diff --git a/local/build-all.R b/local/build-all.R
index 18b0a52..c4d7f97 100644
--- a/local/build-all.R
+++ b/local/build-all.R
@@ -26,9 +26,50 @@ package_cache_files <- c(
   "/mnt/cache/packages/r_minor_sensitive_pkgs.rds",
   "/mnt/cache/packages/s3_cache.rds"
 )
-if (!all(file.exists(package_cache_files))) {
+# Existence is not freshness. The snapshot describes S3 and CRAN state at the
+# moment it was written, and the volume is per-agent, so an agent that ran an
+# earlier pipeline keeps serving that pipeline's answer forever. arm64/alpine324
+# reported "0 remaining" for both 4.4 and 4.6 from a stale snapshot listing 43
+# sensitive packages, while the install-deps step in the very same pipeline had
+# just computed 6871 on another agent.
+#
+# Keyed on the pipeline when the CI exposes one, so a new pipeline recomputes
+# once per agent and its shards then share the result. Off CI, or when no such
+# variable is set, fall back to an age check.
+snapshot_id_path <- "/mnt/cache/packages/snapshot.id"
+snapshot_ttl_hours <- as.numeric(
+  Sys.getenv("PACKAGE_SNAPSHOT_TTL_HOURS", unset = "2")
+)
+current_snapshot_id <- ""
+for (v in c("CI_PIPELINE_NUMBER", "CI_BUILD_NUMBER", "CI_PIPELINE_ID")) {
+  val <- Sys.getenv(v, unset = "")
+  if (nzchar(val)) {
+    current_snapshot_id <- paste(v, val, sep = "=")
+    break
+  }
+}
+
+snapshot_is_stale <- function() {
+  if (!all(file.exists(package_cache_files))) {
+    return(TRUE)
+  }
+  if (nzchar(current_snapshot_id)) {
+    cached <- tryCatch(
+      readLines(snapshot_id_path, warn = FALSE)[1L],
+      error = function(e) NA_character_,
+      warning = function(w) NA_character_
+    )
+    return(!identical(cached, current_snapshot_id))
+  }
+  age_hours <- as.numeric(
+    difftime(Sys.time(), file.mtime(package_cache_files[1L]), units = "hours")
+  )
+  isTRUE(age_hours > snapshot_ttl_hours)
+}
+
+if (snapshot_is_stale()) {
   message(
-    "Package snapshot missing from cache; recomputing via packages-to-build.R"
+    "Package snapshot missing or stale; recomputing via packages-to-build.R"
   )
   dir.create("/mnt/cache/packages", showWarnings = FALSE, recursive = TRUE)
   save_rds_atomic <- function(obj, path) {
@@ -42,6 +83,9 @@ if (!all(file.exists(package_cache_files))) {
     pkgs[r_minor_sensitive == TRUE],
     "/mnt/cache/packages/r_minor_sensitive_pkgs.rds"
   )
+  if (nzchar(current_snapshot_id)) {
+    writeLines(current_snapshot_id, snapshot_id_path)
+  }
   message("Package snapshot recomputed.")
 }