diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6ca8b17f7..dd6a3c547 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -263,6 +263,13 @@ jobs:
         with:
           bun-version: latest
       - run: bun i
+      - name: Cache Hugging Face model downloads
+        uses: actions/cache@v4
+        with:
+          path: models
+          key: hf-models-rag-${{ runner.os }}-${{ hashFiles('packages/test/src/samples/**') }}
+          restore-keys: |
+            hf-models-rag-${{ runner.os }}-
       - name: Download build artifacts
         uses: actions/download-artifact@v8
         with:
@@ -293,12 +300,21 @@ jobs:
         with:
           bun-version: latest
       - run: bun i
+      - name: Cache Hugging Face model downloads
+        uses: actions/cache@v4
+        with:
+          path: models
+          key: hf-models-hft-${{ runner.os }}-${{ hashFiles('packages/test/src/samples/**') }}
+          restore-keys: |
+            hf-models-hft-${{ runner.os }}-
       - name: Download build artifacts
         uses: actions/download-artifact@v8
         with:
           name: build-output
           path: .
       - name: Run HuggingFace Transformers provider tests via vitest
+        env:
+          WORKGLOW_SECRETS_PASSPHRASE: ${{ secrets.WORKGLOW_SECRETS_PASSPHRASE }}
         run: bun run test:vitest:ai-provider-hft
       - name: Copy Vitest coverage fragment
         run: cp coverage/coverage-final.json vitest-ai-provider-hft-coverage.json
@@ -321,12 +337,21 @@ jobs:
         with:
           bun-version: latest
       - run: bun i
+      - name: Cache Hugging Face / GGUF model downloads
+        uses: actions/cache@v4
+        with:
+          path: models
+          key: hf-models-nodellama-${{ runner.os }}-${{ hashFiles('packages/test/src/samples/**') }}
+          restore-keys: |
+            hf-models-nodellama-${{ runner.os }}-
       - name: Download build artifacts
         uses: actions/download-artifact@v8
         with:
           name: build-output
           path: .
       - name: Run LlamaCpp provider tests via vitest
+        env:
+          WORKGLOW_SECRETS_PASSPHRASE: ${{ secrets.WORKGLOW_SECRETS_PASSPHRASE }}
         run: bun run test:vitest:ai-provider-nodellama
       - name: Copy Vitest coverage fragment
         run: cp coverage/coverage-final.json vitest-ai-provider-nodellama-coverage.json
diff --git a/.secrets/credentials/26f1356ad1fd23bad72f47e1cafd32b3886e57b1701ac6fbaaf4f2aa0ba2bb8a.json b/.secrets/credentials/26f1356ad1fd23bad72f47e1cafd32b3886e57b1701ac6fbaaf4f2aa0ba2bb8a.json
new file mode 100644
index 000000000..24d881e32
--- /dev/null
+++ b/.secrets/credentials/26f1356ad1fd23bad72f47e1cafd32b3886e57b1701ac6fbaaf4f2aa0ba2bb8a.json
@@ -0,0 +1 @@
+{"key":"hf-token","value":"{\"encrypted\":\"pkdH1J0oiGVQ6u6wt3T8VxW1rM2LBGksRUBtD8OIw1QicrhzxzqGDyw3fiuMY/yLGohtQADIGY6YJS1hMNzTmWCTXQFv\",\"iv\":\"Qp3YbU0UR5H/c05J\",\"provider\":\"huggingface\",\"createdAt\":\"2026-06-10T14:33:08.480Z\",\"updatedAt\":\"2026-06-10T14:33:08.480Z\"}"}
\ No newline at end of file