diff --git a/scripts/artifact-publish.mjs b/scripts/artifact-publish.mjs
index c464da63..99bdf45b 100644
--- a/scripts/artifact-publish.mjs
+++ b/scripts/artifact-publish.mjs
@@ -951,9 +951,9 @@ function envReuseDockerfile(baseImage, labels = [], recipe, service = null) {
     ...labels.map(([name, value]) => `LABEL ${name}=${dockerfileQuote(value)}`),
     "COPY package.json ./package.json",
     "COPY package-lock.json* ./",
-    ...(goCacheEnabled ? ["COPY go.mod ./go.mod", "COPY go.sum* ./"] : []),
     `RUN ${downloadEnvPrefix}${osPackageScript}`,
     `RUN ${downloadEnvPrefix}${downloadDependencyScript}`,
+    ...(goCacheEnabled ? ["COPY go.mod ./go.mod", "COPY go.sum* ./"] : []),
     ...(goDownloadScript ? [goDownloadScript] : []),
     `COPY ${normalizedRecipe.launcherPath} /usr/local/bin/hwlab-env-reuse-launcher.ts`,
     `RUN ${readinessScript}`,
diff --git a/scripts/ci-plan.test.mjs b/scripts/ci-plan.test.mjs
index d3a9ddb0..8957b4dc 100644
--- a/scripts/ci-plan.test.mjs
+++ b/scripts/ci-plan.test.mjs
@@ -362,6 +362,7 @@ test("artifact reuse paths preserve catalog provenance instead of current planne
   const artifactPublish = await readFile("scripts/artifact-publish.mjs", "utf8");
   assert.match(artifactPublish, /downloadDependencyScript/u);
   assert.match(artifactPublish, /RUN \$\{downloadEnvPrefix\}\$\{downloadDependencyScript\}/u);
+  assert.match(artifactPublish, /RUN \$\{downloadEnvPrefix\}\$\{downloadDependencyScript\}`,[\s\S]{0,120}\["COPY go\.mod \.\/go\.mod", "COPY go\.sum\* \.\/"\]/u);
   assert.match(artifactPublish, /ln -sf "\$\{runtimeRoot\}\/\$bun_bin" \/usr\/local\/bin\/bun/u);
   assert.doesNotMatch(artifactPublish, /RUN \$\{dependencyScript\}/u);
   assert.match(artifactPublish, /const catalogProvenance = serviceImageCatalogProvenance\(catalogService\);/u);