diff --git a/.forgejo/workflows/benchmark-metrics.yml b/.forgejo/workflows/benchmark-metrics.yml
index 1d26732..fc08e47 100644
--- a/.forgejo/workflows/benchmark-metrics.yml
+++ b/.forgejo/workflows/benchmark-metrics.yml
@@ -25,12 +25,6 @@ jobs:
         fi
         go version
 
-    - name: Cache Go modules
-      uses: actions/cache@v4
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-
     - name: Run benchmarks
       run: |
         echo "Running performance benchmarks..."
diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index d4a9fba..4e6a4f9 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -182,7 +182,15 @@ jobs:
       run: |
         make -C cli build-rsync RSYNC_VERSION=${{ env.RSYNC_VERSION }}
 
-    - name: Build binaries
+    - name: Build SQLite for CLI
+      run: |
+        make -C cli build-sqlite
+
+    - name: Build CLI binary
+      run: |
+        cd cli && make tiny
+
+    - name: Build Go binaries
       run: |
         make build
 
diff --git a/cli/scripts/build_sqlite.sh b/cli/scripts/build_sqlite.sh
index edc1074..294e560 100644
--- a/cli/scripts/build_sqlite.sh
+++ b/cli/scripts/build_sqlite.sh
@@ -7,6 +7,7 @@ set -euo pipefail
 SQLITE_VERSION="${SQLITE_VERSION:-3480000}"  # 3.48.0
 SQLITE_YEAR="${SQLITE_YEAR:-2025}"
 SQLITE_SRC_BASE="${SQLITE_SRC_BASE:-https://www.sqlite.org/${SQLITE_YEAR}}"
+SQLITE_SHA256="${SQLITE_SHA256:-d9a15a42db7c78f88fe3d3c5945acce2f4bfe9e4da9f685cd19f6ea1d40aa884}"
 
 os="$(uname -s | tr '[:upper:]' '[:lower:]')"
 arch="$(uname -m)"
@@ -32,6 +33,19 @@ if [[ ! -f "${out_dir}/sqlite3.c" ]]; then
     echo "Fetching ${url}"
     curl -fsSL "${url}" -o "${tmp}/sqlite.zip"
     
+    # Verify SHA256 if provided
+    if [[ -n "${SQLITE_SHA256}" ]]; then
+        echo "verifying sha256 for ${url}"
+        actual_sha256="$(sha256sum "${tmp}/sqlite.zip" | cut -d' ' -f1)"
+        if [[ "${actual_sha256}" != "${SQLITE_SHA256}" ]]; then
+            echo "build-sqlite: sha256 mismatch!" >&2
+            echo "  expected: ${SQLITE_SHA256}" >&2
+            echo "  actual:   ${actual_sha256}" >&2
+            exit 2
+        fi
+        echo "${tmp}/sqlite.zip: OK"
+    fi
+    
     unzip -q "${tmp}/sqlite.zip" -d "${tmp}"
     mv "${tmp}/sqlite-amalgamation-${SQLITE_VERSION}"/* "${out_dir}/"