diff --git a/MODULE.bazel b/MODULE.bazel
index 7b6a1c919c..1712f1b7f8 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,5 +1,6 @@
 module(name = "codex")
 
+bazel_dep(name = "bazel_lib", version = "3.2.2")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 
diff --git a/bazel/build-info/BUILD.bazel b/bazel/build-info/BUILD.bazel
new file mode 100644
index 0000000000..ab199d362b
--- /dev/null
+++ b/bazel/build-info/BUILD.bazel
@@ -0,0 +1,12 @@
+load("@bazel_lib//lib:expand_template.bzl", "expand_template")
+
+# Isolate workspace status in a cheap action whose output changes only when
+# the embedded commit changes. Rust compiler actions consume only this file.
+expand_template(
+    name = "build-commit-env",
+    out = "build-commit.env",
+    stamp = 1,
+    stamp_substitutions = {"{BUILD_COMMIT}": "{{STABLE_GIT_COMMIT}}"},
+    template = ["STABLE_GIT_COMMIT={BUILD_COMMIT}"],
+    visibility = ["//codex-rs:__subpackages__"],
+)
diff --git a/codex-rs/cli/BUILD.bazel b/codex-rs/cli/BUILD.bazel
index 87494cb33f..41fbbb78ba 100644
--- a/codex-rs/cli/BUILD.bazel
+++ b/codex-rs/cli/BUILD.bazel
@@ -4,12 +4,12 @@ load("//bazel/rules:e2e_benchmark.bzl", "codex_e2e_benchmark")
 
 codex_rust_crate(
     name = "cli",
+    binaries_with_build_commit = ["codex"],
     crate_name = "codex_cli",
     extra_binaries = [
         "//codex-rs/bwrap:bwrap",
     ],
     rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
-    stamped_binaries = ["codex"],
     test_data_extra = glob(["src/**/snapshots/**"]),
 )
 
diff --git a/codex-rs/tui/BUILD.bazel b/codex-rs/tui/BUILD.bazel
index c98e954025..e0e14fac82 100644
--- a/codex-rs/tui/BUILD.bazel
+++ b/codex-rs/tui/BUILD.bazel
@@ -2,6 +2,7 @@ load("//:defs.bzl", "MACOS_WEBRTC_RUSTC_LINK_FLAGS", "codex_rust_crate")
 
 codex_rust_crate(
     name = "tui",
+    binaries_with_build_commit = ["codex-tui"],
     compile_data = glob([
         "assets/**",
         "frames/**",
@@ -12,7 +13,6 @@ codex_rust_crate(
     ],
     integration_compile_data_extra = ["src/test_backend.rs"],
     rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
-    stamped_binaries = ["codex-tui"],
     test_data_extra = glob([
         "src/**/*.rs",
         "src/**/snapshots/**",
diff --git a/codex-rs/voice-host/BUILD.bazel b/codex-rs/voice-host/BUILD.bazel
index a893868022..665141e706 100644
--- a/codex-rs/voice-host/BUILD.bazel
+++ b/codex-rs/voice-host/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "voice-host",
+    binaries_with_build_commit = ["codex-voice-host"],
     crate_name = "codex_voice_host",
     crate_srcs = [],
-    stamped_binaries = ["codex-voice-host"],
     unit_test_args = ["--test-threads=1"],
 )
diff --git a/defs.bzl b/defs.bzl
index 4a82be374e..7d2ea81faf 100644
--- a/defs.bzl
+++ b/defs.bzl
@@ -195,7 +195,7 @@ def codex_rust_crate(
         lib_data_extra = [],
         rustc_flags_extra = [],
         binary_rustc_flags_extra = {},
-        stamped_binaries = [],
+        binaries_with_build_commit = [],
         rustc_env = {},
         rustc_env_files = [],
         deps_extra = [],
@@ -240,9 +240,9 @@ def codex_rust_crate(
         lib_data_extra: Extra runtime data for the library target.
         binary_rustc_flags_extra: Mapping from binary names to extra rustc
             flags for those binary targets.
-        stamped_binaries: Binary names that read STABLE_GIT_COMMIT at compile
-            time. Other binaries omit workspace status inputs so Git revisions
-            and build timestamps do not invalidate their cached compilations.
+        binaries_with_build_commit: Binary names that embed STABLE_GIT_COMMIT from the
+            generated build-commit environment file. Other workspace status is
+            excluded from their compilation inputs.
         rustc_env: Extra rustc_env entries to merge with defaults.
         rustc_env_files: Generated compiler environment files for the library target.
         deps_extra: Extra normal deps beyond @crates resolution.
@@ -407,10 +407,16 @@ def codex_rust_crate(
             # generated rust_binary instead of leaking it to sibling binaries.
             compile_data = binary_compile_data_extra.get(binary, []),
             rustc_flags = rustc_flags_extra + binary_rustc_flags_extra.get(binary, []) + WINDOWS_RUSTC_LINK_FLAGS,
-            # Only consumers of build identity need workspace status inputs.
-            rustc_env = {"STABLE_GIT_COMMIT": "{STABLE_GIT_COMMIT}"} if binary in stamped_binaries else {},
+            # Keep stamp = 0: rules_rust otherwise makes stable-status.txt and
+            # volatile-status.txt compiler inputs, even though we only consume
+            # STABLE_GIT_COMMIT. BUILD_USER and BUILD_HOST vary across developers
+            # and CI workers, while BUILD_TIMESTAMP varies across builds; these
+            # unrelated values prevent remote cache reuse for the same commit.
+            # Isolate status inputs in build-commit-env's cheap action so its
+            # output, and hence this compiler input, changes only with the commit.
+            rustc_env_files = ["//bazel/build-info:build-commit-env"] if binary in binaries_with_build_commit else [],
             srcs = native.glob(["src/**/*.rs"]),
-            stamp = 1 if binary in stamped_binaries else 0,
+            stamp = 0,
             visibility = ["//visibility:public"],
         )