diff --git a/.github/workflows/engine-build.yml b/.github/workflows/engine-build.yml
index c32a19564b..6289c1352d 100644
--- a/.github/workflows/engine-build.yml
+++ b/.github/workflows/engine-build.yml
@@ -8,6 +8,7 @@ on:
         default: false
   schedule:
     - cron: "36 00 * * *"
+  pull_request:
 jobs:
   build-engine:
     strategy:
@@ -33,12 +34,26 @@ jobs:
         uses: namespacelabs/nscloud-cache-action@v1
         with:
           path: bazel-remote-data
+      - name: Restore pull request's bazel remote cache overlay
+        id: pr-cache-restore
+        if: github.event_name == 'pull_request'
+        uses: actions/cache/restore@v4
+        with:
+          path: bazel-remote-data-overlay
+          key: pr-bazel-remote-data
+      - name: Mount bazel remote overlay
+        id: mount-overlay
+        if: github.event_name == 'pull_request'
+        run: |
+          sudo apt-get install --yes fuse-overlayfs
+          mkdir overlay-workdir
+          sudo fuse-overlayfs -o lowerdir=bazel-remote-data,upperdir=bazel-remote-data-overlay,workdir=overlay-workdir bazel-remote-data
       - name: Start remote ccache fetcher
         env:
           BAZEL_REMOTE_S3_ENDPOINT: ${{ vars.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com
           BAZEL_REMOTE_S3_BUCKET: ${{ vars.R2_BUCKET_BUILD_CACHE }}
-          BAZEL_REMOTE_S3_ACCESS_KEY_ID: ${{ vars.R2_ACCESS_KEY_ID }}
-          BAZEL_REMOTE_S3_SECRET_ACCESS_KEY: ${{ secrets.R2_ACCESS_KEY_SECRET }}
+          BAZEL_REMOTE_S3_ACCESS_KEY_ID: ${{ github.event_name == 'pull_request' && vars.R2_RO_ACCESS_KEY_ID || vars.R2_ACCESS_KEY_ID }}
+          BAZEL_REMOTE_S3_SECRET_ACCESS_KEY: ${{ github.event_name == 'pull_request' && vars.R2_RO_ACCESS_KEY_SECRET || secrets.R2_ACCESS_KEY_SECRET }}
         run: |
           docker network create --driver bridge engine-build
           docker run -d --rm \
@@ -57,6 +72,7 @@ jobs:
             --s3.auth_method access_key \
             --s3.region auto \
             --max_size 5 \
+            --num_uploaders ${{ github.event_name == 'pull_request' && '0' || '100' }} \
             --disable_http_ac_validation
 
           cat > remote_ccache.conf <<EOF
@@ -101,3 +117,13 @@ jobs:
         run: |
           docker stop builder || true
           docker stop remote-cache
+      - name: Unmount bazel remote overlay
+        if: always() && steps.mount-overlay.outcome == 'success'
+        run: sudo fusermount -u bazel-remote-data
+      - name: Save pull request's bazel remote cache overlay
+        id: pr-cache-save
+        if: always() && steps.pr-cache-restore.outcome == 'success'
+        uses: actions/cache/save@v4
+        with:
+          path: bazel-remote-data-overlay
+          key: ${{ steps.pr-cache-restore.outputs.cache-primary-key }}