diff --git a/apps/docs/content/docs/dev/advanced/redis.mdx b/apps/docs/content/docs/dev/advanced/redis.mdx
index 181bdd053..3d1c50e9a 100644
--- a/apps/docs/content/docs/dev/advanced/redis.mdx
+++ b/apps/docs/content/docs/dev/advanced/redis.mdx
@@ -55,6 +55,12 @@ REDIS_URL=redis://localhost:6379
 REDIS_PASSWORD=root
 ```
 
+<Callout type="info" title="Both processes read these">
+  The API takes its connection from `vitnode.api.config.ts`, but the [Next.js cache
+  handlers](#caching-nextjs-output) read these variables directly. If you run the
+  web app and the API as separate services, set them on both.
+</Callout>
+
 <Callout type="warn" title="Change the password in production">
   `root` is a convenience default for local development. Set a strong
   `REDIS_PASSWORD` in production.
@@ -189,6 +195,12 @@ export const postsRoute = buildRoute({
 
 ## Caching database queries
 
+<Callout type="info" title="Two caches, one request">
+  This page covers the cache *inside* the API. The Next.js cache in front of it
+  stores whole responses and is expired differently. [Cache](/docs/dev/cache)
+  covers both and how to choose between them.
+</Callout>
+
 The most useful method is `remember` - it runs your loader only on a cache
 miss, which is perfect for hot, rarely-changing data. Good candidates are
 reference data such as role-name translations or resolved staff permissions.
@@ -244,6 +256,109 @@ revoking an admin takes effect immediately - not when the cache expires.
   it never changes what a request can see beyond the short TTL above.
 </Callout>
 
+## Staff permission caching
+
+Resolving what an admin or a moderator is allowed to do takes three queries: the
+user's roles, whether any of them is `root`, and the staff entries attached to
+that user or those roles. Every gated request runs it, and an AdminCP page that
+renders a dozen gated elements runs it a dozen times.
+
+**When `redis` is configured, VitNode caches the resolved set for you** - keyed
+per user and per kind, in the shared framework namespace, for at most 60 seconds.
+
+The TTL is a backstop rather than the mechanism: the routes that can change the
+answer expire the cache themselves, so a permission change is live immediately.
+
+- Editing a **staff entry attached to a user** clears that user's entry.
+- Editing a **role**, deleting one, or editing a **staff entry attached to a
+  role** moves a generation stamp that every key is built from, which expires
+  every user's cached set in a single write - the members of a role are not a set
+  a mutation can cheaply enumerate.
+- Changing a user's **primary or secondary roles** clears that user's entry.
+
+<Callout type="info" title="Safe without Redis">
+  Without Redis the read misses, the write is a no-op, and every request resolves
+  permissions from the database exactly as before.
+</Callout>
+
+## Caching Next.js output
+
+Everything above is the cache *inside* the API. Redis also backs the **Next.js**
+caches in the web process, so a cached page or `fetch` response is shared by
+every instance instead of being rebuilt once per container.
+
+**There is nothing to add to `next.config.ts`.** `vitNodeNextConfig` wires the
+handlers up when `REDIS_URL` is set - the same variable that turns Redis on for
+the API - because Next takes a cache handler as a module *path* and cannot be
+handed a config object:
+
+```ts title="src/next.config.ts"
+// Already all it takes - the handlers follow REDIS_URL.
+export default vitNodeNextConfig(nextConfig);
+```
+
+<Callout type="warn" title="The web process reads the environment directly">
+  The API gets its connection from `vitnode.api.config.ts`; the cache handlers
+  cannot - they are loaded by Next itself, outside your app's module graph. They
+  read `REDIS_URL` and `REDIS_PASSWORD` from the environment, so both must be set
+  wherever the **web** process runs, not only where the API runs. In a split
+  deployment that means adding them to the frontend service too.
+</Callout>
+
+### What each handler covers
+
+VitNode registers two, because Next has two caches and they are not the same one:
+
+<TypeTable
+  type={{
+    "cacheHandlers.default": {
+      description:
+        'Backs the `use cache` directive. Entries are stored whole in Redis, so they survive a restart and every instance reads the same one.',
+      type: "use cache",
+    },
+    cacheHandler: {
+      description:
+        "Backs the fetch Data Cache and the prerender store. `fetch` responses go to Redis; prerendered pages stay on each instance's disk, where the build put them.",
+      type: "Data Cache + ISR",
+    },
+  }}
+/>
+
+Prerendered pages are deliberately left on disk. A custom handler *replaces*
+Next's filesystem cache outright, and the pages `next build` produced only exist
+there - putting them in Redis would mean serving one deploy's HTML from another
+deploy's cache. Their payloads are also Next-internal structures that would need
+re-checking on every upgrade. The build output is identical on every instance
+anyway, so there is nothing to gain by sharing it.
+
+### Why it matters: shared invalidation
+
+The part that is genuinely broken without this is not speed, it is correctness.
+`updateTag` runs on whichever instance handled the Server Action. With per-process
+caches the other instances never hear about it and keep serving the old page until
+their own copies age out.
+
+Both handlers record every revalidation in Redis and check it on read, so an
+invalidation raised anywhere is seen everywhere - including for the prerendered
+pages that still live on local disk, which each instance then rebuilds for itself.
+
+### Behaviour and limits
+
+- **A cold start misses.** The connection is opened in the background and commands
+  fail fast until it is ready, so the first requests after a boot render normally.
+- **A Redis outage is a miss, never an error.** Reads fall through and writes are
+  dropped; pages render as if nothing were cached.
+- **Entries carry a TTL** so abandoned keys cannot accumulate: `use cache` entries
+  expire at their `cacheLife` `expire`, stored `fetch` responses after 7 days, and
+  revalidation markers after 30 days.
+- **Everything lives under `vitnode:next:`**, separate from the API's
+  `vitnode:cache:` namespace, so neither side can clear the other by accident.
+
+<Callout type="info" title="Opting out">
+  To use Redis for the API but keep Next on its built-in caches, override the two
+  keys after the wrapper: `vitNodeNextConfig({ cacheHandler: undefined, cacheHandlers: undefined })`.
+</Callout>
+
 ## Rate limiting with Redis
 
 When `redis` is configured, the [rate limiter](/docs/dev/advanced/rate-limiter)
diff --git a/apps/docs/content/docs/dev/cache.mdx b/apps/docs/content/docs/dev/cache.mdx
new file mode 100644
index 000000000..5cd23e39b
--- /dev/null
+++ b/apps/docs/content/docs/dev/cache.mdx
@@ -0,0 +1,183 @@
+---
+title: Cache
+description: Learn how caching works in VitNode across Next.js and Redis.
+---
+
+VitNode uses a simple two-layer caching model:
+
+1. **Next.js Cache (App)**: Caches rendered UI and public API responses.
+2. **Redis Cache (API)**: Caches database queries and heavy computations inside Hono route handlers.
+
+Caching is **opt-in**. Dynamic data stays fresh by default.
+
+---
+
+## App Caching (Next.js)
+
+### Public Data (`"use cache"`)
+
+For public data shared by all visitors (e.g. blog posts, site configuration), use Next.js `"use cache"`.
+
+Always use `coreFetcher` (which skips request cookies) and call `await connection()` so Next.js can prerender safely:
+
+```ts title="services/announcements.ts"
+import { coreFetcher } from '@vitnode/core/lib/fetcher/core';
+import { cacheLife, cacheTag } from 'next/cache';
+import { connection } from 'next/server';
+
+export const getAnnouncements = async (locale: string) => {
+  'use cache';
+  cacheLife('hours');
+  cacheTag('announcements');
+  await connection();
+
+  const res = await coreFetcher(announcementsModule, {
+    module: 'announcements',
+    path: '/',
+    method: 'get',
+    args: { query: { lang: locale } },
+  });
+
+  return await res.json();
+};
+```
+
+Render cached data inside a `<Suspense>` boundary in your page:
+
+```tsx title="page.tsx"
+<React.Suspense fallback={<Skeleton className="h-64 w-full" />}>
+  <Announcements />
+</React.Suspense>
+```
+
+<Callout type="info" title="cacheLife Presets">
+  Common presets: `'seconds'`, `'minutes'`, `'hours'`, `'days'`, `'weeks'`, `'max'`, or custom `{ stale, revalidate, expire }`.
+</Callout>
+
+### Per-User Data (`React.cache`)
+
+Never cache user-specific data (such as sessions or permissions) with `"use cache"`.
+
+Instead, use React's `cache()` to deduplicate calls within a single render pass without sharing data between visitors:
+
+```ts title="services/profile.ts"
+import { fetcher } from '@vitnode/core/lib/fetcher';
+import { cache } from 'react';
+
+export const getMyProfile = cache(async () => {
+  const res = await fetcher(usersModule, {
+    module: 'users',
+    path: '/me',
+    method: 'get',
+  });
+
+  return await res.json();
+});
+```
+
+---
+
+## Invalidation APIs
+
+When data changes, expire the cached entries using the appropriate helper:
+
+import { TypeTable } from "fumadocs-ui/components/type-table";
+
+<TypeTable
+  type={{
+    "updateTag(tag)": {
+      description:
+        "Server Actions only. Instantly purges the tag and refreshes the current page (read-your-writes semantics).",
+      type: "void",
+    },
+    "revalidateTag(tag, profile)": {
+      description:
+        "Route Handlers, webhooks, or background jobs. Profile is required for SWR: revalidateTag('posts', 'max') or inline { revalidate: 3600 }.",
+      type: "void",
+    },
+    "refresh()": {
+      description:
+        "Server Actions only. Refreshes uncached dynamic data on the page without touching the cache.",
+      type: "void",
+    },
+  }}
+/>
+
+### Invalidation Example
+
+Call `updateTag` inside a Server Action after mutating data:
+
+```ts title="mutation-api.server.ts"
+'use server';
+
+import { fetcher } from '@vitnode/core/lib/fetcher';
+import { updateTag } from 'next/cache';
+
+export const publishAnnouncement = async (id: number) => {
+  const res = await fetcher(announcementsModule, {
+    module: 'announcements',
+    path: '/{id}/publish',
+    method: 'post',
+    args: { params: { id } },
+  });
+
+  // Purge the cache immediately
+  updateTag('announcements');
+
+  return await res.json();
+};
+```
+
+<Callout type="info" title="Content Engine">
+  Content Engine entries are automatically tagged and revalidated for you via `revalidateContent`. See [Content Engine Caching](/docs/dev/content-engine/public-api-and-caching).
+</Callout>
+
+---
+
+## Where the App cache is stored
+
+By default Next.js keeps `"use cache"` entries in a per-process memory cache and everything else on local disk. That is fine for one instance and wrong for several: an `updateTag` runs on whichever instance handled the Server Action, and the others keep serving what they already had.
+
+**Set `REDIS_URL` and VitNode swaps both Next.js cache handlers for Redis-backed ones.** No `next.config.ts` change is required - `vitNodeNextConfig` registers them:
+
+```ts title="src/next.config.ts"
+// Unchanged. The handlers follow REDIS_URL.
+export default vitNodeNextConfig(nextConfig);
+```
+
+What that buys you:
+
+- `"use cache"` entries are stored in Redis, so they survive restarts and rolling deploys and are shared between instances.
+- `fetch` Data Cache responses are shared too.
+- **Every tag revalidation is shared**, so `updateTag` on one instance invalidates all of them - including for prerendered pages, which stay on each instance's own disk and are rebuilt individually.
+
+<Callout type="warn" title="The web process needs the env vars">
+  The handlers are loaded by Next.js itself and read `REDIS_URL` / `REDIS_PASSWORD` straight from the environment - they cannot see `vitnode.api.config.ts`. In a split deployment, set them on the **frontend** service as well as the API.
+</Callout>
+
+See [Redis](/docs/dev/advanced/redis#caching-nextjs-output) for what each handler covers, TTLs, and how to opt out.
+
+## API Caching (Redis)
+
+Inside your Hono API route handlers, use `c.get("cache")` to store expensive query results in Redis:
+
+```ts title="plugins/stats/src/routes/stats.ts"
+// Cache result on miss for 5 minutes
+const stats = await c.get('cache').remember(
+  `stats:${containerId}`,
+  60 * 5, // TTL in seconds
+  async () => await calculateHeavyStats(c, containerId),
+);
+```
+
+### Invalidation
+
+Delete the key whenever the underlying record changes:
+
+```ts title="plugins/stats/src/routes/update.ts"
+await c.get('cache').delete(`stats:${containerId}`);
+```
+
+<Callout type="info" title="Optional Redis">
+  Redis is optional. If not configured, `c.get("cache")` gracefully acts as a no-op and runs the callback directly. See [Redis Setup](/docs/dev/advanced/redis).
+</Callout>
diff --git a/apps/docs/content/docs/dev/fetcher.mdx b/apps/docs/content/docs/dev/fetcher.mdx
index 17f733da2..8dbe9465e 100644
--- a/apps/docs/content/docs/dev/fetcher.mdx
+++ b/apps/docs/content/docs/dev/fetcher.mdx
@@ -63,20 +63,42 @@ const response = await fetcher(categoriesAdminModule, {
 
 ### Caching Responses
 
-You can leverage Next.js caching by passing cache options:
+`fetcher()` forwards the incoming request's cookies and headers, which means two
+things at once: the API knows who is asking, and the call can never sit inside a
+`"use cache"` function. For a response that is the same for every visitor, reach
+for `coreFetcher` - the same typed interface without the request-bound headers -
+and cache that:
 
 ```ts
-const response = await fetcher(usersModule, {
-  path: '/session',
-  method: 'get',
-  module: 'users',
-  options: {
-    // [!code ++]
-    cache: 'force-cache', // Uses Next.js cache
-  },
-});
+import { coreFetcher } from '@vitnode/core/lib/fetcher/core';
+import { cacheLife, cacheTag } from 'next/cache';
+
+const getAnnouncements = async () => {
+  // [!code ++:3]
+  'use cache';
+  cacheLife('minutes');
+  cacheTag('announcements');
+
+  const response = await coreFetcher(announcementsModule, {
+    path: '/',
+    method: 'get',
+    module: 'announcements',
+  });
+
+  return await response.json();
+};
 ```
 
+<Callout type="warn" title="Not for per-visitor responses">
+  Do not reach for `options: { cache: 'force-cache' }` on a `fetcher()` call. It
+  stores the response in the Next.js Data Cache keyed by the request - cookie
+  included - with no expiry, so the visitor keeps being served their own data
+  from whenever it was first fetched. Use React's `cache()` for those instead.
+</Callout>
+
+See [Cache](/docs/dev/cache) for how to decide which of the two a given route is,
+and how to expire what you store.
+
 ### Cookie Management
 
 When working with authentication or sessions, you might need to handle cookies. React Server Components have special considerations for cookie handling:
diff --git a/apps/docs/content/docs/dev/meta.json b/apps/docs/content/docs/dev/meta.json
index 47d11afc0..b2e0d3b9a 100644
--- a/apps/docs/content/docs/dev/meta.json
+++ b/apps/docs/content/docs/dev/meta.json
@@ -14,6 +14,7 @@
     "database",
     "content-engine",
     "fetcher",
+    "cache",
     "working-with-users",
     "i18n",
     "search",
diff --git a/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/login/reset-password/page.tsx b/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/login/reset-password/page.tsx
index 02f57b3b6..e61670367 100644
--- a/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/login/reset-password/page.tsx
+++ b/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/login/reset-password/page.tsx
@@ -4,6 +4,15 @@ import { getTranslations } from "next-intl/server";
 
 import { PasswordResetView } from "@vitnode/core/views/auth/password-reset/password-reset-view";
 
+// instant = false: kept on purpose. The page is only meaningful on an install
+// with an email adapter, and `PasswordResetView` calls `notFound()` when there
+// is none - so the response status depends on a read only the API can answer.
+// That read cannot be prerendered, and behind a `<Suspense>` boundary it would
+// land after the fallback had already committed the response to 200, leaving
+// crawlers, caches and monitoring with a successful reset-password page whose
+// body says not-found. The route blocks so the status is decided first.
+export const instant = false;
+
 export const generateMetadata = async (): Promise<Metadata> => {
   const t = await getTranslations("core.auth.reset_password");
 
diff --git a/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/settings/layout.tsx b/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/settings/layout.tsx
index 0e3b8c17b..b1bf02a42 100644
--- a/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/settings/layout.tsx
+++ b/apps/docs/src/app/[locale]/(main)/(plugins)/(vitnode-core)/settings/layout.tsx
@@ -9,11 +9,6 @@ export const metadata: Metadata = {
   },
 };
 
-// instant = false: kept on purpose. Every route under this layout is gated on a
-// signed-in user in `LayoutSettings`, which calls `notFound()` when there isn't
-// one. Moving that read inside `<Suspense>` would turn a real 404 into a 200
-// shell that later swaps to a not-found body, so the gate stays where it is and
-// the segment is allowed to block.
 export const instant = false;
 
 export default function Layout(
diff --git a/apps/docs/src/app/[locale]/admin/(auth)/(plugins)/(vitnode-core)/core/users/[id]/page.tsx b/apps/docs/src/app/[locale]/admin/(auth)/(plugins)/(vitnode-core)/core/users/[id]/page.tsx
index a5f1d66ae..df6ff9e14 100644
--- a/apps/docs/src/app/[locale]/admin/(auth)/(plugins)/(vitnode-core)/core/users/[id]/page.tsx
+++ b/apps/docs/src/app/[locale]/admin/(auth)/(plugins)/(vitnode-core)/core/users/[id]/page.tsx
@@ -2,6 +2,7 @@ import type { Metadata } from "next/dist/types";
 
 import { getTranslations } from "next-intl/server";
 import dynamic from "next/dynamic";
+import { connection } from "next/server";
 import React from "react";
 
 import { adminModule } from "@vitnode/core/api/modules/admin/admin.module";
@@ -46,18 +47,38 @@ export const generateMetadata = async ({
   };
 };
 
-export default async function Page({
+/**
+ * `generateMetadata` puts the user's name in the title, which needs a fetch that
+ * cannot be cached - `fetcher` forwards the request's cookies and `use cache`
+ * cannot enclose a runtime read. This marks the route as intentionally partly
+ * dynamic so the metadata is allowed to be, while the body still prerenders.
+ */
+const DynamicMarker = async () => {
+  await connection();
+
+  return null;
+};
+
+const ShowUserAdmin = async ({
   params,
 }: {
   params: Promise<{ id: string }>;
-}) {
+}) => {
   const { id } = await params;
 
+  return <ShowUserAdminView id={id} />;
+};
+
+export default function Page({ params }: { params: Promise<{ id: string }> }) {
   return (
     <I18nProvider namespaces={["admin.user", "core.search"]}>
       <div className="p-4">
+        <React.Suspense fallback={null}>
+          <DynamicMarker />
+        </React.Suspense>
+
         <React.Suspense fallback={<Loader />}>
-          <ShowUserAdminView id={id} />
+          <ShowUserAdmin params={params} />
         </React.Suspense>
       </div>
     </I18nProvider>
diff --git a/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx b/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx
index 2dbb8c87e..49b3a048d 100644
--- a/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx
+++ b/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbStaffEditAdmin } from "@vitnode/core/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin";
+import { BreadcrumbSkeleton } from "@vitnode/core/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbStaffEditAdmin id={id} type="admin" />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={4} />}>
+      <BreadcrumbStaffEditAdmin params={params} type="admin" />
+    </React.Suspense>
+  );
 }
diff --git a/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx b/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx
index 753c353b2..75e151b69 100644
--- a/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx
+++ b/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbStaffEditAdmin } from "@vitnode/core/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin";
+import { BreadcrumbSkeleton } from "@vitnode/core/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbStaffEditAdmin id={id} type="moderator" />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={4} />}>
+      <BreadcrumbStaffEditAdmin params={params} type="moderator" />
+    </React.Suspense>
+  );
 }
diff --git a/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx b/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx
index 59050d00a..69bdd70e3 100644
--- a/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx
+++ b/apps/docs/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbUserAdmin } from "@vitnode/core/views/admin/layouts/breadcrumb/breadcrumb-user-admin";
+import { BreadcrumbSkeleton } from "@vitnode/core/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbUserAdmin id={id} />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={3} />}>
+      <BreadcrumbUserAdmin params={params} />
+    </React.Suspense>
+  );
 }
diff --git a/apps/docs/src/app/[locale]/admin/(auth)/layout.tsx b/apps/docs/src/app/[locale]/admin/(auth)/layout.tsx
index a6e0ca312..83191e110 100644
--- a/apps/docs/src/app/[locale]/admin/(auth)/layout.tsx
+++ b/apps/docs/src/app/[locale]/admin/(auth)/layout.tsx
@@ -5,8 +5,6 @@ import {
 
 import { vitNodeConfig } from "@/vitnode.config";
 
-export const instant = false;
-
 export default function Layout(props: AdminLayoutProps) {
   return <AdminLayout vitNodeConfig={vitNodeConfig} {...props} />;
 }
diff --git a/apps/docs/src/app/[locale]/layout.client.tsx b/apps/docs/src/app/[locale]/layout.client.tsx
index 8ae133f18..e10eb48fc 100644
--- a/apps/docs/src/app/[locale]/layout.client.tsx
+++ b/apps/docs/src/app/[locale]/layout.client.tsx
@@ -1,16 +1,43 @@
 "use client";
 
-import { useParams } from "next/navigation";
+import { useParams, useServerInsertedHTML } from "next/navigation";
 import { useLayoutEffect } from "react";
 
 /**
- * Keeps the docs section class (`dev`, `guides`, `plugins`, `ui`) on `<body>` in
- * sync with the route. The class sets `--color-fd-primary`, so it has to live on
- * `<body>` - an element that cannot be wrapped in `<Suspense>`.
+ * Paints the docs section class (`dev`, `guides`, `plugins`, `ui`) on `<html>`
+ * before first paint.
  *
- * First paint is handled by the inline script in the root layout, which derives
- * the same class from `location.pathname` before anything renders. This takes
- * over from there, so client navigations between sections repaint correctly.
+ * The class sets `--color-fd-primary`, so it has to sit on an ancestor of the
+ * whole shell. `<body>` cannot be wrapped in `<Suspense>`, so the class cannot
+ * come from a `useParams()` read during prerendering without making every route
+ * block - deriving it from `location.pathname` here keeps the shell static.
+ *
+ * `useServerInsertedHTML` keeps the tag out of React's render tree: it is
+ * emitted into the streamed `<head>` on the server and is a no-op on the
+ * client, so React never renders a `<script>` during a client render (which it
+ * warns about, and which would never execute anyway).
+ */
+const docsModeScript = `(function(){var p=location.pathname.split("/"),i=p.indexOf("docs"),m=i<0?"":p[i+1];if(m)document.documentElement.classList.add(m)})()`;
+
+export function DocsModeScript(): null {
+  useServerInsertedHTML(() => (
+    <script
+      // eslint-disable-next-line @eslint-react/dom-no-dangerously-set-innerhtml
+      dangerouslySetInnerHTML={{ __html: docsModeScript }}
+      key="docs-mode-script"
+      suppressHydrationWarning
+    />
+  ));
+
+  return null;
+}
+
+/**
+ * Keeps the docs section class on `<html>` in sync with the route.
+ *
+ * First paint is handled by `DocsModeScript` above, which derives the same
+ * class from `location.pathname` before anything renders. This takes over from
+ * there, so client navigations between sections repaint correctly.
  * Renders nothing.
  */
 export function DocsModeSync(): null {
@@ -20,10 +47,10 @@ export function DocsModeSync(): null {
   useLayoutEffect(() => {
     if (typeof mode !== "string" || mode.length === 0) return;
 
-    document.body.classList.add(mode);
+    document.documentElement.classList.add(mode);
 
     return () => {
-      document.body.classList.remove(mode);
+      document.documentElement.classList.remove(mode);
     };
   }, [mode]);
 
diff --git a/apps/docs/src/app/[locale]/layout.tsx b/apps/docs/src/app/[locale]/layout.tsx
index 99391552e..38c145de8 100644
--- a/apps/docs/src/app/[locale]/layout.tsx
+++ b/apps/docs/src/app/[locale]/layout.tsx
@@ -15,7 +15,7 @@ import { Suspense } from "react";
 import { vitNodeConfig } from "@/vitnode.config";
 
 import SearchDialogFumadocs from "../../components/fumadocs/search-dialog";
-import { DocsModeSync } from "./layout.client";
+import { DocsModeScript, DocsModeSync } from "./layout.client";
 
 export const generateMetadata = (): Metadata =>
   generateMetadataRootLayout(vitNodeConfig);
@@ -27,16 +27,6 @@ const geist = Geist({
   subsets: ["latin"],
 });
 
-/**
- * Paints the docs section class on `<body>` before first paint.
- *
- * `<body>` cannot be wrapped in `<Suspense>`, so the class cannot come from a
- * `useParams()` read during prerendering without making every route block.
- * Deriving it from `location.pathname` here keeps the shell static; the
- * `DocsModeSync` component below takes over for client navigations.
- */
-const docsModeScript = `(function(){var p=location.pathname.split("/"),i=p.indexOf("docs"),m=i<0?"":p[i+1];if(m)document.body.classList.add(m)})()`;
-
 export default async function Layout(props: RootLayoutProps) {
   const locale = await getLocale();
 
@@ -46,8 +36,7 @@ export default async function Layout(props: RootLayoutProps) {
         className={`${geist.className} antialiased`}
         suppressHydrationWarning
       >
-        {/* eslint-disable-next-line @eslint-react/dom-no-dangerously-set-innerhtml */}
-        <script dangerouslySetInnerHTML={{ __html: docsModeScript }} />
+        <DocsModeScript />
         <Suspense>
           <DocsModeSync />
         </Suspense>
diff --git a/apps/docs/src/app/global.css b/apps/docs/src/app/global.css
index 06c7de5df..a349c0577 100644
--- a/apps/docs/src/app/global.css
+++ b/apps/docs/src/app/global.css
@@ -145,18 +145,18 @@
   }
 }
 
-.dev {
+html.dev {
   --color-fd-primary: var(--dev-color);
 }
 
-.guides {
+html.guides {
   --color-fd-primary: var(--guides-color);
 }
 
-.plugins {
+html.plugins {
   --color-fd-primary: var(--plugins-color);
 }
 
-.ui {
+html.ui {
   --color-fd-primary: var(--ui-color);
 }
diff --git a/packages/create-vitnode-app/copy-of-vitnode-app/monorepo/apps/web/.env.example b/packages/create-vitnode-app/copy-of-vitnode-app/monorepo/apps/web/.env.example
index cc536606d..3f87cb318 100644
--- a/packages/create-vitnode-app/copy-of-vitnode-app/monorepo/apps/web/.env.example
+++ b/packages/create-vitnode-app/copy-of-vitnode-app/monorepo/apps/web/.env.example
@@ -1 +1,12 @@
-NEXT_PUBLIC_API_URL=http://localhost:8080
\ No newline at end of file
+NEXT_PUBLIC_API_URL=http://localhost:8080
+
+# Optional. Set these to back the Next.js caches with Redis, so cached pages and
+# `use cache` entries are shared between instances and a tag revalidation on one
+# instance is seen by all of them.
+#
+# The web process needs its own copy: the cache handlers are loaded by Next.js
+# itself and read the environment directly - they cannot see the API's
+# `vitnode.api.config.ts`. Point them at the same Redis the API uses.
+# https://vitnode.com/docs/dev/advanced/redis#caching-nextjs-output
+# REDIS_URL=redis://localhost:6379
+# REDIS_PASSWORD=root
diff --git a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx
index 2dbb8c87e..49b3a048d 100644
--- a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx
+++ b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/admins/edit/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbStaffEditAdmin } from "@vitnode/core/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin";
+import { BreadcrumbSkeleton } from "@vitnode/core/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbStaffEditAdmin id={id} type="admin" />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={4} />}>
+      <BreadcrumbStaffEditAdmin params={params} type="admin" />
+    </React.Suspense>
+  );
 }
diff --git a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx
index 753c353b2..75e151b69 100644
--- a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx
+++ b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/staff/moderators/edit/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbStaffEditAdmin } from "@vitnode/core/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin";
+import { BreadcrumbSkeleton } from "@vitnode/core/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbStaffEditAdmin id={id} type="moderator" />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={4} />}>
+      <BreadcrumbStaffEditAdmin params={params} type="moderator" />
+    </React.Suspense>
+  );
 }
diff --git a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx
index 59050d00a..69bdd70e3 100644
--- a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx
+++ b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/@breadcrumb/core/users/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbUserAdmin } from "@vitnode/core/views/admin/layouts/breadcrumb/breadcrumb-user-admin";
+import { BreadcrumbSkeleton } from "@vitnode/core/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbUserAdmin id={id} />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={3} />}>
+      <BreadcrumbUserAdmin params={params} />
+    </React.Suspense>
+  );
 }
diff --git a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/layout.tsx b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/layout.tsx
index a6e0ca312..83191e110 100644
--- a/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/layout.tsx
+++ b/packages/create-vitnode-app/copy-of-vitnode-app/root/src/app/[locale]/admin/(auth)/layout.tsx
@@ -5,8 +5,6 @@ import {
 
 import { vitNodeConfig } from "@/vitnode.config";
 
-export const instant = false;
-
 export default function Layout(props: AdminLayoutProps) {
   return <AdminLayout vitNodeConfig={vitNodeConfig} {...props} />;
 }
diff --git a/packages/vitnode/config/next.config.ts b/packages/vitnode/config/next.config.ts
index 4a2816cb3..55208f433 100644
--- a/packages/vitnode/config/next.config.ts
+++ b/packages/vitnode/config/next.config.ts
@@ -1,12 +1,62 @@
 import type { NextConfig } from "next";
+
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import createNextIntlPlugin from "next-intl/plugin";
 
 const withNextIntl = createNextIntlPlugin("./src/vitnode.config.ts");
 
+/**
+ * Absolute path to one of the built cache handlers.
+ *
+ * Next takes a cache handler as a **path** and imports it itself, so this has to
+ * point at the compiled file rather than the source. Resolved from this module's
+ * own URL rather than through the package name: the config is loaded from inside
+ * the package, and locating a sibling file needs no export map, no resolution
+ * conditions and no self-reference support.
+ */
+const handlerPath = (name: string): null | string => {
+  const path = fileURLToPath(
+    new URL(`../dist/src/lib/cache/${name}.js`, import.meta.url),
+  );
+
+  return existsSync(path) ? path : null;
+};
+
+/**
+ * Redis-backed cache handlers, when `REDIS_URL` is set.
+ *
+ * `REDIS_URL` is the switch because a cache handler is a module path - there is
+ * no way to hand it a config object from here - so the environment is the only
+ * channel it has. That also keeps it consistent with the API, where
+ * `vitnode.api.config.ts` already gates Redis on the same variable.
+ *
+ * Two slots, because Next has two caches and they are not the same one:
+ *
+ * - `cacheHandlers.default` backs `"use cache"`.
+ * - `cacheHandler` backs the `fetch` Data Cache and the prerender store.
+ *
+ * Both fall back to what Next does by default if the built files are missing, so
+ * a half-built workspace degrades to the in-memory and filesystem caches instead
+ * of failing to boot.
+ */
+const redisCacheHandlers = (): NextConfig => {
+  if (!process.env.REDIS_URL) return {};
+
+  const useCache = handlerPath("use-cache-handler");
+  const incremental = handlerPath("incremental-cache-handler");
+
+  return {
+    ...(useCache ? { cacheHandlers: { default: useCache } } : {}),
+    ...(incremental ? { cacheHandler: incremental } : {}),
+  };
+};
+
 export const vitNodeNextConfig = (config: NextConfig): NextConfig =>
   withNextIntl({
     cacheComponents: true,
     partialPrefetching: true,
+    ...redisCacheHandlers(),
     ...config,
     serverExternalPackages: [
       ...(config.serverExternalPackages ?? []),
diff --git a/packages/vitnode/src/api/lib/check-staff-permission.ts b/packages/vitnode/src/api/lib/check-staff-permission.ts
index 67a426033..80c0f1180 100644
--- a/packages/vitnode/src/api/lib/check-staff-permission.ts
+++ b/packages/vitnode/src/api/lib/check-staff-permission.ts
@@ -15,6 +15,10 @@ import type {
 } from "./permission-staff";
 
 import { hasStaffPermission, staffPermissionKey } from "./staff-permission";
+import {
+  readStaffPermissions,
+  writeStaffPermissions,
+} from "./staff-permission-cache";
 
 const tableByType = {
   admin: core_admin_permissions,
@@ -34,7 +38,14 @@ export const getUserRoleIds = async (
   return [...new Set([user.roleId, ...secondary.map(row => row.roleId)])];
 };
 
-export const resolveStaffPermissions = async (
+/**
+ * The three queries behind a permission set: the user's roles, whether any of
+ * them is `root`, and the staff entries attached to the user or those roles.
+ *
+ * Split out from {@link resolveStaffPermissions} so the cache in front of it has
+ * something to be a cache *of* - and so the uncached path stays readable.
+ */
+const loadStaffPermissions = async (
   c: Context,
   {
     type,
@@ -82,6 +93,37 @@ export const resolveStaffPermissions = async (
   return { root: false, permissions };
 };
 
+/**
+ * A user's effective staff permissions, read through the shared cache.
+ *
+ * This is the hottest read on an authenticated request: `GET /session` resolves
+ * it, and so does every `assertStaffPermission` an AdminCP route runs. Three
+ * database queries each time adds up on a page that renders a dozen gated
+ * elements, and the answer only moves when an admin edits a role or a staff
+ * entry - each of which expires the cache explicitly, so its 60-second lifetime
+ * is only a backstop.
+ *
+ * Without Redis the read misses, the write is a no-op, and this is exactly the
+ * uncached function it wraps. `remember` is not used because the key depends on
+ * a value that has to be read from the cache first - see
+ * [the epoch](./staff-permission-cache.ts).
+ */
+export const resolveStaffPermissions = async (
+  c: Context,
+  {
+    type,
+    user,
+  }: { type: PermissionStaffType; user: { id: number; roleId: number } },
+): Promise<StaffPermissionSet> => {
+  const cached = await readStaffPermissions(c, { type, userId: user.id });
+  if (cached) return cached;
+
+  const resolved = await loadStaffPermissions(c, { type, user });
+  await writeStaffPermissions(c, { type, userId: user.id }, resolved);
+
+  return resolved;
+};
+
 export const checkStaffPermission = async (
   c: Context,
   { type, ...args }: PermissionsStaffArgs & { type: PermissionStaffType },
diff --git a/packages/vitnode/src/api/lib/staff-permission-cache.test.ts b/packages/vitnode/src/api/lib/staff-permission-cache.test.ts
new file mode 100644
index 000000000..56b0aaab8
--- /dev/null
+++ b/packages/vitnode/src/api/lib/staff-permission-cache.test.ts
@@ -0,0 +1,331 @@
+// @vitest-environment node
+import type { Context } from "hono";
+
+import { beforeEach, describe, expect, it } from "vitest";
+
+import type { StaffPermissionSet } from "./permission-staff";
+
+import { resolveStaffPermissions } from "./check-staff-permission";
+import {
+  invalidateAllStaffPermissions,
+  invalidateStaffEntry,
+  invalidateStaffPermissionsForUser,
+  readStaffPermissions,
+  writeStaffPermissions,
+} from "./staff-permission-cache";
+
+/**
+ * The slice of `CacheModel` this module uses, over a Map.
+ *
+ * `configured: false` reproduces a deployment without Redis, where every read
+ * misses and every write is dropped - the case that has to keep working, since
+ * Redis is optional.
+ */
+const fakeCache = ({ configured = true }: { configured?: boolean } = {}) => {
+  const store = new Map<string, string>();
+
+  return {
+    store,
+    deleteSystem: async (key: string | string[]) => {
+      for (const one of Array.isArray(key) ? key : [key]) store.delete(one);
+
+      return Promise.resolve();
+    },
+    getSystem: async <T>(key: string): Promise<null | T> => {
+      if (!configured) return Promise.resolve(null);
+      const raw = store.get(key);
+
+      return Promise.resolve(raw === undefined ? null : (JSON.parse(raw) as T));
+    },
+    setSystem: async <T>(key: string, value: T): Promise<void> => {
+      if (configured) store.set(key, JSON.stringify(value));
+
+      return Promise.resolve();
+    },
+  };
+};
+
+/**
+ * A `db` whose `select()` chain hands back the next queued result set.
+ *
+ * `resolveStaffPermissions` runs three selects in a fixed order - secondary
+ * roles, root roles, staff entries - so a queue is enough to drive it, and
+ * `selects` is what the assertions about cache hits actually count.
+ */
+const fakeDb = (results: unknown[][]) => {
+  let index = 0;
+  const state = { selects: 0 };
+
+  return {
+    state,
+    db: {
+      select: () => {
+        state.selects += 1;
+        const rows = results[index++] ?? [];
+        const chain: Record<string, unknown> = {
+          from: () => chain,
+          where: () => chain,
+          limit: async () => Promise.resolve(rows),
+          then: async (
+            onFulfilled: (value: unknown[]) => unknown,
+            onRejected?: (reason: unknown) => unknown,
+          ) => Promise.resolve(rows).then(onFulfilled, onRejected),
+        };
+
+        return chain;
+      },
+    },
+  };
+};
+
+const MODERATOR_PERMISSION = {
+  plugin: "@vitnode/core",
+  module: "posts",
+  permission: "can_delete",
+};
+
+/** No secondary roles, no root role, one staff entry with one permission. */
+const oneStaffEntry = () => [
+  [],
+  [],
+  [{ unrestricted: false, permissions: [MODERATOR_PERMISSION] }],
+];
+
+const context = (
+  cache: ReturnType<typeof fakeCache>,
+  db?: ReturnType<typeof fakeDb>["db"],
+): Context =>
+  ({
+    get: (key: string) => (key === "cache" ? cache : db),
+  }) as unknown as Context;
+
+const USER = { id: 42, roleId: 3 };
+
+describe("staff permission cache", () => {
+  let cache: ReturnType<typeof fakeCache>;
+
+  beforeEach(() => {
+    cache = fakeCache();
+  });
+
+  it("round-trips a permission set", async () => {
+    const c = context(cache);
+    const value: StaffPermissionSet = {
+      root: false,
+      permissions: [MODERATOR_PERMISSION],
+    };
+
+    await writeStaffPermissions(c, { type: "admin", userId: 1 }, value);
+
+    expect(await readStaffPermissions(c, { type: "admin", userId: 1 })).toEqual(
+      value,
+    );
+  });
+
+  it("keeps admin and moderator sets apart", async () => {
+    const c = context(cache);
+
+    await writeStaffPermissions(
+      c,
+      { type: "admin", userId: 1 },
+      { root: true, permissions: [] },
+    );
+
+    expect(
+      await readStaffPermissions(c, { type: "moderator", userId: 1 }),
+    ).toBeNull();
+  });
+
+  it("keeps one user's set out of another's", async () => {
+    const c = context(cache);
+
+    await writeStaffPermissions(
+      c,
+      { type: "admin", userId: 1 },
+      { root: true, permissions: [] },
+    );
+
+    expect(
+      await readStaffPermissions(c, { type: "admin", userId: 2 }),
+    ).toBeNull();
+  });
+
+  it("moving the epoch expires every user at once", async () => {
+    const c = context(cache);
+
+    for (const userId of [1, 2, 3]) {
+      await writeStaffPermissions(
+        c,
+        { type: "admin", userId },
+        { root: true, permissions: [] },
+      );
+    }
+
+    await invalidateAllStaffPermissions(c);
+
+    for (const userId of [1, 2, 3]) {
+      expect(
+        await readStaffPermissions(c, { type: "admin", userId }),
+      ).toBeNull();
+    }
+  });
+
+  it("a per-user invalidation leaves everyone else warm", async () => {
+    const c = context(cache);
+
+    for (const userId of [1, 2]) {
+      await writeStaffPermissions(
+        c,
+        { type: "admin", userId },
+        { root: true, permissions: [] },
+      );
+      await writeStaffPermissions(
+        c,
+        { type: "moderator", userId },
+        { root: true, permissions: [] },
+      );
+    }
+
+    await invalidateStaffPermissionsForUser(c, 1);
+
+    expect(
+      await readStaffPermissions(c, { type: "admin", userId: 1 }),
+    ).toBeNull();
+    expect(
+      await readStaffPermissions(c, { type: "moderator", userId: 1 }),
+    ).toBeNull();
+    expect(
+      await readStaffPermissions(c, { type: "admin", userId: 2 }),
+    ).not.toBeNull();
+  });
+
+  describe("invalidateStaffEntry", () => {
+    it("expires only the named user for a user-scoped entry", async () => {
+      const c = context(cache);
+
+      await writeStaffPermissions(
+        c,
+        { type: "admin", userId: 1 },
+        { root: true, permissions: [] },
+      );
+      await writeStaffPermissions(
+        c,
+        { type: "admin", userId: 2 },
+        { root: true, permissions: [] },
+      );
+
+      await invalidateStaffEntry(c, { roleId: null, userId: 1 });
+
+      expect(
+        await readStaffPermissions(c, { type: "admin", userId: 1 }),
+      ).toBeNull();
+      expect(
+        await readStaffPermissions(c, { type: "admin", userId: 2 }),
+      ).not.toBeNull();
+    });
+
+    it("expires everyone for a role-scoped entry", async () => {
+      const c = context(cache);
+
+      await writeStaffPermissions(
+        c,
+        { type: "admin", userId: 2 },
+        { root: true, permissions: [] },
+      );
+
+      await invalidateStaffEntry(c, { roleId: 5, userId: null });
+
+      expect(
+        await readStaffPermissions(c, { type: "admin", userId: 2 }),
+      ).toBeNull();
+    });
+  });
+});
+
+describe("resolveStaffPermissions", () => {
+  it("queries the database once and serves the rest from the cache", async () => {
+    const cache = fakeCache();
+    const first = fakeDb(oneStaffEntry());
+    const expected: StaffPermissionSet = {
+      root: false,
+      permissions: [MODERATOR_PERMISSION],
+    };
+
+    const one = await resolveStaffPermissions(context(cache, first.db), {
+      type: "moderator",
+      user: USER,
+    });
+
+    expect(one).toEqual(expected);
+    expect(first.state.selects).toBe(3);
+
+    // A second request, same cache: the loader must not run again.
+    const second = fakeDb([]);
+    const two = await resolveStaffPermissions(context(cache, second.db), {
+      type: "moderator",
+      user: USER,
+    });
+
+    expect(two).toEqual(expected);
+    expect(second.state.selects).toBe(0);
+  });
+
+  it("goes back to the database after an invalidation", async () => {
+    const cache = fakeCache();
+
+    await resolveStaffPermissions(context(cache, fakeDb(oneStaffEntry()).db), {
+      type: "moderator",
+      user: USER,
+    });
+
+    await invalidateStaffPermissionsForUser(context(cache), USER.id);
+
+    const after = fakeDb(oneStaffEntry());
+    await resolveStaffPermissions(context(cache, after.db), {
+      type: "moderator",
+      user: USER,
+    });
+
+    expect(after.state.selects).toBe(3);
+  });
+
+  it("resolves from the database on every call without Redis", async () => {
+    const cache = fakeCache({ configured: false });
+    const expected: StaffPermissionSet = {
+      root: false,
+      permissions: [MODERATOR_PERMISSION],
+    };
+
+    for (const attempt of [0, 1]) {
+      const run = fakeDb(oneStaffEntry());
+      const result = await resolveStaffPermissions(context(cache, run.db), {
+        type: "moderator",
+        user: USER,
+      });
+
+      expect(result, `attempt ${attempt}`).toEqual(expected);
+      expect(run.state.selects, `attempt ${attempt}`).toBe(3);
+    }
+  });
+
+  it("caches a root resolution too, so `root: true` is not re-queried", async () => {
+    const cache = fakeCache();
+    const first = fakeDb([[], [{ id: 9 }]]);
+
+    const one = await resolveStaffPermissions(context(cache, first.db), {
+      type: "admin",
+      user: USER,
+    });
+
+    expect(one).toEqual({ root: true, permissions: [] });
+
+    const second = fakeDb([]);
+    const two = await resolveStaffPermissions(context(cache, second.db), {
+      type: "admin",
+      user: USER,
+    });
+
+    expect(two).toEqual({ root: true, permissions: [] });
+    expect(second.state.selects).toBe(0);
+  });
+});
diff --git a/packages/vitnode/src/api/lib/staff-permission-cache.ts b/packages/vitnode/src/api/lib/staff-permission-cache.ts
new file mode 100644
index 000000000..4dd8e7080
--- /dev/null
+++ b/packages/vitnode/src/api/lib/staff-permission-cache.ts
@@ -0,0 +1,140 @@
+import type { Context } from "hono";
+
+import { randomUUID } from "node:crypto";
+
+import type {
+  PermissionStaffType,
+  StaffPermissionSet,
+} from "./permission-staff";
+
+/**
+ * How long one resolved permission set is trusted.
+ *
+ * The same 60 seconds the [session cache](../models/session-cache.ts) uses, and
+ * for the same reason: it is a ceiling on how stale a permission check can be if
+ * something changed the answer without going through one of the invalidation
+ * points below. Every route that *does* change the answer expires the cache
+ * itself, so the TTL is a backstop rather than the mechanism.
+ */
+export const STAFF_PERMISSIONS_CACHE_TTL_SECONDS = 60;
+
+/**
+ * The generation stamp every permission key is built from.
+ *
+ * Lives in the framework system namespace and is written with **no TTL** - it is
+ * the thing that has to outlive the entries it names.
+ */
+const EPOCH_KEY = "staff-permissions:epoch";
+
+const STAFF_TYPES = ["admin", "moderator"] as const;
+
+/**
+ * Reads the current generation, or the one every deployment starts on.
+ *
+ * A miss is not an error: it means nothing has invalidated the cache yet - or
+ * Redis is not configured, in which case nothing is cached either and the key
+ * this builds is never read from anything.
+ */
+const readEpoch = async (c: Context): Promise<string> =>
+  (await c.get("cache").getSystem<string>(EPOCH_KEY)) ?? "0";
+
+/**
+ * Where one user's resolved permission set of one kind lives.
+ *
+ * In the **system** namespace rather than the per-plugin one, because the read
+ * and the write can happen under different plugins: a moderator permission check
+ * runs inside whichever plugin's route asked for it, while the AdminCP routes
+ * that invalidate it are core's. A plugin-namespaced key would let a plugin's
+ * cached copy survive the change that was supposed to expire it.
+ */
+const permissionsKey = (
+  epoch: string,
+  { type, userId }: { type: PermissionStaffType; userId: number },
+): string => `staff-permissions:${epoch}:${type}:${userId}`;
+
+/** The cached resolution, or `null` on a miss, without Redis, or on error. */
+export const readStaffPermissions = async (
+  c: Context,
+  args: { type: PermissionStaffType; userId: number },
+): Promise<null | StaffPermissionSet> =>
+  await c
+    .get("cache")
+    .getSystem<StaffPermissionSet>(permissionsKey(await readEpoch(c), args));
+
+/** Stores one resolution for {@link STAFF_PERMISSIONS_CACHE_TTL_SECONDS}. */
+export const writeStaffPermissions = async (
+  c: Context,
+  args: { type: PermissionStaffType; userId: number },
+  value: StaffPermissionSet,
+): Promise<void> => {
+  await c
+    .get("cache")
+    .setSystem(
+      permissionsKey(await readEpoch(c), args),
+      value,
+      STAFF_PERMISSIONS_CACHE_TTL_SECONDS,
+    );
+};
+
+/**
+ * Expires **every** cached permission set, for every user, at once.
+ *
+ * By moving the generation rather than deleting keys, because the mutations that
+ * need this are the role-shaped ones - a role gaining `root`, a role being
+ * deleted and its members reassigned - and those change the answer for every
+ * member of that role. Enumerating them would be a query plus one delete per
+ * user; moving the stamp is a single write, and the entries it orphans fall out
+ * on their own TTL.
+ *
+ * The new stamp is a random id rather than a timestamp. Two app instances with
+ * skewed clocks could otherwise write a *lower* stamp than the one already
+ * stored, pointing new reads back at a generation whose stale entries are still
+ * alive.
+ */
+export const invalidateAllStaffPermissions = async (
+  c: Context,
+): Promise<void> => {
+  await c.get("cache").setSystem(EPOCH_KEY, randomUUID());
+};
+
+/**
+ * Expires one user's cached permission sets - both kinds, since a role
+ * reassignment moves admin and moderator permissions together.
+ *
+ * Used where the mutation names a single user, so the rest of the staff keep
+ * their warm entries.
+ */
+export const invalidateStaffPermissionsForUser = async (
+  c: Context,
+  userId: number,
+): Promise<void> => {
+  const epoch = await readEpoch(c);
+
+  await c
+    .get("cache")
+    .deleteSystem(
+      STAFF_TYPES.map(type => permissionsKey(epoch, { type, userId })),
+    );
+};
+
+/**
+ * Expires whatever one staff entry governs.
+ *
+ * A staff entry hangs off *either* a user or a role, and the two are worth
+ * different amounts of cache: a user entry affects exactly that person, while a
+ * role entry affects everyone who holds the role - a set this route has no cheap
+ * way to enumerate. So one gets a targeted delete and the other moves the
+ * generation.
+ */
+export const invalidateStaffEntry = async (
+  c: Context,
+  entry: { roleId?: null | number; userId?: null | number },
+): Promise<void> => {
+  if (entry.userId != null) {
+    await invalidateStaffPermissionsForUser(c, entry.userId);
+
+    return;
+  }
+
+  await invalidateAllStaffPermissions(c);
+};
diff --git a/packages/vitnode/src/api/modules/admin/roles/routes/delete.route.ts b/packages/vitnode/src/api/modules/admin/roles/routes/delete.route.ts
index e2e57104a..3f2b50486 100644
--- a/packages/vitnode/src/api/modules/admin/roles/routes/delete.route.ts
+++ b/packages/vitnode/src/api/modules/admin/roles/routes/delete.route.ts
@@ -2,6 +2,7 @@ import { z } from "@hono/zod-openapi";
 import { and, count, eq, inArray } from "drizzle-orm";
 
 import { buildRoute } from "@/api/lib/route";
+import { invalidateAllStaffPermissions } from "@/api/lib/staff-permission-cache";
 import { assertCanAssignPrimaryRole } from "@/api/modules/admin/users/lib/assert-edit-user-permission";
 import { CONFIG_PLUGIN } from "@/config";
 import { core_languages_words } from "@/database/languages";
@@ -171,6 +172,10 @@ export const deleteRoleAdminRoute = buildRoute({
       await tx.delete(core_roles).where(eq(core_roles.id, roleId));
     });
 
+    // Every member of the deleted role was just reassigned, and the staff
+    // entries that pointed at it are gone with it.
+    await invalidateAllStaffPermissions(c);
+
     await c.get("events").emit("role.deleted", { roleId });
 
     return c.body(null, 200);
diff --git a/packages/vitnode/src/api/modules/admin/roles/routes/update.route.ts b/packages/vitnode/src/api/modules/admin/roles/routes/update.route.ts
index 23955074b..ec31b88d1 100644
--- a/packages/vitnode/src/api/modules/admin/roles/routes/update.route.ts
+++ b/packages/vitnode/src/api/modules/admin/roles/routes/update.route.ts
@@ -3,6 +3,7 @@ import { eq } from "drizzle-orm";
 
 import { buildRoute } from "@/api/lib/route";
 import { saveLanguageWords } from "@/api/lib/save-language-words";
+import { invalidateAllStaffPermissions } from "@/api/lib/staff-permission-cache";
 import { CONFIG_PLUGIN } from "@/config";
 import { core_roles } from "@/database/roles";
 
@@ -116,6 +117,10 @@ export const updateRoleAdminRoute = buildRoute({
       });
     }
 
+    // `root` is part of every permission resolution, so an edit here can change
+    // the answer for every member of this role at once.
+    await invalidateAllStaffPermissions(c);
+
     await c.get("events").emit("role.updated", { roleId });
 
     return c.json({ id: roleId }, 200);
diff --git a/packages/vitnode/src/api/modules/admin/staff/routes/create.route.ts b/packages/vitnode/src/api/modules/admin/staff/routes/create.route.ts
index 8e6167782..9b11b8cdc 100644
--- a/packages/vitnode/src/api/modules/admin/staff/routes/create.route.ts
+++ b/packages/vitnode/src/api/modules/admin/staff/routes/create.route.ts
@@ -3,6 +3,7 @@ import { eq, or } from "drizzle-orm";
 
 import { assertStaffPermission } from "@/api/lib/check-staff-permission";
 import { buildRoute } from "@/api/lib/route";
+import { invalidateStaffEntry } from "@/api/lib/staff-permission-cache";
 import { CONFIG_PLUGIN } from "@/config";
 import { core_admin_permissions } from "@/database/admins";
 import { core_moderators_permissions } from "@/database/moderators";
@@ -101,6 +102,8 @@ export const createStaffAdminRoute = buildRoute({
       })
       .returning({ id: table.id });
 
+    await invalidateStaffEntry(c, { roleId, userId });
+
     return c.json({ id: created.id }, 201);
   },
 });
diff --git a/packages/vitnode/src/api/modules/admin/staff/routes/delete.route.ts b/packages/vitnode/src/api/modules/admin/staff/routes/delete.route.ts
index 0d8329157..26bfdc5d9 100644
--- a/packages/vitnode/src/api/modules/admin/staff/routes/delete.route.ts
+++ b/packages/vitnode/src/api/modules/admin/staff/routes/delete.route.ts
@@ -7,6 +7,7 @@ import {
   getUserRoleIds,
 } from "@/api/lib/check-staff-permission";
 import { buildRoute } from "@/api/lib/route";
+import { invalidateStaffEntry } from "@/api/lib/staff-permission-cache";
 import { CONFIG_PLUGIN } from "@/config";
 import { core_admin_permissions } from "@/database/admins";
 import { core_moderators_permissions } from "@/database/moderators";
@@ -99,6 +100,8 @@ export const deleteStaffAdminRoute = buildRoute({
 
     await c.get("db").delete(table).where(eq(table.id, entryId));
 
+    await invalidateStaffEntry(c, entry);
+
     return c.body(null, 200);
   },
 });
diff --git a/packages/vitnode/src/api/modules/admin/staff/routes/update-permissions.route.ts b/packages/vitnode/src/api/modules/admin/staff/routes/update-permissions.route.ts
index 3d552c9f8..6afeb5e9a 100644
--- a/packages/vitnode/src/api/modules/admin/staff/routes/update-permissions.route.ts
+++ b/packages/vitnode/src/api/modules/admin/staff/routes/update-permissions.route.ts
@@ -10,6 +10,7 @@ import {
 } from "@/api/lib/check-staff-permission";
 import { buildRoute } from "@/api/lib/route";
 import { staffPermissionKey } from "@/api/lib/staff-permission";
+import { invalidateStaffEntry } from "@/api/lib/staff-permission-cache";
 import { CONFIG_PLUGIN } from "@/config";
 import { core_admin_permissions } from "@/database/admins";
 import { core_moderators_permissions } from "@/database/moderators";
@@ -194,6 +195,8 @@ export const updatePermissionsStaffAdminRoute = buildRoute({
       return c.json({ error: "Staff entry not found" }, 404);
     }
 
+    await invalidateStaffEntry(c, entry);
+
     return c.json({ unrestricted, permissions: sanitized }, 200);
   },
 });
diff --git a/packages/vitnode/src/api/modules/admin/users/routes/update.route.ts b/packages/vitnode/src/api/modules/admin/users/routes/update.route.ts
index df6ddc8a3..d7ffc633e 100644
--- a/packages/vitnode/src/api/modules/admin/users/routes/update.route.ts
+++ b/packages/vitnode/src/api/modules/admin/users/routes/update.route.ts
@@ -2,6 +2,7 @@ import { z } from "@hono/zod-openapi";
 import { and, eq, inArray, ne } from "drizzle-orm";
 
 import { buildRoute } from "@/api/lib/route";
+import { invalidateStaffPermissionsForUser } from "@/api/lib/staff-permission-cache";
 import { CONFIG_PLUGIN } from "@/config";
 import { core_roles } from "@/database/roles";
 import { core_users, core_users_secondary_roles } from "@/database/users";
@@ -226,6 +227,12 @@ export const updateUserAdminRoute = buildRoute({
       }
     }
 
+    // A role change moves which staff entries apply to this user, so their
+    // cached permission set has to go. Only this user's - the roles themselves
+    // are untouched, so everyone else's stays warm.
+    const rolesChanged =
+      body.roleId !== undefined || secondaryRoleIds !== undefined;
+
     if (Object.keys(values).length > 0) {
       const [updated] = await db
         .update(core_users)
@@ -238,6 +245,10 @@ export const updateUserAdminRoute = buildRoute({
           nameCode: core_users.nameCode,
         });
 
+      if (rolesChanged) {
+        await invalidateStaffPermissionsForUser(c, user.id);
+      }
+
       await c.get("events").emit("user.updated", {
         userId: updated.id,
         email: updated.email,
@@ -259,6 +270,10 @@ export const updateUserAdminRoute = buildRoute({
       .where(eq(core_users.id, user.id))
       .limit(1);
 
+    if (rolesChanged) {
+      await invalidateStaffPermissionsForUser(c, user.id);
+    }
+
     await c.get("events").emit("user.updated", {
       userId: current.id,
       email: current.email,
diff --git a/packages/vitnode/src/lib/api/get-moderator-permissions-api.ts b/packages/vitnode/src/lib/api/get-moderator-permissions-api.ts
index ca84a06e2..7a8060cc1 100644
--- a/packages/vitnode/src/lib/api/get-moderator-permissions-api.ts
+++ b/packages/vitnode/src/lib/api/get-moderator-permissions-api.ts
@@ -1,3 +1,5 @@
+import { cache } from "react";
+
 import type {
   PermissionsStaffArgs,
   StaffPermissionSet,
@@ -7,7 +9,16 @@ import { hasStaffPermission } from "@/api/lib/staff-permission";
 import { usersModule } from "@/api/modules/users/users.module";
 import { fetcher } from "@/lib/fetcher";
 
-export const getModeratorPermissionsApi =
+/**
+ * The visitor's effective moderator permissions on the public site.
+ *
+ * Memoised per render pass for the same reason
+ * [the admin session](./get-session-admin-api.ts) is: a page gates several
+ * elements on several different permissions, and every
+ * {@link checkModeratorPermissionApi} call resolves the whole set. One render
+ * pass makes one request whatever it asks about.
+ */
+export const getModeratorPermissionsApi = cache(
   async (): Promise<StaffPermissionSet> => {
     const res = await fetcher(usersModule, {
       path: "/permissions",
@@ -20,7 +31,8 @@ export const getModeratorPermissionsApi =
     }
 
     return await res.json();
-  };
+  },
+);
 
 export const checkModeratorPermissionApi = async (
   args: PermissionsStaffArgs,
diff --git a/packages/vitnode/src/lib/api/get-session-admin-api.ts b/packages/vitnode/src/lib/api/get-session-admin-api.ts
index 14f2c0a08..6d19d8897 100644
--- a/packages/vitnode/src/lib/api/get-session-admin-api.ts
+++ b/packages/vitnode/src/lib/api/get-session-admin-api.ts
@@ -1,3 +1,5 @@
+import { cache } from "react";
+
 import type { PermissionsStaffArgs } from "@/api/lib/permission-staff";
 
 import { hasStaffPermission } from "@/api/lib/staff-permission";
@@ -7,14 +9,27 @@ import { fetcher } from "@/lib/fetcher";
 
 import { redirect } from "../navigation";
 
-export const getSessionAdminApi = async () => {
+/**
+ * The signed-in admin and their effective permission set.
+ *
+ * Memoised with React's `cache()` for the duration of one render pass. This is
+ * the single hottest read in the AdminCP: {@link checkAdminPermissionApi} is
+ * called from roughly a hundred places - every view that gates a button, and
+ * `getSearchNavItems` once per navigation entry - and each call used to be its
+ * own HTTP request for the same answer. One render pass now makes one.
+ *
+ * Deliberately *not* a Next cache. A permission set is per-admin and is
+ * revoked, not expired: the API re-checks admin status against the database on
+ * every request precisely so that removing someone takes effect immediately,
+ * and a stored entry keyed by their session cookie would undo that. The
+ * database work behind it is cached instead - short-lived, in Redis, and
+ * dropped the moment a role or a staff entry changes.
+ */
+export const getSessionAdminApi = cache(async () => {
   const res = await fetcher(adminModule, {
     path: "/session",
     method: "get",
     module: "admin",
-    options: {
-      cache: "force-cache",
-    },
   });
 
   if (res.status !== 200) {
@@ -26,7 +41,7 @@ export const getSessionAdminApi = async () => {
   const data = await res.json();
 
   return data;
-};
+});
 
 export const checkAdminPermissionApi = async ({
   plugin = CONFIG_PLUGIN.pluginId,
diff --git a/packages/vitnode/src/lib/api/get-session-api.ts b/packages/vitnode/src/lib/api/get-session-api.ts
index ef1064b3c..1ec7ec25b 100644
--- a/packages/vitnode/src/lib/api/get-session-api.ts
+++ b/packages/vitnode/src/lib/api/get-session-api.ts
@@ -1,14 +1,29 @@
+import { cache } from "react";
+
 import { usersModule } from "@/api/modules/users/users.module";
 import { fetcher } from "@/lib/fetcher";
 
-export const getSessionApi = async () => {
+/**
+ * The signed-in visitor, or `{ user: null }`.
+ *
+ * Wrapped in React's `cache()`, which memoises per **render pass** - not across
+ * requests. The layout, the header, the user menu and the page itself all ask
+ * for the session while rendering one page, and without this each one is its
+ * own HTTP round-trip to the API for a byte-identical answer.
+ *
+ * Deliberately *not* a Next cache. The response is per-visitor and changes the
+ * moment they edit their profile or verify their email, so there is no shared
+ * entry to hand out and no safe lifetime to give one: `cache: "force-cache"`
+ * here would store the answer under the session cookie and keep serving it long
+ * after the user changed. The database round-trip behind it is already cached -
+ * see the [Redis session cache](/docs/dev/advanced/redis#session-caching), which
+ * is short-lived and cleared on sign-out.
+ */
+export const getSessionApi = cache(async () => {
   const res = await fetcher(usersModule, {
     path: "/session",
     method: "get",
     module: "users",
-    options: {
-      cache: "force-cache",
-    },
   });
 
   // A non-200 response (e.g. 429 rate limiting) carries a non-session body, so
@@ -20,6 +35,6 @@ export const getSessionApi = async () => {
   const data = await res.json();
 
   return data;
-};
+});
 
 export type SessionApi = Awaited<ReturnType<typeof getSessionApi>>;
diff --git a/packages/vitnode/src/lib/cache-tags.ts b/packages/vitnode/src/lib/cache-tags.ts
new file mode 100644
index 000000000..e10fccaa5
--- /dev/null
+++ b/packages/vitnode/src/lib/cache-tags.ts
@@ -0,0 +1,23 @@
+/**
+ * Cache tags for core's own Next.js cache entries.
+ *
+ * Pure strings and no `next/*` import, for the same reason the Content Engine's
+ * [tag builders](../content/cache.ts) are: a Server Action has to name a tag to
+ * expire it, an app has to name the same tag to have its own `"use cache"`
+ * functions expire alongside core's, and neither should have to reach into a
+ * server-only module to spell one.
+ *
+ * Content has its own family of tags (`content:*`) built per content type. These
+ * are the handful core owns outright.
+ */
+
+/**
+ * The public search feed - what `/search` and `/discover` render before anyone
+ * types a term.
+ *
+ * One tag rather than one per locale: the feed is rebuilt wholesale by
+ * `rebuildSearchIndex`, which re-indexes every language at once, so a per-locale
+ * tag would buy nothing and only add strings to expire. Term searches are not
+ * cached at all and so are not tagged - see `views/search/fetch-feed.ts`.
+ */
+export const SEARCH_FEED_TAG = "core:search:feed";
diff --git a/packages/vitnode/src/lib/cache/client.ts b/packages/vitnode/src/lib/cache/client.ts
new file mode 100644
index 000000000..ada61e389
--- /dev/null
+++ b/packages/vitnode/src/lib/cache/client.ts
@@ -0,0 +1,169 @@
+import type { RedisClientType } from "redis";
+
+import { createClient } from "redis";
+
+/**
+ * Root prefix for everything the Next.js cache handlers write.
+ *
+ * Deliberately *not* `vitnode:cache:` - that namespace belongs to the API's
+ * `c.get("cache")` and is flushed per plugin. These keys are written by the web
+ * process, hold rendered output rather than domain values, and are thrown away
+ * on a different schedule, so they get a namespace of their own that neither
+ * side can clear by accident.
+ */
+export const NEXT_CACHE_PREFIX = "vitnode:next:";
+
+/**
+ * The client lives on `globalThis` because Next loads a cache handler through a
+ * dynamic import that may be evaluated more than once - once per handler kind,
+ * and again across the copies of a module that server bundles can produce. Each
+ * evaluation must reach the same connection rather than opening its own.
+ */
+const CLIENT = Symbol.for("@vitnode/next-cache-client");
+
+interface ClientRegistry {
+  [CLIENT]?: null | RedisClientType;
+}
+
+/**
+ * Whether Redis is configured for the web process.
+ *
+ * `REDIS_URL` is the switch, matching how `vitnode.api.config.ts` gates Redis on
+ * the API side. A cache handler is given to Next as a **module path**, so there
+ * is no way to hand it a configuration object from `next.config.ts` - the
+ * environment is the only channel it has, which is why the connection is read
+ * from here rather than passed in.
+ */
+export const isCacheRedisConfigured = (): boolean =>
+  Boolean(process.env.REDIS_URL);
+
+/**
+ * The shared connection, or `null` when Redis is not configured.
+ *
+ * Mirrors the API's client: commands fail fast instead of queueing, errors are
+ * swallowed at the socket, and the connection is opened in the background so a
+ * cold start never blocks on Redis being up.
+ */
+export const getCacheRedis = (): null | RedisClientType => {
+  const registry = globalThis as ClientRegistry;
+
+  if (registry[CLIENT] !== undefined) return registry[CLIENT];
+
+  const url = process.env.REDIS_URL;
+  if (!url) {
+    registry[CLIENT] = null;
+
+    return null;
+  }
+
+  const client = createClient({
+    url,
+    ...(process.env.REDIS_PASSWORD
+      ? { password: process.env.REDIS_PASSWORD }
+      : {}),
+    // Fail fast rather than queue, so a cache read misses and the request
+    // regenerates instead of hanging on an unreachable Redis.
+    disableOfflineQueue: true,
+  }) as RedisClientType;
+
+  // Without a listener an "error" event is rethrown as an unhandled exception
+  // and takes the web process down. Every command already handles its own
+  // failure.
+  client.on("error", () => {
+    /* handled per command */
+  });
+
+  void client
+    .connect()
+    .then(() => {
+      idle(client);
+    })
+    .catch(() => {
+      /* node-redis keeps retrying; commands fail fast until it is up */
+    });
+
+  registry[CLIENT] = client;
+
+  return client;
+};
+
+/**
+ * How many commands are waiting on Redis right now.
+ *
+ * An open socket is a referenced handle, which keeps the Node event loop alive.
+ * That is wrong for a cache client in a process that is trying to finish -
+ * `next build` loads these handlers too - and it is equally wrong to unreference
+ * it permanently, because then a process with nothing else to do exits *while a
+ * command is still in flight* and the write is silently lost.
+ *
+ * So the socket is referenced exactly while it has work: an idle client never
+ * holds a process open, and a busy one always finishes what it started.
+ */
+let inFlight = 0;
+
+const busy = (client: RedisClientType): void => {
+  inFlight += 1;
+  if (inFlight === 1) {
+    try {
+      client.ref();
+    } catch {
+      /* not connected yet; the connect handler settles the reference */
+    }
+  }
+};
+
+const idle = (client: RedisClientType): void => {
+  if (inFlight > 0) return;
+
+  try {
+    client.unref();
+  } catch {
+    /* nothing to unreference */
+  }
+};
+
+const settle = (client: RedisClientType): void => {
+  inFlight -= 1;
+  idle(client);
+};
+
+/**
+ * Runs a Redis command, returning `fallback` if Redis is absent or the command
+ * fails.
+ *
+ * Every read in both handlers goes through this. A cache that throws is worse
+ * than no cache at all: a miss costs a render, an exception costs the response.
+ */
+export const cacheRedisRead = async <T>(
+  run: (client: RedisClientType) => Promise<T>,
+  fallback: T,
+): Promise<T> => {
+  const client = getCacheRedis();
+  if (!client) return fallback;
+
+  busy(client);
+  try {
+    return await run(client);
+  } catch {
+    return fallback;
+  } finally {
+    settle(client);
+  }
+};
+
+/** The write half of {@link cacheRedisRead}. Failures are dropped. */
+export const cacheRedisWrite = async (
+  run: (client: RedisClientType) => Promise<unknown>,
+): Promise<void> => {
+  const client = getCacheRedis();
+  if (!client) return;
+
+  busy(client);
+  try {
+    await run(client);
+  } catch {
+    /* a dropped write is a future miss, which is survivable */
+  } finally {
+    settle(client);
+  }
+};
diff --git a/packages/vitnode/src/lib/cache/handlers.test-d.ts b/packages/vitnode/src/lib/cache/handlers.test-d.ts
new file mode 100644
index 000000000..4e695878c
--- /dev/null
+++ b/packages/vitnode/src/lib/cache/handlers.test-d.ts
@@ -0,0 +1,34 @@
+import type {
+  CacheEntry,
+  CacheHandler,
+} from "next/dist/server/lib/cache-handlers/types";
+
+import { assertType, describe, it } from "vitest";
+
+import type { UseCacheEntry, UseCacheHandler } from "./use-cache-handler";
+
+import useCacheHandler from "./use-cache-handler";
+
+/**
+ * The handlers declare their own copies of Next's cache-handler contracts, so a
+ * moved or renamed internal type cannot break `tsc -p tsconfig.build.json` for
+ * everyone. This is where that copy is checked against the real thing.
+ *
+ * A failure here is not a bug in the handler - it means Next changed the
+ * contract, and the handler needs reviewing against the new one before the next
+ * release. That is a deliberately louder signal than a runtime cache miss.
+ */
+describe("use cache handler", () => {
+  it("implements Next's CacheHandler contract", () => {
+    assertType<CacheHandler>(useCacheHandler);
+  });
+
+  it("keeps its local entry type in step with Next's", () => {
+    assertType<UseCacheEntry>({} as CacheEntry);
+    assertType<CacheEntry>({} as UseCacheEntry);
+  });
+
+  it("keeps its local handler type in step with Next's", () => {
+    assertType<UseCacheHandler>({} as CacheHandler);
+  });
+});
diff --git a/packages/vitnode/src/lib/cache/handlers.test.ts b/packages/vitnode/src/lib/cache/handlers.test.ts
new file mode 100644
index 000000000..859491c72
--- /dev/null
+++ b/packages/vitnode/src/lib/cache/handlers.test.ts
@@ -0,0 +1,383 @@
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+/**
+ * A Redis stand-in covering the handful of commands the handlers use.
+ *
+ * Injected by mocking `./client`, so the tests drive the real handler logic -
+ * key layout, serialisation, tag comparisons - and only the socket is fake.
+ * `fail: true` reproduces an unreachable Redis, which must degrade to a miss
+ * rather than an exception.
+ */
+const store = new Map<string, string>();
+let fail = false;
+
+vi.mock("./client", () => ({
+  NEXT_CACHE_PREFIX: "vitnode:next:",
+  cacheRedisRead: async <T>(
+    run: (client: unknown) => Promise<T>,
+    fallback: T,
+  ): Promise<T> => {
+    if (fail) return fallback;
+
+    try {
+      return await run(client);
+    } catch {
+      return fallback;
+    }
+  },
+  cacheRedisWrite: async (run: (client: unknown) => Promise<unknown>) => {
+    if (fail) return;
+    await run(client);
+  },
+  getCacheRedis: () => (fail ? null : client),
+  isCacheRedisConfigured: () => !fail,
+}));
+
+const client = {
+  del: async (key: string) => {
+    store.delete(key);
+
+    return Promise.resolve(1);
+  },
+  get: async (key: string) => Promise.resolve(store.get(key) ?? null),
+  mGet: async (keys: string[]) =>
+    Promise.resolve(keys.map(key => store.get(key) ?? null)),
+  set: async (key: string, value: string) => {
+    store.set(key, value);
+
+    return Promise.resolve("OK");
+  },
+};
+
+const fileSystemCache = {
+  entries: new Map<string, unknown>(),
+  revalidated: [] as string[],
+  sets: [] as { data: unknown; key: string }[],
+};
+
+vi.mock("next/dist/server/lib/incremental-cache/file-system-cache.js", () => ({
+  default: class {
+    async get(key: string) {
+      return Promise.resolve(fileSystemCache.entries.get(key) ?? null);
+    }
+    async revalidateTag(tags: string | string[]) {
+      fileSystemCache.revalidated.push(
+        ...(typeof tags === "string" ? [tags] : tags),
+      );
+
+      return Promise.resolve();
+    }
+    async set(key: string, data: unknown) {
+      fileSystemCache.sets.push({ data, key });
+
+      return Promise.resolve();
+    }
+  },
+}));
+
+const { default: useCacheHandler } = await import("./use-cache-handler");
+const { default: IncrementalCacheHandler } =
+  await import("./incremental-cache-handler");
+const { readTagStates, writeTagStates } = await import("./tags");
+
+/** A `"use cache"` entry with a one-chunk payload. */
+const entry = ({
+  expire = 3600,
+  payload = "hello",
+  revalidate = 60,
+  tags = [] as string[],
+  timestamp = Date.now(),
+} = {}) => ({
+  expire,
+  revalidate,
+  stale: 30,
+  tags,
+  timestamp,
+  value: new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(payload));
+      controller.close();
+    },
+  }),
+});
+
+const readBack = async (
+  value: ReadableStream<Uint8Array> | undefined,
+): Promise<string> => {
+  if (!value) return "";
+  const chunks: Uint8Array[] = [];
+  const reader = value.getReader();
+
+  for (;;) {
+    const next = await reader.read();
+    if (next.done) break;
+    if (next.value) chunks.push(next.value);
+  }
+
+  return Buffer.concat(chunks).toString("utf8");
+};
+
+beforeEach(() => {
+  store.clear();
+  fail = false;
+  fileSystemCache.entries.clear();
+  fileSystemCache.revalidated.length = 0;
+  fileSystemCache.sets.length = 0;
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("use cache handler", () => {
+  it("round-trips an entry through Redis", async () => {
+    await useCacheHandler.set("key", Promise.resolve(entry()));
+
+    const found = await useCacheHandler.get("key", []);
+
+    expect(found).toBeDefined();
+    expect(found?.revalidate).toBe(60);
+    expect(await readBack(found?.value)).toBe("hello");
+  });
+
+  it("misses for a key that was never written", async () => {
+    expect(await useCacheHandler.get("absent", [])).toBeUndefined();
+  });
+
+  it("serves the payload to more than one reader", async () => {
+    await useCacheHandler.set("key", Promise.resolve(entry()));
+
+    expect(await readBack((await useCacheHandler.get("key", []))?.value)).toBe(
+      "hello",
+    );
+    // A stream can only be consumed once, so a second read has to get its own.
+    expect(await readBack((await useCacheHandler.get("key", []))?.value)).toBe(
+      "hello",
+    );
+  });
+
+  it("does not store a dynamic entry", async () => {
+    await useCacheHandler.set("key", Promise.resolve(entry({ expire: 0 })));
+
+    expect(await useCacheHandler.get("key", [])).toBeUndefined();
+    expect(store.size).toBe(0);
+  });
+
+  it("drops an entry whose tag was revalidated after it was written", async () => {
+    await useCacheHandler.set(
+      "key",
+      Promise.resolve(entry({ tags: ["posts"], timestamp: Date.now() - 5000 })),
+    );
+
+    await useCacheHandler.updateTags(["posts"]);
+
+    expect(await useCacheHandler.get("key", [])).toBeUndefined();
+  });
+
+  it("keeps an entry written after the revalidation", async () => {
+    await useCacheHandler.updateTags(["posts"]);
+
+    await useCacheHandler.set(
+      "key",
+      Promise.resolve(entry({ tags: ["posts"], timestamp: Date.now() + 5000 })),
+    );
+
+    expect(await useCacheHandler.get("key", [])).toBeDefined();
+  });
+
+  it("leaves an unrelated tag alone", async () => {
+    await useCacheHandler.set(
+      "key",
+      Promise.resolve(entry({ tags: ["posts"], timestamp: Date.now() - 5000 })),
+    );
+
+    await useCacheHandler.updateTags(["comments"]);
+
+    expect(await useCacheHandler.get("key", [])).toBeDefined();
+  });
+
+  it("serves a stale-tagged entry but asks for revalidation", async () => {
+    await useCacheHandler.set(
+      "key",
+      Promise.resolve(entry({ tags: ["posts"], timestamp: Date.now() - 5000 })),
+    );
+
+    // `expire` in the future is Next's stale-while-revalidate form: stale now,
+    // hard-expired later.
+    await useCacheHandler.updateTags(["posts"], { expire: 3600 });
+
+    const found = await useCacheHandler.get("key", []);
+
+    expect(found).toBeDefined();
+    expect(found?.revalidate).toBe(-1);
+  });
+
+  it("reports the latest expiration across tags", async () => {
+    await useCacheHandler.updateTags(["posts"]);
+
+    expect(await useCacheHandler.getExpiration(["posts"])).toBeGreaterThan(0);
+    expect(await useCacheHandler.getExpiration(["untouched"])).toBe(0);
+  });
+
+  it("misses instead of throwing when Redis is unreachable", async () => {
+    await useCacheHandler.set("key", Promise.resolve(entry()));
+    fail = true;
+
+    await expect(useCacheHandler.get("key", [])).resolves.toBeUndefined();
+    await expect(
+      useCacheHandler.set("other", Promise.resolve(entry())),
+    ).resolves.toBeUndefined();
+    await expect(
+      useCacheHandler.updateTags(["posts"]),
+    ).resolves.toBeUndefined();
+  });
+
+  it("survives a corrupt entry", async () => {
+    store.set("vitnode:next:uc:key", "{not json");
+
+    expect(await useCacheHandler.get("key", [])).toBeUndefined();
+  });
+});
+
+describe("incremental cache handler", () => {
+  const handler = () => new IncrementalCacheHandler({ revalidatedTags: [] });
+
+  it("stores and reads a fetch entry in Redis", async () => {
+    const cache = handler();
+    const value = { kind: "FETCH", data: { body: "x" }, revalidate: 60 };
+
+    await cache.set("fetch-key", value, { kind: "FETCH" });
+    const found = await cache.get("fetch-key", { kind: "FETCH" });
+
+    expect(found?.value).toMatchObject(value);
+    expect(fileSystemCache.sets).toHaveLength(0);
+  });
+
+  it("drops a fetch entry whose tag was revalidated elsewhere", async () => {
+    const cache = handler();
+
+    // The clock is driven explicitly because the comparison is strict - an entry
+    // stamped in the same millisecond as the revalidation survives it, which is
+    // Next's own rule and not something to paper over with a sleep.
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    await cache.set(
+      "fetch-key",
+      { kind: "FETCH", data: {}, tags: ["posts"], revalidate: 60 },
+      { kind: "FETCH" },
+    );
+
+    // Simulates another instance expiring the tag after this entry was written.
+    vi.setSystemTime(new Date("2026-01-01T00:00:05.000Z"));
+    await writeTagStates(["posts"]);
+
+    expect(await cache.get("fetch-key", { kind: "FETCH" })).toBeNull();
+  });
+
+  it("honours a revalidation matched by the request's soft tags", async () => {
+    const cache = handler();
+
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    await cache.set(
+      "fetch-key",
+      { kind: "FETCH", data: {}, revalidate: 60 },
+      { kind: "FETCH" },
+    );
+
+    vi.setSystemTime(new Date("2026-01-01T00:00:05.000Z"));
+    await writeTagStates(["_N_T_/layout"]);
+
+    expect(
+      await cache.get("fetch-key", {
+        kind: "FETCH",
+        softTags: ["_N_T_/layout"],
+      }),
+    ).toBeNull();
+  });
+
+  it("deletes a fetch entry when set with no data", async () => {
+    const cache = handler();
+
+    await cache.set(
+      "fetch-key",
+      { kind: "FETCH", data: {}, revalidate: 60 },
+      { kind: "FETCH" },
+    );
+    await cache.set("fetch-key", null, { kind: "FETCH" });
+
+    expect(await cache.get("fetch-key", { kind: "FETCH" })).toBeNull();
+  });
+
+  it("delegates page entries to the filesystem handler", async () => {
+    const cache = handler();
+    const page = {
+      lastModified: Date.now(),
+      value: { kind: "APP_PAGE", html: "<p>hi</p>", headers: {} },
+    };
+    fileSystemCache.entries.set("/blog", page);
+
+    expect(await cache.get("/blog", { kind: "APP_PAGE" })).toBe(page);
+
+    await cache.set("/blog", page.value, { kind: "APP_PAGE" });
+    expect(fileSystemCache.sets).toHaveLength(1);
+    expect(store.size).toBe(0);
+  });
+
+  it("discards a delegated page whose tag another instance expired", async () => {
+    const cache = handler();
+    fileSystemCache.entries.set("/blog", {
+      lastModified: Date.now() - 5000,
+      value: {
+        kind: "APP_PAGE",
+        html: "<p>hi</p>",
+        headers: { "x-next-cache-tags": "content:blog:list,other" },
+      },
+    });
+
+    await writeTagStates(["content:blog:list"]);
+
+    expect(await cache.get("/blog", { kind: "APP_PAGE" })).toBeNull();
+  });
+
+  it("keeps a delegated page whose tags are untouched", async () => {
+    const cache = handler();
+    const page = {
+      lastModified: Date.now() - 5000,
+      value: {
+        kind: "APP_PAGE",
+        html: "<p>hi</p>",
+        headers: { "x-next-cache-tags": "content:blog:list" },
+      },
+    };
+    fileSystemCache.entries.set("/blog", page);
+
+    await writeTagStates(["something-else"]);
+
+    expect(await cache.get("/blog", { kind: "APP_PAGE" })).toBe(page);
+  });
+
+  it("records a revalidation both for the cluster and for this process", async () => {
+    const cache = handler();
+
+    await cache.revalidateTag("posts");
+
+    expect(fileSystemCache.revalidated).toEqual(["posts"]);
+    expect(
+      (await readTagStates(["posts"])).get("posts")?.expired,
+    ).toBeGreaterThan(0);
+  });
+
+  it("treats tags revalidated during this request as expired", async () => {
+    const cache = new IncrementalCacheHandler({ revalidatedTags: ["posts"] });
+
+    await cache.set(
+      "fetch-key",
+      { kind: "FETCH", data: {}, tags: ["posts"], revalidate: 60 },
+      { kind: "FETCH" },
+    );
+
+    expect(await cache.get("fetch-key", { kind: "FETCH" })).toBeNull();
+  });
+});
diff --git a/packages/vitnode/src/lib/cache/incremental-cache-handler.ts b/packages/vitnode/src/lib/cache/incremental-cache-handler.ts
new file mode 100644
index 000000000..dc24c1579
--- /dev/null
+++ b/packages/vitnode/src/lib/cache/incremental-cache-handler.ts
@@ -0,0 +1,273 @@
+import { cacheRedisRead, cacheRedisWrite, NEXT_CACHE_PREFIX } from "./client";
+import { areTagsExpired, readTagStates, writeTagStates } from "./tags";
+
+/** Next's header carrying a response's cache tags, as a comma-separated list. */
+const NEXT_CACHE_TAGS_HEADER = "x-next-cache-tags";
+
+/**
+ * How long a stored `fetch` response is kept in Redis.
+ *
+ * The Data Cache has no expiry of its own - Next stores `revalidate` alongside
+ * the entry and decides freshness on read - so without a ceiling here an entry
+ * for a URL nothing requests any more would sit in Redis forever. A week is long
+ * enough that it never truncates a live cache and short enough that abandoned
+ * keys go away.
+ */
+const FETCH_RETENTION_SECONDS = 60 * 60 * 24 * 7;
+
+const fetchKey = (cacheKey: string): string =>
+  `${NEXT_CACHE_PREFIX}fetch:${cacheKey}`;
+
+interface StoredFetchEntry {
+  lastModified: number;
+  value: Record<string, unknown> & { tags?: string[] };
+}
+
+/**
+ * The subset of Next's cache-handler context this needs, declared locally so a
+ * change to Next's internal types cannot break the package build. The
+ * conformance test asserts the real context is still assignable.
+ */
+export interface IncrementalCacheHandlerContext {
+  [key: string]: unknown;
+  revalidatedTags?: string[];
+}
+
+interface FetchGetContext {
+  kind: "FETCH";
+  softTags?: string[];
+  tags?: string[];
+}
+
+interface ResponseGetContext {
+  kind: "APP_PAGE" | "APP_ROUTE" | "IMAGE" | "PAGES";
+}
+
+type GetContext = FetchGetContext | ResponseGetContext;
+
+interface HandlerValue {
+  lastModified?: number;
+  value: null | (Record<string, unknown> & { tags?: string[] });
+}
+
+/**
+ * Next's own filesystem handler, which this one wraps rather than replaces.
+ *
+ * Typed loosely on purpose: it is reached through a deep path into Next's build
+ * output, so the less this file asserts about its shape, the less an internal
+ * refactor of Next can break.
+ */
+interface FileSystemCacheLike {
+  get: (key: string, ctx: unknown) => Promise<HandlerValue | null>;
+  resetRequestCache?: () => void;
+  revalidateTag: (
+    tags: readonly string[] | string,
+    durations?: { expire?: number },
+  ) => Promise<void>;
+  set: (key: string, data: unknown, ctx: unknown) => Promise<void>;
+}
+
+type FileSystemCacheConstructor = new (
+  ctx: IncrementalCacheHandlerContext,
+) => FileSystemCacheLike;
+
+/**
+ * The tags on a cached page response.
+ *
+ * Page entries carry their tags in a response header rather than a field, which
+ * is where Next itself reads them from when deciding whether a tag revalidation
+ * has outdated a prerendered route.
+ */
+const responseTags = (value: HandlerValue["value"]): string[] => {
+  const headers = (value as null | { headers?: Record<string, unknown> })
+    ?.headers;
+  const header = headers?.[NEXT_CACHE_TAGS_HEADER];
+
+  return typeof header === "string" && header.length > 0
+    ? header.split(",").filter(Boolean)
+    : [];
+};
+
+/**
+ * The Data Cache and prerender store, backed by Redis where that is safe.
+ *
+ * A custom handler here **fully replaces** Next's filesystem cache - there is no
+ * fallback path, `incrementalCache.get` calls the handler and nothing else. That
+ * single fact shapes the whole design, because the pages `next build` prerendered
+ * live on disk and nothing else will ever put them in Redis:
+ *
+ * - **`fetch` responses go to Redis.** They are written at runtime, they are
+ *   plain JSON, and they are what the Content Engine's tagged reads produce. This
+ *   is the half that genuinely benefits from being shared.
+ * - **Pages, routes and images stay with Next's own filesystem handler**, which
+ *   this class instantiates and delegates to. Their payloads are Next-internal
+ *   shapes - `Buffer`s, a `Map` of RSC segments, postponed PPR state - that would
+ *   have to be re-serialised here and re-checked on every Next upgrade, and the
+ *   build output is identical on every instance anyway, so there is nothing to
+ *   share.
+ *
+ * **Tag revalidation is shared for both.** That is the part that is otherwise
+ * broken across instances: `revalidateTag` on the instance that handled the
+ * Server Action does nothing for the other three, which keep serving the page
+ * they already have. Every revalidation is recorded in Redis and checked on read
+ * here, so a delegated filesystem entry is discarded when another instance
+ * expired its tag - each instance then rebuilds its own copy.
+ */
+class VitNodeIncrementalCache {
+  constructor(ctx: IncrementalCacheHandlerContext) {
+    this.ctx = ctx;
+    this.revalidatedTags = ctx.revalidatedTags ?? [];
+  }
+
+  private readonly ctx: IncrementalCacheHandlerContext;
+  private fileSystemCache: FileSystemCacheLike | null = null;
+  private readonly revalidatedTags: string[];
+
+  /**
+   * Loads Next's filesystem handler on first use.
+   *
+   * Imported by path at runtime, not at module scope: the import is only needed
+   * once a page-shaped entry is actually asked for, and keeping it out of the
+   * module's top level means a Next version that moved the file degrades to "no
+   * prerender cache" rather than failing to load the handler at boot.
+   */
+  private async fs(): Promise<FileSystemCacheLike | null> {
+    if (this.fileSystemCache) return this.fileSystemCache;
+
+    try {
+      const loaded: unknown =
+        await import("next/dist/server/lib/incremental-cache/file-system-cache.js");
+      const Ctor = ((loaded as { default?: unknown }).default ??
+        loaded) as FileSystemCacheConstructor;
+
+      this.fileSystemCache = new Ctor(this.ctx);
+
+      return this.fileSystemCache;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Whether a shared revalidation has outdated an entry this instance still has.
+   *
+   * The check Next performs against its in-process tags manifest, done against
+   * the shared one instead - which is what makes an invalidation raised on
+   * another instance visible here.
+   */
+  private async isOutdated(
+    tags: string[],
+    lastModified: number,
+  ): Promise<boolean> {
+    if (tags.length === 0) return false;
+    if (tags.some(tag => this.revalidatedTags.includes(tag))) return true;
+
+    return areTagsExpired(await readTagStates(tags), tags, lastModified);
+  }
+
+  async get(cacheKey: string, ctx: GetContext): Promise<HandlerValue | null> {
+    if (ctx.kind !== "FETCH") {
+      const fs = await this.fs();
+      const entry = (await fs?.get(cacheKey, ctx)) ?? null;
+      if (!entry?.value) return entry;
+
+      return (await this.isOutdated(
+        responseTags(entry.value),
+        entry.lastModified ?? 0,
+      ))
+        ? null
+        : entry;
+    }
+
+    const raw = await cacheRedisRead<null | string>(
+      async client => await client.get(fetchKey(cacheKey)),
+      null,
+    );
+    if (raw === null) return null;
+
+    let stored: StoredFetchEntry;
+    try {
+      stored = JSON.parse(raw) as StoredFetchEntry;
+    } catch {
+      return null;
+    }
+
+    // Both halves matter: `tags` are what the entry was stored with, `softTags`
+    // are the implicit route tags of the request reading it, and a revalidation
+    // of either has to drop the entry.
+    const tags = [
+      ...new Set([
+        ...(stored.value.tags ?? []),
+        ...(ctx.tags ?? []),
+        ...(ctx.softTags ?? []),
+      ]),
+    ];
+
+    return (await this.isOutdated(tags, stored.lastModified))
+      ? null
+      : { lastModified: stored.lastModified, value: stored.value };
+  }
+
+  /** Delegates to the filesystem handler, which has per-request state. */
+  resetRequestCache(): void {
+    this.fileSystemCache?.resetRequestCache?.();
+  }
+
+  /**
+   * Records a revalidation for every instance, then lets the filesystem handler
+   * record it for this one.
+   *
+   * Both, not either: Redis is what the other instances read, and Next's
+   * in-process manifest is what the filesystem handler consults on its own reads
+   * within this process.
+   */
+  async revalidateTag(
+    tags: readonly string[] | string,
+    durations?: { expire?: number },
+  ): Promise<void> {
+    const list = typeof tags === "string" ? [tags] : [...tags];
+    if (list.length === 0) return;
+
+    await writeTagStates(list, durations);
+
+    const fs = await this.fs();
+    await fs?.revalidateTag(list, durations);
+  }
+
+  async set(cacheKey: string, data: unknown, ctx: unknown): Promise<void> {
+    const kind = (ctx as undefined | { fetchCache?: boolean; kind?: string })
+      ?.kind;
+    const isFetch =
+      kind === "FETCH" ||
+      (data as null | { kind?: string })?.kind === "FETCH" ||
+      (ctx as undefined | { fetchCache?: boolean })?.fetchCache === true;
+
+    if (!isFetch) {
+      const fs = await this.fs();
+      await fs?.set(cacheKey, data, ctx);
+
+      return;
+    }
+
+    if (!data) {
+      await cacheRedisWrite(
+        async client => await client.del(fetchKey(cacheKey)),
+      );
+
+      return;
+    }
+
+    const stored: StoredFetchEntry = {
+      lastModified: Date.now(),
+      value: data as StoredFetchEntry["value"],
+    };
+
+    await cacheRedisWrite(async client => {
+      await client.set(fetchKey(cacheKey), JSON.stringify(stored), {
+        expiration: { type: "EX", value: FETCH_RETENTION_SECONDS },
+      });
+    });
+  }
+}
+
+export default VitNodeIncrementalCache;
diff --git a/packages/vitnode/src/lib/cache/tags.ts b/packages/vitnode/src/lib/cache/tags.ts
new file mode 100644
index 000000000..6a5cd3944
--- /dev/null
+++ b/packages/vitnode/src/lib/cache/tags.ts
@@ -0,0 +1,156 @@
+import { cacheRedisRead, cacheRedisWrite, NEXT_CACHE_PREFIX } from "./client";
+
+/**
+ * When a tag was last marked stale or expired, in milliseconds.
+ *
+ * The same two fields Next keeps in its in-process tags manifest, with the same
+ * meanings, because both handlers reproduce Next's own comparisons against them
+ * and any drift here would show up as a page that refuses to expire.
+ */
+export interface TagState {
+  /** Revalidated at this timestamp - entries older than it are gone. */
+  expired?: number;
+  /** Marked stale at this timestamp - entries older than it get revalidated. */
+  stale?: number;
+}
+
+/**
+ * How long a revalidation marker is kept.
+ *
+ * A marker has to outlive every cache entry that could still be carrying the
+ * tag, or that entry comes back from the dead. 30 days is the `revalidate` of
+ * Next's longest built-in profile (`max`), so an entry that outlives its marker
+ * has already been forced to refresh on age alone.
+ */
+const TAG_RETENTION_SECONDS = 60 * 60 * 24 * 30;
+
+/**
+ * One key per tag rather than one manifest hash.
+ *
+ * A single hash would grow for the lifetime of the deployment - every tag ever
+ * revalidated, kept forever because a hash field cannot carry its own TTL - and
+ * every read would have to fetch the whole thing. Separate keys expire on their
+ * own and let a lookup ask for exactly the tags on the entry in hand.
+ */
+const tagKey = (tag: string): string => `${NEXT_CACHE_PREFIX}tag:${tag}`;
+
+/** Reads the revalidation state of several tags in one round-trip. */
+export const readTagStates = async (
+  tags: readonly string[],
+): Promise<Map<string, TagState>> => {
+  const states = new Map<string, TagState>();
+  if (tags.length === 0) return states;
+
+  const raw = await cacheRedisRead<(null | string)[]>(
+    async client => await client.mGet(tags.map(tagKey)),
+    [],
+  );
+
+  tags.forEach((tag, index) => {
+    const value = raw[index];
+    if (value == null) return;
+
+    try {
+      states.set(tag, JSON.parse(value) as TagState);
+    } catch {
+      /* a corrupt marker is treated as "never revalidated" */
+    }
+  });
+
+  return states;
+};
+
+/**
+ * Records a revalidation, visible to every instance.
+ *
+ * `durations.expire` is Next's stale-while-revalidate form: the tag goes stale
+ * now and hard-expires later, so the old response may be served while a new one
+ * is built. Without it the tag expires immediately, which is what a delete or an
+ * unpublish needs.
+ */
+export const writeTagStates = async (
+  tags: readonly string[],
+  durations?: { expire?: number },
+): Promise<void> => {
+  if (tags.length === 0) return;
+
+  const now = Date.now();
+  const state: TagState = durations
+    ? {
+        stale: now,
+        ...(durations.expire === undefined
+          ? {}
+          : { expired: now + durations.expire * 1000 }),
+      }
+    : { expired: now };
+
+  // The marker has to outlive a future-dated expiry as well as any entry
+  // carrying the tag, so a long `expire` extends the retention rather than
+  // being silently truncated by it.
+  const ttl = Math.max(
+    TAG_RETENTION_SECONDS,
+    durations?.expire === undefined ? 0 : Math.ceil(durations.expire) + 60,
+  );
+
+  await cacheRedisWrite(async client => {
+    await Promise.all(
+      tags.map(
+        async tag =>
+          await client.set(tagKey(tag), JSON.stringify(state), {
+            expiration: { type: "EX", value: ttl },
+          }),
+      ),
+    );
+  });
+};
+
+/**
+ * Whether any tag was revalidated after the entry was written.
+ *
+ * A transcription of Next's `areTagsExpired`, including the part that looks odd
+ * on first reading: a marker dated in the future (`expire` was given) does not
+ * expire anything until that moment arrives, which is what lets the old response
+ * keep being served in the meantime.
+ */
+export const areTagsExpired = (
+  states: Map<string, TagState>,
+  tags: readonly string[],
+  timestamp: number,
+): boolean => {
+  const now = Date.now();
+
+  return tags.some(tag => {
+    const expiredAt = states.get(tag)?.expired;
+
+    return (
+      typeof expiredAt === "number" && expiredAt <= now && expiredAt > timestamp
+    );
+  });
+};
+
+/** Whether any tag was marked stale after the entry was written. */
+export const areTagsStale = (
+  states: Map<string, TagState>,
+  tags: readonly string[],
+  timestamp: number,
+): boolean =>
+  tags.some(tag => {
+    const staleAt = states.get(tag)?.stale ?? 0;
+
+    return staleAt > timestamp;
+  });
+
+/**
+ * The most recent revalidation across a set of tags, or `0` for none.
+ *
+ * What Next's `getExpiration` contract asks for: it compares the result with an
+ * entry's timestamp to decide whether a request's implicit tags have outdated it.
+ */
+export const latestTagExpiration = (
+  states: Map<string, TagState>,
+  tags: readonly string[],
+): number =>
+  tags.reduce(
+    (latest, tag) => Math.max(latest, states.get(tag)?.expired ?? 0),
+    0,
+  );
diff --git a/packages/vitnode/src/lib/cache/use-cache-handler.ts b/packages/vitnode/src/lib/cache/use-cache-handler.ts
new file mode 100644
index 000000000..5e6556d9c
--- /dev/null
+++ b/packages/vitnode/src/lib/cache/use-cache-handler.ts
@@ -0,0 +1,254 @@
+import { cacheRedisRead, cacheRedisWrite, NEXT_CACHE_PREFIX } from "./client";
+import {
+  areTagsExpired,
+  areTagsStale,
+  latestTagExpiration,
+  readTagStates,
+  writeTagStates,
+} from "./tags";
+
+/**
+ * Next's sentinel for "never expires" (`0xfffffffe` seconds, ~136 years).
+ *
+ * Declared here rather than imported from `next/dist/lib/constants` so a handler
+ * that Next loads by path does not reach back into Next's internals for a
+ * number.
+ */
+const INFINITE_CACHE = 0xfffffffe;
+
+const entryKey = (cacheKey: string): string =>
+  `${NEXT_CACHE_PREFIX}uc:${cacheKey}`;
+
+/**
+ * One `"use cache"` entry as it is stored.
+ *
+ * `value` is the rendered payload base64-encoded inside the JSON envelope. A
+ * separate binary key would avoid the ~33% encoding overhead, but it would also
+ * make an entry two keys that can expire independently - and half an entry is
+ * worse than none.
+ */
+interface StoredEntry {
+  expire: number;
+  revalidate: number;
+  stale: number;
+  tags: string[];
+  timestamp: number;
+  value: string;
+}
+
+/**
+ * The shape Next's `"use cache"` handler contract requires.
+ *
+ * Declared locally rather than imported from `next/dist/server/lib/cache-handlers/types`
+ * so that a moved internal path breaks a type test rather than the package build.
+ * `use-cache-handler.test-d.ts` asserts this stays assignable to the real one.
+ */
+export interface UseCacheEntry {
+  expire: number;
+  revalidate: number;
+  stale: number;
+  tags: string[];
+  timestamp: number;
+  value: ReadableStream<Uint8Array>;
+}
+
+export interface UseCacheHandler {
+  get: (
+    cacheKey: string,
+    softTags: string[],
+  ) => Promise<undefined | UseCacheEntry>;
+  getExpiration: (tags: string[]) => Promise<number>;
+  refreshTags: () => Promise<void>;
+  set: (
+    cacheKey: string,
+    pendingEntry: Promise<UseCacheEntry>,
+  ) => Promise<void>;
+  updateTags: (
+    tags: string[],
+    durations?: { expire?: number },
+  ) => Promise<void>;
+}
+
+/** Drains a stream into one buffer, so it can be handed to Redis. */
+const readStream = async (
+  stream: ReadableStream<Uint8Array>,
+): Promise<Buffer> => {
+  const reader = stream.getReader();
+  const chunks: Uint8Array[] = [];
+
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) chunks.push(value);
+  }
+
+  return Buffer.concat(chunks);
+};
+
+const toStream = (payload: Buffer): ReadableStream<Uint8Array> =>
+  new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new Uint8Array(payload));
+      controller.close();
+    },
+  });
+
+/**
+ * In-flight writes, so a `get` racing a `set` for the same key waits for it.
+ *
+ * Per process and intentionally so: it coordinates this instance's own reads
+ * with its own writes. Another instance racing the same key simply misses once.
+ */
+const pendingSets = new Map<string, Promise<void>>();
+
+/**
+ * A `"use cache"` handler backed by Redis.
+ *
+ * Two things it buys over the in-memory default, and both only matter once there
+ * is more than one process: entries survive a restart or a rolling deploy, and
+ * every instance sees the same entry - so `updateTag` from a Server Action on
+ * one instance is not invisible to the other three.
+ *
+ * ## What it deliberately does not do
+ *
+ * It does not drop an entry once it is past `revalidate`. Next's in-memory
+ * handler does, on the grounds that warming an entry an LRU is about to evict is
+ * wasted work; a shared store has the opposite incentive, so a stale entry is
+ * served while the wrapper rebuilds it in the background. Redis holds the entry
+ * for `expire`, which is the point past which Next would refuse to serve it
+ * anyway.
+ *
+ * It also keeps no in-process copy in front of Redis. One would save a
+ * round-trip on a hot key and immediately reintroduce the divergence between
+ * instances this handler exists to remove.
+ */
+const handler: UseCacheHandler = {
+  /**
+   * Reads an entry, and reports whether its tags have moved under it.
+   *
+   * The contract passes the request's implicit tags as a second argument. They
+   * are deliberately not taken: {@link getExpiration} answers for those, which is
+   * the division of labour the contract asks for. What is checked here is the
+   * entry's own tags, because those were written with it and nothing else will
+   * look at them.
+   */
+  async get(cacheKey) {
+    // A set for this key may still be draining its stream. Waiting is what keeps
+    // a concurrent reader from missing and rendering the same thing again.
+    await pendingSets.get(cacheKey);
+
+    const raw = await cacheRedisRead<null | string>(
+      async client => await client.get(entryKey(cacheKey)),
+      null,
+    );
+    if (raw === null) return undefined;
+
+    let stored: StoredEntry;
+    try {
+      stored = JSON.parse(raw) as StoredEntry;
+    } catch {
+      return undefined;
+    }
+
+    const tags = stored.tags ?? [];
+    const states = await readTagStates(tags);
+
+    if (areTagsExpired(states, tags, stored.timestamp)) return undefined;
+
+    return {
+      expire: stored.expire,
+      // `-1` is Next's signal to revalidate this entry now while still serving
+      // it, which is exactly what a stale (rather than expired) tag means.
+      revalidate: areTagsStale(states, tags, stored.timestamp)
+        ? -1
+        : stored.revalidate,
+      stale: stored.stale,
+      tags,
+      timestamp: stored.timestamp,
+      value: toStream(Buffer.from(stored.value, "base64")),
+    };
+  },
+
+  async getExpiration(tags) {
+    return latestTagExpiration(await readTagStates(tags), tags);
+  },
+
+  /**
+   * Nothing to pull in.
+   *
+   * Next calls this before a request so a handler can refresh a local manifest.
+   * This one has no manifest: {@link get} and {@link getExpiration} read the tags
+   * they actually need, when they need them, which is both fresher and cheaper
+   * than syncing every tag the deployment has ever revalidated.
+   */
+  async refreshTags() {
+    await Promise.resolve();
+  },
+
+  /**
+   * Stores an entry once its stream has finished.
+   *
+   * The entry arrives as a promise whose `value` stream may still be being
+   * written, so it is drained in full before anything is stored - a half-written
+   * payload in a shared cache would be served to every instance.
+   */
+  async set(cacheKey, pendingEntry) {
+    let release = (): void => {};
+    pendingSets.set(
+      cacheKey,
+      new Promise<void>(resolve => {
+        release = resolve;
+      }),
+    );
+
+    try {
+      const entry = await pendingEntry;
+
+      // `expire: 0` is a dynamic entry: the wrapper regenerates it on every read
+      // rather than serving a stored copy, so writing it is a round-trip for a
+      // value nothing will ever read back.
+      if (entry.expire === 0) return;
+
+      const payload = await readStream(entry.value);
+      const stored: StoredEntry = {
+        expire: entry.expire,
+        revalidate: entry.revalidate,
+        stale: entry.stale,
+        tags: entry.tags,
+        timestamp: entry.timestamp,
+        value: payload.toString("base64"),
+      };
+
+      await cacheRedisWrite(async client => {
+        const raw = JSON.stringify(stored);
+
+        // Redis expiry is a backstop that keeps abandoned entries from
+        // accumulating. Next enforces `expire` itself on read, so the two agree;
+        // an "infinite" entry simply gets no TTL rather than a 136-year one.
+        if (entry.expire >= INFINITE_CACHE) {
+          await client.set(entryKey(cacheKey), raw);
+
+          return;
+        }
+
+        await client.set(entryKey(cacheKey), raw, {
+          expiration: {
+            type: "EX",
+            value: Math.max(1, Math.ceil(entry.expire)),
+          },
+        });
+      });
+    } catch {
+      /* a failed write is a future miss, not a failed request */
+    } finally {
+      release();
+      pendingSets.delete(cacheKey);
+    }
+  },
+
+  async updateTags(tags, durations) {
+    await writeTagStates(tags, durations);
+  },
+};
+
+export default handler;
diff --git a/packages/vitnode/src/routes/admin/core/users/[id]/page.tsx b/packages/vitnode/src/routes/admin/core/users/[id]/page.tsx
index 8ea322a1d..b6530736d 100644
--- a/packages/vitnode/src/routes/admin/core/users/[id]/page.tsx
+++ b/packages/vitnode/src/routes/admin/core/users/[id]/page.tsx
@@ -2,6 +2,7 @@ import type { Metadata } from "next/dist/types";
 
 import { getTranslations } from "next-intl/server";
 import dynamic from "next/dynamic";
+import { connection } from "next/server";
 import React from "react";
 
 import { adminModule } from "@/api/modules/admin/admin.module";
@@ -46,18 +47,38 @@ export const generateMetadata = async ({
   };
 };
 
-export default async function Page({
+/**
+ * `generateMetadata` puts the user's name in the title, which needs a fetch that
+ * cannot be cached - `fetcher` forwards the request's cookies and `use cache`
+ * cannot enclose a runtime read. This marks the route as intentionally partly
+ * dynamic so the metadata is allowed to be, while the body still prerenders.
+ */
+const DynamicMarker = async () => {
+  await connection();
+
+  return null;
+};
+
+const ShowUserAdmin = async ({
   params,
 }: {
   params: Promise<{ id: string }>;
-}) {
+}) => {
   const { id } = await params;
 
+  return <ShowUserAdminView id={id} />;
+};
+
+export default function Page({ params }: { params: Promise<{ id: string }> }) {
   return (
     <I18nProvider namespaces={["admin.user", "core.search"]}>
       <div className="p-4">
+        <React.Suspense fallback={null}>
+          <DynamicMarker />
+        </React.Suspense>
+
         <React.Suspense fallback={<Loader />}>
-          <ShowUserAdminView id={id} />
+          <ShowUserAdmin params={params} />
         </React.Suspense>
       </div>
     </I18nProvider>
diff --git a/packages/vitnode/src/routes/breadcrumb/admin/core/staff/admins/edit/[id]/page.tsx b/packages/vitnode/src/routes/breadcrumb/admin/core/staff/admins/edit/[id]/page.tsx
index 6624b1395..82a2a0bfa 100644
--- a/packages/vitnode/src/routes/breadcrumb/admin/core/staff/admins/edit/[id]/page.tsx
+++ b/packages/vitnode/src/routes/breadcrumb/admin/core/staff/admins/edit/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbStaffEditAdmin } from "@/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin";
+import { BreadcrumbSkeleton } from "@/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbStaffEditAdmin id={id} type="admin" />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={4} />}>
+      <BreadcrumbStaffEditAdmin params={params} type="admin" />
+    </React.Suspense>
+  );
 }
diff --git a/packages/vitnode/src/routes/breadcrumb/admin/core/staff/moderators/edit/[id]/page.tsx b/packages/vitnode/src/routes/breadcrumb/admin/core/staff/moderators/edit/[id]/page.tsx
index 8101841a7..75c0af914 100644
--- a/packages/vitnode/src/routes/breadcrumb/admin/core/staff/moderators/edit/[id]/page.tsx
+++ b/packages/vitnode/src/routes/breadcrumb/admin/core/staff/moderators/edit/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbStaffEditAdmin } from "@/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin";
+import { BreadcrumbSkeleton } from "@/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbStaffEditAdmin id={id} type="moderator" />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={4} />}>
+      <BreadcrumbStaffEditAdmin params={params} type="moderator" />
+    </React.Suspense>
+  );
 }
diff --git a/packages/vitnode/src/routes/breadcrumb/admin/core/users/[id]/page.tsx b/packages/vitnode/src/routes/breadcrumb/admin/core/users/[id]/page.tsx
index ff761a42d..e8ad18d7b 100644
--- a/packages/vitnode/src/routes/breadcrumb/admin/core/users/[id]/page.tsx
+++ b/packages/vitnode/src/routes/breadcrumb/admin/core/users/[id]/page.tsx
@@ -1,11 +1,16 @@
+import React from "react";
+
 import { BreadcrumbUserAdmin } from "@/views/admin/layouts/breadcrumb/breadcrumb-user-admin";
+import { BreadcrumbSkeleton } from "@/views/breadcrumb/breadcrumb-render";
 
-export default async function BreadcrumbSlot({
+export default function BreadcrumbSlot({
   params,
 }: {
   params: Promise<{ id: string }>;
 }) {
-  const { id } = await params;
-
-  return <BreadcrumbUserAdmin id={id} />;
+  return (
+    <React.Suspense fallback={<BreadcrumbSkeleton crumbs={3} />}>
+      <BreadcrumbUserAdmin params={params} />
+    </React.Suspense>
+  );
 }
diff --git a/packages/vitnode/src/routes/main/login/reset-password/page.tsx b/packages/vitnode/src/routes/main/login/reset-password/page.tsx
index 5aba343d6..ddf421575 100644
--- a/packages/vitnode/src/routes/main/login/reset-password/page.tsx
+++ b/packages/vitnode/src/routes/main/login/reset-password/page.tsx
@@ -4,6 +4,15 @@ import { getTranslations } from "next-intl/server";
 
 import { PasswordResetView } from "@/views/auth/password-reset/password-reset-view";
 
+// instant = false: kept on purpose. The page is only meaningful on an install
+// with an email adapter, and `PasswordResetView` calls `notFound()` when there
+// is none - so the response status depends on a read only the API can answer.
+// That read cannot be prerendered, and behind a `<Suspense>` boundary it would
+// land after the fallback had already committed the response to 200, leaving
+// crawlers, caches and monitoring with a successful reset-password page whose
+// body says not-found. The route blocks so the status is decided first.
+export const instant = false;
+
 export const generateMetadata = async (): Promise<Metadata> => {
   const t = await getTranslations("core.auth.reset_password");
 
diff --git a/packages/vitnode/src/views/admin/layouts/admin-layout.tsx b/packages/vitnode/src/views/admin/layouts/admin-layout.tsx
index eb2b5b429..036b276ff 100644
--- a/packages/vitnode/src/views/admin/layouts/admin-layout.tsx
+++ b/packages/vitnode/src/views/admin/layouts/admin-layout.tsx
@@ -1,4 +1,4 @@
-import { cookies } from "next/headers";
+import { Suspense } from "react";
 
 import { AdminStaffPermissionProvider } from "@/components/staff-permission/provider";
 import { Separator } from "@/components/ui/separator";
@@ -7,6 +7,7 @@ import {
   SidebarProvider,
   SidebarTrigger,
 } from "@/components/ui/sidebar";
+import { Skeleton } from "@/components/ui/skeleton";
 import { getSessionAdminApi } from "@/lib/api/get-session-admin-api";
 
 import type { VitNodeConfig } from "../../../vitnode.config";
@@ -15,6 +16,8 @@ import { I18nProvider } from "../../../components/i18n-provider";
 import { getSearchNavItems } from "./search/get-search-nav-items";
 import { SearchAdmin } from "./search/search";
 import { getAdminNav } from "./sidebar/nav/get-admin-nav";
+import { NavSidebarAdmin } from "./sidebar/nav/nav";
+import { NavSidebarAdminSkeleton } from "./sidebar/nav/nav-skeleton";
 import { SidebarAdmin } from "./sidebar/sidebar";
 import { UserBarAdmin } from "./user-bar/user-bar";
 
@@ -24,51 +27,112 @@ export interface AdminLayoutProps {
   children: React.ReactNode;
 }
 
-export const AdminLayout = async ({
+const AdminStaffPermissionScope = async ({
   children,
-  breadcrumb,
+}: {
+  children: React.ReactNode;
+}) => {
+  const session = await getSessionAdminApi();
+
+  return (
+    <AdminStaffPermissionProvider
+      value={session?.permissions ?? { root: false, permissions: [] }}
+    >
+      {children}
+    </AdminStaffPermissionProvider>
+  );
+};
+
+const NavSidebarAdminSession = async ({
   vitNodeConfig,
-}: AdminLayoutProps & {
+}: {
+  vitNodeConfig: VitNodeConfig;
+}) => <NavSidebarAdmin nav={await getAdminNav({ vitNodeConfig })} />;
+
+const SearchAdminSession = async ({
+  vitNodeConfig,
+}: {
   vitNodeConfig: VitNodeConfig;
 }) => {
+  const nav = await getAdminNav({ vitNodeConfig });
+
+  return (
+    <SearchAdmin items={await getSearchNavItems({ nav, vitNodeConfig })} />
+  );
+};
+
+const UserBarAdminSession = async () => {
   const session = await getSessionAdminApi();
-  const cookieStore = await cookies();
-  const defaultOpen =
-    !cookieStore.get("vitnode_admin_sidebar_state") ||
-    cookieStore.get("vitnode_admin_sidebar_state")?.value === "true";
   if (!session) return null;
 
-  const nav = await getAdminNav({ vitNodeConfig });
-  const searchItems = await getSearchNavItems({ nav, vitNodeConfig });
+  return <UserBarAdmin user={session.user} />;
+};
+
+const ContentAdminSkeleton = () => (
+  <div className="space-y-6 p-4">
+    <div className="space-y-2">
+      <Skeleton className="h-7 w-56" />
+      <Skeleton className="h-4 w-80 max-w-full" />
+    </div>
+    <Skeleton className="h-72 w-full" />
+  </div>
+);
 
+export const AdminLayout = ({
+  children,
+  breadcrumb,
+  vitNodeConfig,
+}: AdminLayoutProps & {
+  vitNodeConfig: VitNodeConfig;
+}) => {
   return (
     <I18nProvider namespaces={["admin.global"]}>
-      <AdminStaffPermissionProvider value={session.permissions}>
-        <SidebarProvider defaultOpen={defaultOpen}>
-          <SidebarAdmin nav={nav} vitNodeConfig={vitNodeConfig} />
-          <SidebarInset>
-            <header className="bg-background sticky top-0 z-20 flex h-16 shrink-0 items-center gap-2 border-b px-4">
-              <SidebarTrigger className="-ml-1 shrink-0" />
-              {breadcrumb != null && (
-                <>
-                  <Separator
-                    className="mr-1 h-4 shrink-0"
-                    orientation="vertical"
-                  />
-                  <div className="min-w-0 flex-1">{breadcrumb}</div>
-                </>
-              )}
-
-              <div className="ml-auto flex shrink-0 items-center justify-center gap-2 px-2">
-                <SearchAdmin items={searchItems} />
-
-                <UserBarAdmin user={session.user} />
-              </div>
-            </header>
-            {children}
-          </SidebarInset>
-        </SidebarProvider>
-      </AdminStaffPermissionProvider>
+      <SidebarProvider>
+        <SidebarAdmin vitNodeConfig={vitNodeConfig}>
+          <Suspense fallback={<NavSidebarAdminSkeleton />}>
+            <NavSidebarAdminSession vitNodeConfig={vitNodeConfig} />
+          </Suspense>
+        </SidebarAdmin>
+        <SidebarInset>
+          <header className="bg-background sticky top-0 z-20 flex h-16 shrink-0 items-center gap-2 border-b px-4">
+            <SidebarTrigger className="-ml-1 shrink-0" />
+            {breadcrumb != null && (
+              <>
+                <Separator
+                  className="mr-1 h-4 shrink-0"
+                  orientation="vertical"
+                />
+                <div className="min-w-0 flex-1">{breadcrumb}</div>
+              </>
+            )}
+
+            <div className="ml-auto flex shrink-0 items-center justify-center gap-2 px-2">
+              <Suspense
+                fallback={
+                  <>
+                    <Skeleton className="size-8 sm:hidden" />
+                    <Skeleton className="hidden h-9 w-42 sm:block xl:w-64" />
+                  </>
+                }
+              >
+                <AdminStaffPermissionScope>
+                  <SearchAdminSession vitNodeConfig={vitNodeConfig} />
+                </AdminStaffPermissionScope>
+              </Suspense>
+
+              <Suspense fallback={<Skeleton className="size-9" />}>
+                <AdminStaffPermissionScope>
+                  <UserBarAdminSession />
+                </AdminStaffPermissionScope>
+              </Suspense>
+            </div>
+          </header>
+
+          <Suspense fallback={<ContentAdminSkeleton />}>
+            <AdminStaffPermissionScope>{children}</AdminStaffPermissionScope>
+          </Suspense>
+        </SidebarInset>
+      </SidebarProvider>
     </I18nProvider>
   );
 };
diff --git a/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-admin.tsx b/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-admin.tsx
index 453e106ab..c0c186b09 100644
--- a/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-admin.tsx
+++ b/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-admin.tsx
@@ -1,5 +1,8 @@
+import { Suspense } from "react";
+
 import type { VitNodeConfig } from "@/vitnode.config";
 
+import { Skeleton } from "@/components/ui/skeleton";
 import { BreadcrumbRender } from "@/views/breadcrumb/breadcrumb-render";
 
 import type { NavAdminParent } from "../sidebar/nav/get-admin-nav";
@@ -24,7 +27,7 @@ export interface BreadcrumbAdminProps {
   vitNodeConfig?: VitNodeConfig;
 }
 
-export const BreadcrumbAdmin = async ({
+const BreadcrumbAdminResolved = async ({
   segments,
   vitNodeConfig,
   overrideLastLabel,
@@ -53,3 +56,15 @@ export const BreadcrumbAdmin = async ({
 
   return <BreadcrumbRender crumbs={crumbs} scrollable />;
 };
+
+/**
+ * The nav the crumbs are resolved from is permission-filtered, so building it
+ * reads the admin session. That read is kept behind this boundary rather than
+ * one in the layout: `@breadcrumb` is its own route segment, and a boundary
+ * above the segment does not make a navigation into it instant.
+ */
+export const BreadcrumbAdmin = (props: BreadcrumbAdminProps) => (
+  <Suspense fallback={<Skeleton className="h-4 w-40" />}>
+    <BreadcrumbAdminResolved {...props} />
+  </Suspense>
+);
diff --git a/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin.tsx b/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin.tsx
index d40175891..15f977bf3 100644
--- a/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin.tsx
+++ b/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-staff-edit-admin.tsx
@@ -4,14 +4,22 @@ import type { PermissionStaffType } from "@/api/lib/permission-staff";
 
 import { BreadcrumbAdmin } from "./breadcrumb-admin";
 
+/**
+ * Takes `params` as the promise the slot was handed rather than the resolved
+ * id: awaiting it above the slot's `<Suspense>` would pull the URL back into
+ * the AdminCP's shared App Shell.
+ */
 export const BreadcrumbStaffEditAdmin = async ({
   type,
-  id,
+  params,
 }: {
-  id: string;
+  params: Promise<{ id: string }>;
   type: PermissionStaffType;
 }) => {
-  const t = await getTranslations("admin.staff");
+  const [{ id }, t] = await Promise.all([
+    params,
+    getTranslations("admin.staff"),
+  ]);
   const tab = type === "admin" ? "admins" : "moderators";
 
   return (
diff --git a/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-user-admin.tsx b/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-user-admin.tsx
index 20b6d1ba8..e908cf182 100644
--- a/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-user-admin.tsx
+++ b/packages/vitnode/src/views/admin/layouts/breadcrumb/breadcrumb-user-admin.tsx
@@ -11,17 +11,24 @@ import { resolveBreadcrumb } from "./resolve-breadcrumb";
  * Breadcrumb for the user detail page (`/admin/core/users/<id>`). Resolves the
  * real user name server-side so the last crumb shows the name instead of the
  * raw url segment - the data-resolution showcase of the parallel-routes pattern.
+ *
+ * Takes `params` as the promise the slot was handed rather than the resolved
+ * id: awaiting it above the slot's `<Suspense>` would pull the URL back into
+ * the AdminCP's shared App Shell.
  */
 export const BreadcrumbUserAdmin = async ({
-  id,
+  params,
   vitNodeConfig,
 }: {
-  id: string;
+  params: Promise<{ id: string }>;
   /** Defaults to the registered app config when omitted. */
   vitNodeConfig?: VitNodeConfig;
 }) => {
+  const [{ id }, nav] = await Promise.all([
+    params,
+    getAdminNav({ vitNodeConfig }),
+  ]);
   const segments = ["core", "users", id];
-  const nav = await getAdminNav({ vitNodeConfig });
 
   // Static sibling routes (e.g. `/users/roles`) also match this dynamic slot —
   // only look up a user when the segment isn't already a known nav route.
diff --git a/packages/vitnode/src/views/admin/layouts/sidebar/nav/nav-skeleton.tsx b/packages/vitnode/src/views/admin/layouts/sidebar/nav/nav-skeleton.tsx
new file mode 100644
index 000000000..136896d3f
--- /dev/null
+++ b/packages/vitnode/src/views/admin/layouts/sidebar/nav/nav-skeleton.tsx
@@ -0,0 +1,30 @@
+import {
+  SidebarGroup,
+  SidebarGroupLabel,
+  SidebarMenu,
+} from "@/components/ui/sidebar";
+import { Skeleton } from "@/components/ui/skeleton";
+import { cn } from "@/lib/utils";
+
+/**
+ * Widths are fixed rather than randomised. `SidebarMenuSkeleton` picks its own
+ * with `Math.random()`, which a prerendered fallback cannot do.
+ */
+const ITEM_WIDTHS = ["w-24", "w-20", "w-28", "w-16", "w-22"];
+
+export const NavSidebarAdminSkeleton = () => (
+  <SidebarGroup>
+    <SidebarGroupLabel>
+      <Skeleton className="h-3 w-12" />
+    </SidebarGroupLabel>
+
+    <SidebarMenu>
+      {ITEM_WIDTHS.map(width => (
+        <div className="flex h-8 items-center gap-2 px-2" key={width}>
+          <Skeleton className="size-4 shrink-0 rounded-md" />
+          <Skeleton className={cn("h-4", width)} />
+        </div>
+      ))}
+    </SidebarMenu>
+  </SidebarGroup>
+);
diff --git a/packages/vitnode/src/views/admin/layouts/sidebar/sidebar.tsx b/packages/vitnode/src/views/admin/layouts/sidebar/sidebar.tsx
index a69692774..6f1cec48b 100644
--- a/packages/vitnode/src/views/admin/layouts/sidebar/sidebar.tsx
+++ b/packages/vitnode/src/views/admin/layouts/sidebar/sidebar.tsx
@@ -10,15 +10,16 @@ import {
 } from "@/components/ui/sidebar";
 import { Link } from "@/lib/navigation";
 
-import type { NavAdminParent } from "./nav/nav";
-
-import { NavSidebarAdmin } from "./nav/nav";
-
+/**
+ * The sidebar frame. Takes the nav as `children` rather than building it, so the
+ * logo and the switchers can be prerendered while the permission-filtered nav
+ * streams into its own boundary.
+ */
 export const SidebarAdmin = ({
-  nav,
+  children,
   vitNodeConfig,
 }: {
-  nav: NavAdminParent[];
+  children: React.ReactNode;
   vitNodeConfig: VitNodeConfig;
 }) => {
   return (
@@ -34,9 +35,7 @@ export const SidebarAdmin = ({
         <ThemeSwitcher />
       </SidebarHeader>
 
-      <SidebarContent>
-        <NavSidebarAdmin nav={nav} />
-      </SidebarContent>
+      <SidebarContent>{children}</SidebarContent>
     </Sidebar>
   );
 };
diff --git a/packages/vitnode/src/views/admin/views/core/advanced/search/mutation-api.server.ts b/packages/vitnode/src/views/admin/views/core/advanced/search/mutation-api.server.ts
index 471d5aaf6..76d9fc73a 100644
--- a/packages/vitnode/src/views/admin/views/core/advanced/search/mutation-api.server.ts
+++ b/packages/vitnode/src/views/admin/views/core/advanced/search/mutation-api.server.ts
@@ -1,6 +1,9 @@
 "use server";
 
+import { updateTag } from "next/cache";
+
 import { debugAdminModule } from "@/api/modules/admin/debug/debug.admin.module";
+import { SEARCH_FEED_TAG } from "@/lib/cache-tags";
 import { fetcher } from "@/lib/fetcher";
 
 export const rebuildSearchIndexMutation = async (itemType?: string) => {
@@ -18,7 +21,16 @@ export const rebuildSearchIndexMutation = async (itemType?: string) => {
     return { error: await res.text() };
   }
 
-  return { data: await res.json() };
+  const data = await res.json();
+
+  // The public browse feed is a cached read of this index. Expiring it here is
+  // what makes a rebuild visible on `/search` and `/discover` without waiting
+  // out its `cacheLife`. `updateTag` rather than `revalidateTag` because this is
+  // a Server Action: the admin who pressed the button sees the new feed on the
+  // refresh it triggers, not one navigation later.
+  updateTag(SEARCH_FEED_TAG);
+
+  return { data };
 };
 
 /**
@@ -41,5 +53,10 @@ export const clearSearchCollectionMutation = async (itemType: string) => {
     return { error: await res.text() };
   }
 
-  return { data: await res.json() };
+  const data = await res.json();
+
+  // Documents just disappeared from the index; the feed must stop listing them.
+  updateTag(SEARCH_FEED_TAG);
+
+  return { data };
 };
diff --git a/packages/vitnode/src/views/admin/views/core/dashboard/dashboard-admin-view.tsx b/packages/vitnode/src/views/admin/views/core/dashboard/dashboard-admin-view.tsx
index 79f551144..ebdcc3d60 100644
--- a/packages/vitnode/src/views/admin/views/core/dashboard/dashboard-admin-view.tsx
+++ b/packages/vitnode/src/views/admin/views/core/dashboard/dashboard-admin-view.tsx
@@ -4,6 +4,7 @@ import React from "react";
 
 import { I18nProvider } from "@/components/i18n-provider";
 import { Badge } from "@/components/ui/badge";
+import { Skeleton } from "@/components/ui/skeleton";
 import { getSessionAdminApi } from "@/lib/api/get-session-admin-api";
 import { CONFIG } from "@/lib/config";
 
@@ -12,14 +13,25 @@ import type { DashboardHeaderContent } from "./widgets/types";
 import { DashboardBoard } from "./dashboard-board";
 import { DashboardBoardSkeleton } from "./dashboard-board-skeleton";
 
+const DashboardVersion = async () => {
+  const [session, t] = await Promise.all([
+    getSessionAdminApi(),
+    getTranslations("admin.dashboard"),
+  ]);
+  if (!session) return null;
+
+  return t("version", { version: session.vitnode_version });
+};
+
 export const DashboardAdminView = async () => {
-  const session = await getSessionAdminApi();
   const t = await getTranslations("admin.dashboard");
-  if (!session) return null;
-  const { vitnode_version } = session;
 
   const header: DashboardHeaderContent = {
-    desc: t("version", { version: vitnode_version }),
+    desc: (
+      <React.Suspense fallback={<Skeleton className="h-5 w-48" />}>
+        <DashboardVersion />
+      </React.Suspense>
+    ),
     h1: (
       <>
         <span>VitNode</span>
diff --git a/packages/vitnode/src/views/auth/password-reset/password-reset-view.tsx b/packages/vitnode/src/views/auth/password-reset/password-reset-view.tsx
index 2efb2158f..425bd0479 100644
--- a/packages/vitnode/src/views/auth/password-reset/password-reset-view.tsx
+++ b/packages/vitnode/src/views/auth/password-reset/password-reset-view.tsx
@@ -1,6 +1,10 @@
+import type z from "zod";
+
 import { notFound } from "next/navigation";
 import React from "react";
 
+import type { routeMiddlewareSchema } from "@/api/modules/middleware/route";
+
 import { I18nProvider } from "@/components/i18n-provider";
 import { Card, CardContent, CardHeader } from "@/components/ui/card";
 import { Skeleton } from "@/components/ui/skeleton";
@@ -9,17 +13,24 @@ import { getMiddlewareApi } from "@/lib/api/get-middleware-api";
 import { ChangePasswordForm } from "./change-password-form/form";
 import { PasswordResetForm } from "./form/form";
 
+type Captcha = z.infer<typeof routeMiddlewareSchema>["captcha"];
+
+/**
+ * Which of the two forms to show depends on whether the URL carries a reset
+ * token, so this is the only part that reads `searchParams`. Kept behind its own
+ * `<Suspense>` so the card paints before the branch is decided, rather than the
+ * whole view waiting on a promise only one field of it needs.
+ *
+ * The email-adapter check deliberately does *not* live here - see the view below.
+ */
 const PasswordResetContent = async ({
+  captcha,
   searchParams,
 }: {
+  captcha: Captcha;
   searchParams: Promise<{ token: string; userId: string }>;
 }) => {
-  const [{ isEmail, captcha }, { token, userId }] = await Promise.all([
-    getMiddlewareApi(),
-    searchParams,
-  ]);
-
-  if (!isEmail) notFound();
+  const { token, userId } = await searchParams;
 
   if (token && userId) {
     return (
@@ -55,16 +66,33 @@ const PasswordResetContentSkeleton = () => (
   </>
 );
 
-export const PasswordResetView = ({
+/**
+ * Resolves whether this install can reset passwords at all *before* anything is
+ * streamed, because that answer decides the response status: an install with no
+ * email adapter has to return a real 404, and once a `<Suspense>` fallback has
+ * flushed the response is already committed to 200. Crawlers, caches and uptime
+ * checks would then record a healthy reset-password page whose body says
+ * not-found.
+ *
+ * Nothing here can be prerendered to avoid that - `getMiddlewareApi` waits for a
+ * real request (the API is unreachable during the build) - so the route carries a
+ * documented `instant = false` and blocks until the status is known.
+ */
+export const PasswordResetView = async ({
   searchParams,
 }: {
   searchParams: Promise<{ token: string; userId: string }>;
-}) => (
-  <div className="mx-auto flex max-w-md flex-col justify-center px-4 py-16 md:min-h-[calc(100vh-4rem)]">
-    <Card>
-      <React.Suspense fallback={<PasswordResetContentSkeleton />}>
-        <PasswordResetContent searchParams={searchParams} />
-      </React.Suspense>
-    </Card>
-  </div>
-);
+}) => {
+  const { isEmail, captcha } = await getMiddlewareApi();
+  if (!isEmail) notFound();
+
+  return (
+    <div className="mx-auto flex max-w-md flex-col justify-center px-4 py-16 md:min-h-[calc(100vh-4rem)]">
+      <Card>
+        <React.Suspense fallback={<PasswordResetContentSkeleton />}>
+          <PasswordResetContent captcha={captcha} searchParams={searchParams} />
+        </React.Suspense>
+      </Card>
+    </div>
+  );
+};
diff --git a/packages/vitnode/src/views/search/discover-view.tsx b/packages/vitnode/src/views/search/discover-view.tsx
index 19690a4ea..cd893c56e 100644
--- a/packages/vitnode/src/views/search/discover-view.tsx
+++ b/packages/vitnode/src/views/search/discover-view.tsx
@@ -1,23 +1,11 @@
 import { getLocale } from "next-intl/server";
 
-import { searchModule } from "@/api/modules/search/search.module";
-import { fetcher } from "@/lib/fetcher";
-
-import type { SearchFeedPage } from "./types";
-
+import { fetchSearchFeed } from "./fetch-feed";
 import { SearchFeed } from "./search-feed";
 
 export const DiscoverView = async () => {
   const locale = await getLocale();
-  const res = await fetcher(searchModule, {
-    module: "search",
-    path: "/",
-    method: "get",
-    args: {
-      query: { sort: "newest", first: "20", lang: locale },
-    },
-  });
-  const initialData = (await res.json()) as SearchFeedPage;
+  const initialData = await fetchSearchFeed({ locale });
 
   return (
     <SearchFeed
diff --git a/packages/vitnode/src/views/search/fetch-feed.ts b/packages/vitnode/src/views/search/fetch-feed.ts
new file mode 100644
index 000000000..330dabbc0
--- /dev/null
+++ b/packages/vitnode/src/views/search/fetch-feed.ts
@@ -0,0 +1,87 @@
+import "server-only";
+import { cacheLife, cacheTag } from "next/cache";
+import { connection } from "next/server";
+
+import { searchModule } from "@/api/modules/search/search.module";
+import { SEARCH_FEED_TAG } from "@/lib/cache-tags";
+import { fetcher } from "@/lib/fetcher";
+import { coreFetcher } from "@/lib/fetcher/core";
+
+import type { SearchFeedPage } from "./types";
+
+/** How many hits the first server-rendered page holds. */
+const FEED_PAGE_SIZE = "20";
+
+/**
+ * The browse feed: no term, newest first, one language.
+ *
+ * Cached, and it is the only search read that is. The arguments are a closed
+ * set - one entry per enabled locale - the response is identical for every
+ * visitor (the route resolves it with `includePrivate: false` and never looks at
+ * the user), and it is the page crawlers and first-time visitors land on. That
+ * is the whole shape a shared cache wants.
+ *
+ * A *term* search is none of those things: the key space is whatever anyone
+ * types, so caching it would fill the store with entries that are read once. It
+ * stays dynamic - see {@link fetchSearchFeed}.
+ *
+ * `coreFetcher` rather than `fetcher`, because `fetcher` forwards the request's
+ * cookies and `x-forwarded-for` and `"use cache"` cannot enclose a runtime read.
+ * Nothing on this route is per-visitor, so there is nothing to forward.
+ */
+const fetchCachedFeed = async (locale: string): Promise<SearchFeedPage> => {
+  "use cache";
+  cacheLife("minutes");
+  cacheTag(SEARCH_FEED_TAG);
+
+  const res = await coreFetcher(searchModule, {
+    module: "search",
+    path: "/",
+    method: "get",
+    args: {
+      query: { sort: "newest", first: FEED_PAGE_SIZE, lang: locale },
+    },
+  });
+
+  return await res.json();
+};
+
+const fetchLiveFeed = async ({
+  locale,
+  search,
+}: {
+  locale: string;
+  search: string;
+}): Promise<SearchFeedPage> => {
+  const res = await fetcher(searchModule, {
+    module: "search",
+    path: "/",
+    method: "get",
+    args: {
+      query: {
+        search,
+        sort: "relevance",
+        first: FEED_PAGE_SIZE,
+        lang: locale,
+      },
+    },
+  });
+
+  return await res.json();
+};
+
+export const fetchSearchFeed = async ({
+  locale,
+  search,
+}: {
+  locale: string;
+  search?: string;
+}): Promise<SearchFeedPage> => {
+  if (search !== undefined && search !== "") {
+    return await fetchLiveFeed({ locale, search });
+  }
+
+  await connection();
+
+  return await fetchCachedFeed(locale);
+};
diff --git a/packages/vitnode/src/views/search/search-view.tsx b/packages/vitnode/src/views/search/search-view.tsx
index 77ff07c98..8eea48779 100644
--- a/packages/vitnode/src/views/search/search-view.tsx
+++ b/packages/vitnode/src/views/search/search-view.tsx
@@ -1,11 +1,8 @@
 import { getLocale } from "next-intl/server";
 
-import { searchModule } from "@/api/modules/search/search.module";
-import { fetcher } from "@/lib/fetcher";
-
 import type { SearchFeedParams } from "./search-feed";
-import type { SearchFeedPage } from "./types";
 
+import { fetchSearchFeed } from "./fetch-feed";
 import { SearchControls } from "./search-controls";
 
 export const SearchView = async ({
@@ -19,15 +16,7 @@ export const SearchView = async ({
   const sort = search ? "relevance" : "newest";
   const defaultParams: SearchFeedParams = { search, sort };
 
-  const res = await fetcher(searchModule, {
-    module: "search",
-    path: "/",
-    method: "get",
-    args: {
-      query: { ...(search ? { search } : {}), sort, first: "20", lang: locale },
-    },
-  });
-  const initialData = (await res.json()) as SearchFeedPage;
+  const initialData = await fetchSearchFeed({ locale, search });
 
   return (
     <SearchControls defaultParams={defaultParams} initialData={initialData} />