diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index af3ca377c1..302663cbf9 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -25,6 +25,39 @@ jobs:
         with:
           java-version: "25"
           distribution: "temurin"
+      # Same cache layer as backend-build.yml. Without it every run resolved the
+      # whole classpath cold and eventually got HTTP 429 from Maven Central.
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
+      # Gradle does not retry 429s, and a cold cache resolving the buildscript
+      # classpath is exactly where Maven Central rate-limits us. Retry it here,
+      # where a failure is cheap, instead of inside the backgrounded bootRun.
+      - name: Prime Gradle dependencies
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+        run: |
+          for attempt in 1 2 3; do
+            if ./gradlew --quiet -PnoSpotless :stirling-pdf:classes; then
+              exit 0
+            fi
+            echo "::warning::Gradle dependency resolution failed (attempt $attempt of 3)"
+            sleep $((attempt * 30))
+          done
+          echo "::error::Gradle could not resolve dependencies after 3 attempts"
+          exit 1
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -53,6 +86,11 @@ jobs:
           # to aggregate. Chromium-only - other engines silently skip.
           PW_COVERAGE: "1"
           PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
+          # Internal mirror, as in backend-build.yml. Empty on Dependabot and
+          # fork PRs, where the build falls back to Maven Central.
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
         run: task e2e:live
       - name: Flag flaky tests
         # Runs regardless of the test outcome: a flaky test (passed on retry)
@@ -66,6 +104,10 @@ jobs:
       - name: Generate JaCoCo report from e2e:live .exec
         if: always()
         id: live-coverage
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
         # `if: always()` so even a failed test run still produces a
         # report from whatever flows did exercise the backend before
         # the failure. The task itself tolerates a missing .exec