diff --git a/.github/workflows/build-one.yml b/.github/workflows/build-one.yml
index f600a36..9ccfd1c 100644
--- a/.github/workflows/build-one.yml
+++ b/.github/workflows/build-one.yml
@@ -69,12 +69,14 @@ jobs:
 
       - name: Refresh moving-ref package downloads
         run: |
-          # The monthly builder-dl cache freezes moving-ref downloads (VERSION = HEAD /
-          # branch, or the majestic-webui `dist` release asset) under a constant
-          # <pkg>-<ref>.tar.gz filename, so buildroot keeps reusing a stale tarball.
-          # Drop them so it re-fetches the current ref each run. See master.yml.
-          find /tmp/builder-dl -type f \
-            \( -name '*-HEAD.tar.gz' -o -name '*-master.tar.gz' -o -name '*-main.tar.gz' -o -name '*-dist.tar.gz' \) \
+          # The monthly builder-dl cache freezes moving-ref downloads under a constant
+          # filename, so buildroot keeps reusing a stale tarball. Drop them so it
+          # re-fetches the current ref each run. See master.yml for the rationale.
+          # Covers both the dash form (<pkg>-<ref>.tar.gz, e.g. majestic-webui-dist) and
+          # the dot form (<pkg>.<ref>.tar.bz2, e.g. majestic.t31.lite.master from S3 —
+          # a moving build with no .hash, NOT a content-addressed pin).
+          find /tmp/builder-dl -type f -regextype posix-extended \
+            -regex '.*[-.](HEAD|master|main|dist)\.tar\.(gz|bz2|xz)' \
             -print -delete 2>/dev/null || true
 
       - name: Build firmware
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 0b57d71..64a6aac 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -226,17 +226,20 @@ jobs:
         run: |
           # builder caches BR2_DL_DIR (/tmp/builder-dl) under a monthly key
           # (date +%m) and actions/cache only saves on a key miss, so the first build
-          # of the month freezes it for weeks. Packages pinned to a moving ref
-          # (VERSION = HEAD / branch, or the majestic-webui `dist` release asset)
-          # download as a constant <pkg>-<ref>.tar.gz, so buildroot keeps reusing the
-          # stale tarball — even though builder re-clones firmware HEAD each run for
-          # freshness. (Empirically: a 06-14 builder nightly shipped a ~2-week-old
-          # majestic-webui — full bootstrap.min.css, no mj-settings.js — while the
-          # firmware nightly shipped the current UI.) Drop those archives so buildroot
-          # re-fetches the current ref each run. Content-addressed packages
-          # (S3 / semver / SHA pins) keep their cache.
-          find /tmp/builder-dl -type f \
-            \( -name '*-HEAD.tar.gz' -o -name '*-master.tar.gz' -o -name '*-main.tar.gz' -o -name '*-dist.tar.gz' \) \
+          # of the month freezes it for weeks. Packages pinned to a moving ref keep a
+          # constant download filename, so buildroot reuses the stale tarball — even
+          # though builder re-clones firmware HEAD each run for freshness. Two forms:
+          #   - dash:  <pkg>-<ref>.tar.gz   e.g. majestic-webui-dist.tar.gz
+          #   - dot:   <pkg>.<ref>.tar.bz2  e.g. majestic.t31.lite.master.tar.bz2
+          # The dot form is majestic's S3 tarball: it LOOKS S3-pinned but is a moving
+          # `master` build re-uploaded every majestic CI run, with no .hash to force a
+          # refetch — so it must be evicted too. (Empirically: a 06-14 nightly shipped a
+          # ~2-week-old majestic-webui; later a t31 lite image shipped a pre-x-groups
+          # majestic against the current webui — "No settings groups in schema".) Drop
+          # both forms so buildroot re-fetches the current ref. Only genuinely
+          # content-addressed tarballs (semver / SHA in the name) keep their cache.
+          find /tmp/builder-dl -type f -regextype posix-extended \
+            -regex '.*[-.](HEAD|master|main|dist)\.tar\.(gz|bz2|xz)' \
             -print -delete 2>/dev/null || true
 
       - name: Build firmware