diff --git a/deploy/install.sh b/deploy/install.sh
index 3c16e7c..d681e49 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -46,8 +46,9 @@ if [ ! -x "$VENV_PY" ]; then
     sudo -u "$SERVICE_USER" python3 -m venv "$REPO_ROOT/admin/.venv"
 fi
 echo "==> Installing the package + admin dependencies"
-# The service account's HOME is the checkout; do not create an untracked .cache there.
-sudo -u "$SERVICE_USER" sh -c "cd '$REPO_ROOT' && '$VENV_PIP' install --no-cache-dir --quiet '.[admin,vault]' -r admin/requirements.txt -c admin/requirements-lock.txt"
+# The service account's HOME is the checkout. The environment setting also reaches
+# isolated build-dependency pip processes, which do not inherit the CLI cache flag.
+sudo -u "$SERVICE_USER" sh -c "cd '$REPO_ROOT' && PIP_NO_CACHE_DIR=1 '$VENV_PIP' install --no-cache-dir --quiet '.[admin,vault]' -r admin/requirements.txt -c admin/requirements-lock.txt"
 
 # 4. State + log dirs (the unit's StateDirectory/ReadWritePaths keep them; pre-create
 #    so set-password + the SPS audit logger land right instead of crashing on first write)
diff --git a/tests/release/test_deployment.py b/tests/release/test_deployment.py
index 554aaf6..6e7035f 100644
--- a/tests/release/test_deployment.py
+++ b/tests/release/test_deployment.py
@@ -48,7 +48,9 @@ def test_native_installer_disables_pip_cache_in_service_home(self):
             pip.write_text('#!/bin/sh\n'
                            'printf "%s\\n" "$@" > "$HOME/pip-args"\n'
                            'case " $* " in *" --no-cache-dir "*) ;; '
-                           '*) mkdir -p "$HOME/.cache/pip" ;; esac\n')
+                           '*) mkdir -p "$HOME/.cache/pip" ;; esac\n'
+                           'sh -c \'printf "%s" "$PIP_NO_CACHE_DIR" > "$HOME/child-cache-setting"; '
+                           '[ "$PIP_NO_CACHE_DIR" = 1 ] || mkdir -p "$HOME/.cache/pip"\'\n')
             pip.chmod(0o700)
             subprocess.run(['bash', '-c', 'sudo(){ shift 2; "$@"; }\n' + command],
                            env={'PATH': '/usr/bin:/bin', 'HOME': tmp, 'REPO_ROOT': tmp,
@@ -58,6 +60,7 @@ def test_native_installer_disables_pip_cache_in_service_home(self):
             self.assertEqual(args[0], 'install')
             self.assertIn('--no-cache-dir', args)
             self.assertIn('admin/requirements-lock.txt', args)
+            self.assertEqual((home / 'child-cache-setting').read_text(), '1')
             self.assertFalse((home / '.cache').exists())
 
     def test_private_units_and_no_toml_environmentfile(self):