diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 82a22a0d4..6f4610745 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,25 +9,25 @@ on:
 jobs:
   build:
     name: Bazel Build and Test
-    # We use Ubuntu 20.04 as it comes with GCC v9.3 by default.
-    runs-on: ubuntu-20.04
+
+    runs-on: ubuntu-22.04
     env:
       BAZEL_CACHE_USER: github
       BAZEL_CACHE_PWD: ${{ secrets.BAZEL_CACHE_PWD }}
       BAZEL_CACHE_URL: pins-bazel-cache.onf.dev:9090
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     - name: Mount bazel cache
-      uses: actions/cache@v2
+      uses: actions/cache/restore@v3
       with:
         # See https://docs.bazel.build/versions/master/output_directories.html
         path: "/tmp/repo-cache"
         # See https://docs.github.com/en/actions/guides/caching-dependencies-to-speed-up-workflows
-        key: bazel-repo-cache-v1-${{ runner.os }}-${{ hashFiles('**/*_deps.bzl', '.bazelrc', '.bazelversion', 'WORKSPACE.bazel') }}
+        key: bazel-repo-cache-v3-${{ runner.os }}-${{ hashFiles('**/*_deps.bzl', '.bazelrc', '.bazelversion', 'WORKSPACE.bazel') }}
         restore-keys: |
-          bazel-repo-cache-v1-${{ runner.os }}-
+          bazel-repo-cache-v3-${{ runner.os }}-
 
     - name: Install system dependencies
       run: ./install_dependencies.sh
@@ -39,6 +39,13 @@ jobs:
           https://github.com/bazelbuild/bazelisk/releases/latest/download/bazelisk-linux-${ARCH}
         sudo chmod +x /usr/local/bin/bazel
 
+    - name: Save start time
+      uses: josStorer/get-current-time@v2
+      id: start-time
+      with:
+        # Unix timestamp -- seconds since 1970.
+        format: X
+
     # Authentication is enabled for R/W access for builds on main and branch PRs
     # Unauthenticated reads are allowed for PRs from forks
     - name: Build and Test
@@ -51,3 +58,27 @@ jobs:
         BAZEL_OPTS+=" --remote_download_minimal"
         bazel build ${BAZEL_OPTS} //...
         bazel test ${BAZEL_OPTS} //...
+
+    - name: Save end time
+      uses: josStorer/get-current-time@v2
+      id: end-time
+      with:
+        # Unix timestamp -- seconds since 1970.
+        format: X
+
+    - name: Calculate build duration
+      run: |
+        START=${{ steps.start-time.outputs.formattedTime }}
+        END=${{ steps.end-time.outputs.formattedTime }}
+        DURATION=$(( $END - $START ))
+        echo "duration=$DURATION" | tee "$GITHUB_ENV"
+
+    - name: Save bazel cache
+      uses: actions/cache/save@v3
+      # We create a new cache entry if either of the following is true:
+      # - We are on the master branch.
+      # - It took more than 5 minutes to build and test.
+      if: github.ref_name == 'main' || env.duration > 300
+      with:
+        path: "/tmp/repo-cache"
+        key: bazel-repo-cache-v3-${{ runner.os }}-${{ hashFiles('**/*_deps.bzl', '.bazelrc', '.bazelversion', 'WORKSPACE.bazel') }}
diff --git a/pins_infra_deps.bzl b/pins_infra_deps.bzl
index c8d7c81b7..d1b8b2321 100644
--- a/pins_infra_deps.bzl
+++ b/pins_infra_deps.bzl
@@ -196,6 +196,14 @@ def pins_infra_deps():
             build_file = "@//:bazel/BUILD.jsoncpp.bazel",
             sha256 = "6da6cdc026fe042599d9fce7b06ff2c128e8dd6b8b751fca91eb022bce310880",
         )
+    if not native.existing_rule("com_github_ivmai_cudd"):
+        http_archive(
+            name = "com_github_ivmai_cudd",
+            build_file = "@//:bazel/BUILD.cudd.bazel",
+            strip_prefix = "cudd-cudd-3.0.0",
+            sha256 = "5fe145041c594689e6e7cf4cd623d5f2b7c36261708be8c9a72aed72cf67acce",
+            urls = ["https://github.com/ivmai/cudd/archive/cudd-3.0.0.tar.gz"],
+        )
     if not native.existing_rule("com_gnu_gmp"):
         http_archive(
             name = "com_gnu_gmp",