diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index da03b387..63305f4d 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -34,6 +34,9 @@ runs:
       with:
         go-version: ${{ inputs.go-version }}
         check-latest: true
+        cache-dependency-path: |
+          go.sum
+          bin/external-tool
     - uses: actions/setup-node@v4
       if: ${{ inputs.setup-node == 'true' }}
       with:
diff --git a/Makefile b/Makefile
index 2c14e369..ff92a1c5 100644
--- a/Makefile
+++ b/Makefile
@@ -41,7 +41,7 @@ GENERATED = \
 	console/data/frontend
 
 .PHONY: all all-indep
-BUILD_ARGS=
+BUILD_ARGS =
 all: fmt lint all-indep ; $(info $(M) building executable…) @ ## Build program binary
 	$Q env GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) \
          $(if $(filter amd64,$(TARGETARCH)),GOAMD64=$(TARGETVARIANT),\
@@ -64,13 +64,13 @@ PIGEON = go tool pigeon
 REVIVE = go tool revive
 STATICCHECK = go tool staticcheck
 WWHRD = go tool wwhrd
-BUF = go run github.com/bufbuild/buf/cmd/buf@v1.55.1
+BUF = ./bin/external-tool buf
 
 # Generated files
 
 .DELETE_ON_ERROR:
 
-common/pb/rawflow_vtproto.pb.go: common/pb/rawflow.pb.go
+common/pb/rawflow_vtproto.pb.go: | common/pb/rawflow.pb.go
 %.pb.go: buf.gen.yaml %.proto ; $(info $(M) compiling protocol buffers $@…)
 	$Q $(BUF) generate --path $(@:.pb.go=.proto)
 
diff --git a/bin/external-tool b/bin/external-tool
new file mode 100755
index 00000000..c80790dc
--- /dev/null
+++ b/bin/external-tool
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Wrapper to execute an external tool. This is used a bit like "go tool", but in
+# a case we don't want to put the dependency in go.mod (which may be considered
+# by an anti-pattern for some tools).
+
+cmd="$1"
+shift
+
+case "$cmd" in
+    buf) exec go run github.com/bufbuild/buf/cmd/buf@v1.55.1 "$@" ;;
+esac