diff --git a/.gitea/actions/rust-cache/action.yml b/.gitea/actions/rust-cache/action.yml
index 590e8f8..bb30a69 100644
--- a/.gitea/actions/rust-cache/action.yml
+++ b/.gitea/actions/rust-cache/action.yml
@@ -39,6 +39,10 @@ inputs:
     description: Optional S3 key prefix. Defaults to repository/runner/toolchain scope.
     default: ""
     required: false
+  sccache-wrap-cc:
+    description: Also wrap CC and CXX with sccache so build-script C/C++ compiles (e.g. libduckdb-sys, ring) hit the same cache as rustc. Set to "false" to opt out.
+    default: "true"
+    required: false
 
 outputs:
   sccache-enabled:
@@ -119,6 +123,10 @@ runs:
             echo "SCCACHE_S3_ENABLE_VIRTUAL_HOST_STYLE=true" >> "$GITHUB_ENV"
           fi
         fi
+        if [ '${{ inputs.sccache-wrap-cc }}' = 'true' ]; then
+          echo "CC=sccache cc" >> "$GITHUB_ENV"
+          echo "CXX=sccache c++" >> "$GITHUB_ENV"
+        fi
 
     - name: Start sccache
       if: ${{ inputs.sccache == 'true' }}
diff --git a/README.md b/README.md
index 4e0d76d..a441d48 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,7 @@ Omit `sccache-bucket` to use the runner-local sccache cache:
 - `sccache-s3-use-ssl`: Whether the endpoint uses TLS. Defaults to `"true"`.
 - `sccache-s3-enable-virtual-host-style`: Set to `"true"` only for endpoints that require virtual-host-style addressing.
 - `sccache-key-prefix`: Optional cache key prefix. Defaults to repository, runner, and toolchain scope.
+- `sccache-wrap-cc`: Wrap `CC` and `CXX` with sccache so build-script C/C++ compiles (e.g. `libduckdb-sys`, `ring`) hit the cache too. Defaults to `"true"`. Set to `"false"` to opt out.
 
 ### Notes
 
@@ -68,6 +69,10 @@ Omit `sccache-bucket` to use the runner-local sccache cache:
   variables from workflow secrets.
 - `CARGO_INCREMENTAL=0` is set because Rust incremental artifacts are not a
   good fit for sccache-backed CI builds.
+- When `sccache-wrap-cc` is enabled, `CC` is exported as `sccache cc` and `CXX`
+  as `sccache c++`. The `cc` crate splits on whitespace, so build scripts that
+  go through it pick up the wrapper transparently. Build systems that do not
+  support multi-word `CC`/`CXX` should opt out.
 - `SCCACHE_IGNORE_SERVER_IO_ERROR=1` is set so a cache outage falls back to
   local compilation instead of failing the build.
 - `SCCACHE_IDLE_TIMEOUT=3600` keeps the server alive across long build/test