diff --git a/.cirrus.yml b/.cirrus.yml
index c936205..e19de19 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -37,11 +37,11 @@ build_task:
     image_name: "${FEDORA_NETAVARK_IMAGE}"
   cargo_cache: &cargo_cache
     folder: "$CARGO_HOME"
-    fingerprint_key: "cargo_v1_${DEST_BRANCH}"  # Cache for branch + PRs
+    fingerprint_script: echo -e "cargo_v3_${DEST_BRANCH}_amd64\n---\n$(<Cargo.lock)\n---\n$(<Cargo.toml)"
     reupload_on_changes: true
   targets_cache: &targets_cache
     folder: "$CARGO_TARGET_DIR"
-    fingerprint_key: "targets_v1_${CIRRUS_BUILD_ID}" # Cache only within same build
+    fingerprint_script: echo -e "targets_v3_${CIRRUS_TAG}${DEST_BRANCH}${CIRRUS_PR}_amd64\n---\n$(<Cargo.lock)\n---\n$(<Cargo.toml)"
     reupload_on_changes: true
   bin_cache: &bin_cache
     # This simply prevents rebuilding bin/aardvark-dns* or every subsequent task.
@@ -50,6 +50,8 @@ build_task:
     reupload_on_changes: true
   setup_script: &setup "$SCRIPT_BASE/setup.sh $CIRRUS_TASK_NAME"
   main_script: &main "$SCRIPT_BASE/runner.sh $CIRRUS_TASK_NAME"
+  # N/B: This script comes from `main` on the netavark repo
+  cache_grooming_script: &groom bash "$SCRIPT_BASE/netavark_cache_groom.sh"
   upload_caches: [ "cargo", "targets", "bin" ]
 
 
@@ -63,15 +65,16 @@ build_task:
   #    architecture: arm64  # CAUTION: This has to be "arm64", not aarch64.
   #  cargo_cache: &cargo_cache_aarch64
   #    <<: *cargo_cache
-  #    fingerprint_key: "cargo_v1_${DEST_BRANCH}_aarch64"
+  #    fingerprint_script: echo -e "cargo_v3_${DEST_BRANCH}_aarch64\n---\n$(<Cargo.lock)\n---\n$(<Cargo.toml)"
   #  targets_cache: &targets_cache_aarch64
   #    <<: *targets_cache
-  #    fingerprint_key: "cargo_v1_${DEST_BRANCH}_aarch64"
+  #    fingerprint_script: echo -e "targets_v3_${CIRRUS_TAG}${DEST_BRANCH}${CIRRUS_PR}_aarch64\n---\n$(<Cargo.lock)\n---\n$(<Cargo.toml)"
   #  bin_cache: &bin_cache_aarch64
   #    <<: *bin_cache
   #    fingerprint_key: "cargo_v1_${DEST_BRANCH}_aarch64"
   #  setup_script: *setup
   #  main_script: *main
+  #  cache_grooming_script: *groom
   #  upload_caches: [ "cargo", "targets", "bin" ]
 
 
diff --git a/.gitignore b/.gitignore
index 8e2ee5b..60e11d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 .idea/
 proto-build/netavark_proxy.rs
 /bin
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..e69de29
diff --git a/contrib/cirrus/netavark_cache_groom.sh b/contrib/cirrus/netavark_cache_groom.sh
new file mode 100644
index 0000000..b559ba2
--- /dev/null
+++ b/contrib/cirrus/netavark_cache_groom.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+#
+# This script is intended to be run from Cirrus-CI to prepare the
+# rust targets cache for re-use during subsequent runs.  This mainly
+# involves removing files and directories which change frequently
+# but are cheap/quick to regenerate - i.e. prevent "cache-flapping".
+# Any other use of this script is not supported and may cause harm.
+
+set -eo pipefail
+
+SCRIPT_DIRPATH=$(dirname ${BASH_SOURCE[0]})
+source $SCRIPT_DIRPATH/lib.sh
+
+if [[ "$CIRRUS_CI" != true ]] || [[ -z "$DEST_BRANCH" ]]; then
+  die "Script is not intended for use outside of Cirrus-CI"
+fi
+
+SCRIPT_DEST=$SCRIPT_DIRPATH/cache_groom.sh
+showrun curl --location --silent --show-error -o $SCRIPT_DEST \
+  https://raw.githubusercontent.com/containers/netavark/$DEST_BRANCH/contrib/cirrus/cache_groom.sh
+
+# Certain common automation library calls assume execution from this file
+exec bash $SCRIPT_DEST