diff --git a/.gitignore b/.gitignore
index f635f65..2bad5b6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,7 @@ conf
 db
 logs
 docker-compose.dev.yml
+
+# Binary e2e suite working cache: Traefik binary + compiled mock. Persisted
+# across local runs; CI runs on fresh runners so it is recreated every time.
+tests/e2e/mock/.cache/
diff --git a/tests/e2e/mock/.gitignore b/tests/e2e/mock/.gitignore
deleted file mode 100644
index c87aec2..0000000
--- a/tests/e2e/mock/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-# Cached Traefik binary and compiled mock, produced on first run.
-.cache/
diff --git a/tests/e2e/mock/README.md b/tests/e2e/mock/README.md
index ca626a5..574bef6 100644
--- a/tests/e2e/mock/README.md
+++ b/tests/e2e/mock/README.md
@@ -28,7 +28,7 @@ returns whatever decisions the test tells it to.
 
 | Component | How |
 |-----------|-----|
-| Traefik   | Binary `v3.7.1`, downloaded once and cached under `.cache/` |
+| Traefik   | Binary `v3.7.1`, downloaded into `.cache/` (reused across local runs; re-downloaded on fresh CI runners) |
 | Plugin    | Loaded via `experimental.localPlugins` from the repo root (symlinked into `plugins-local/`) |
 | LAPI      | `mocklapi` — a stdlib-only Go command (its own nested module), compiled and cached under `.cache/`, driven through `/admin` endpoints instead of `cscli` |
 | Backend   | A plain HTTP responder built into the mock |
@@ -38,8 +38,9 @@ backend `8091`.
 
 ## Running locally
 
-Prerequisites: `bash`, `curl`, `go`, `tar`. The Traefik binary is fetched and
-the mock is compiled automatically on first run (both cached under `.cache/`).
+Prerequisites: `bash`, `curl`, `go`, `tar`. On first use the Traefik binary is
+fetched and the mock is compiled into `.cache/`. That cache is reused across
+local runs; CI runs on fresh runners, so both are recreated on every CI run.
 
 ```bash
 # one scenario
diff --git a/tests/e2e/mock/lib/common.sh b/tests/e2e/mock/lib/common.sh
index fdf4cb1..3b61025 100644
--- a/tests/e2e/mock/lib/common.sh
+++ b/tests/e2e/mock/lib/common.sh
@@ -7,7 +7,8 @@
 # IPs, ban / captcha rendering), NOT Crowdsec or AppSec correctness.
 #
 # Dependencies: bash, curl, go, tar. The Traefik binary is downloaded and the
-# mock is compiled on first run (both cached), so local and CI behave the same.
+# mock is compiled into .cache/ on first use. That cache persists across local
+# runs; CI runs on fresh runners, so both are recreated on every CI run.
 
 set -euo pipefail
 
diff --git a/tests/e2e/mock/mocklapi/main.go b/tests/e2e/mock/mocklapi/main.go
index ce26619..e5cb5ac 100644
--- a/tests/e2e/mock/mocklapi/main.go
+++ b/tests/e2e/mock/mocklapi/main.go
@@ -213,7 +213,9 @@ func backendHandler() http.Handler {
 
 func main() {
 	lapiAddr := flag.String("lapi-addr", "127.0.0.1:8090", "address for the LAPI mock")
-	backendAddr := flag.String("backend-addr", "127.0.0.1:8091", "address for the backend responder")
+	// The stub upstream service Traefik proxies allowed requests to — the
+	// binary-suite equivalent of the traefik/whoami container. Not AppSec.
+	backendAddr := flag.String("backend-addr", "127.0.0.1:8091", "address of the stub upstream service Traefik proxies allowed requests to")
 	apiKey := flag.String("api-key", "e2e-mock-key", "expected X-Api-Key value")
 	flag.Parse()