diff --git a/codebuild/buildspec.yml b/codebuild/buildspec.yml
index 8229dfe..f97682a 100644
--- a/codebuild/buildspec.yml
+++ b/codebuild/buildspec.yml
@@ -19,6 +19,10 @@ version: 0.2
 env:
   variables:
     TF_VERSION: "1.9.8"
+    # Provider plugin cache -- warm from S3 before tf init, saved back after build
+    TF_PLUGIN_CACHE_DIR: "/root/.terraform.d/plugin-cache"
+    PROVIDER_CACHE_S3: "s3://inf-tfstate-229685449397/tf-provider-cache"
+    PROVIDER_CACHE_S3_REGION: "us-gov-east-1"
 
 phases:
 
@@ -35,6 +39,9 @@ phases:
       - chmod +x /usr/local/bin/tf
       - tf --version
       - pip3 install --quiet requests
+      - echo "Warming provider cache from S3..."
+      - mkdir -p "$TF_PLUGIN_CACHE_DIR"
+      - aws s3 sync "${PROVIDER_CACHE_S3}/" "$TF_PLUGIN_CACHE_DIR/" --region "$PROVIDER_CACHE_S3_REGION" --quiet || true
 
   pre_build:
     on-failure: ABORT
@@ -49,7 +56,7 @@ phases:
           echo "No workspace-specific backend config found; using backend.tf"
           tf init -input=false
         fi
-      - tf workspace select "$TF_WORKSPACE"
+      - tf workspace select -or-create "$TF_WORKSPACE"
       - echo "Active workspace $(tf workspace show)"
 
   build:
@@ -89,6 +96,8 @@ phases:
 
   post_build:
     commands:
+      - echo "Saving provider cache to S3..."
+      - aws s3 sync "$TF_PLUGIN_CACHE_DIR/" "${PROVIDER_CACHE_S3}/" --region "$PROVIDER_CACHE_S3_REGION" --quiet || true
       - |
         echo "Build completed at $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
       - |