a default 'ubuntu' user occupying UID 1000, which collides with the
+# builduser we create below. Remove it so builduser can keep UID 1000 (matching the pod's
+# runAsUser: 1000).
+RUN userdel -r ubuntu || true
+
 RUN useradd -m builduser -u 1000
 
+# Pin GRADLE_USER_HOME to a path baked into the image rather than letting it default to a
+# location under the ephemeral CI workspace. This ensures the dependency cache warmed below
+# (including the ~1 GiB IntelliJ Platform SDK) is actually reused at runtime instead of being
+# re-downloaded on every build. It stays hermetic: each pod gets its own copy-on-write view
+# of this directory from the immutable image, with no shared mutable host state.
+ENV GRADLE_USER_HOME=/home/builduser/.gradle
+
 USER 1000
 
 ARG BRANCH=242.x
 
+# Warm the dependency cache. 'dependencies' resolves every configuration and 'compileKotlin'
+# pulls the IntelliJ Platform SDK onto the compile classpath, so the ~1 GiB SDK gets baked in.
+# Do NOT add compileTestKotlin here: it drags the docker-compose metadata task (composeBuild)
+# into the graph, which needs a Docker daemon that isn't available during the image build.
 RUN git clone --depth 1 -b ${BRANCH} https://github.com/SJrX/systemdUnitFilePlugin.git && \
       cd /tmp/systemdUnitFilePlugin && \
       /tmp/systemdUnitFilePlugin/gradlew --no-daemon --build-cache dependencies compileKotlin && \
       rm -rf /tmp/systemdUnitFilePlugin/
 
-WORKDIR /
+WORKDIR /
\ No newline at end of file