diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml
index f6fcbca..8d02788 100644
--- a/.gitea/workflows/terraform.yml
+++ b/.gitea/workflows/terraform.yml
@@ -98,6 +98,12 @@ jobs:
       - name: Configure module registry auth
         run: |
           git config --global url."https://gitlab-module-pull:${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
+      - name: Clear stale terragrunt cache
+        # .terragrunt-cache is gitignored - a persistent workspace/runner never
+        # gets it cleaned by checkout, so a stale generated provider.tf can
+        # survive across runs even after terragrunt.hcl changes upstream.
+        run: |
+          find live -type d -name '.terragrunt-cache' -prune -exec rm -rf {} \;
       - name: Decrypt secret values
         # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
         # (checkout, kubeconfig, terragrunt run) never sees it.
@@ -159,6 +165,12 @@ jobs:
       - name: Configure module registry auth
         run: |
           git config --global url."https://gitlab-module-pull:${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
+      - name: Clear stale terragrunt cache
+        # .terragrunt-cache is gitignored - a persistent workspace/runner never
+        # gets it cleaned by checkout, so a stale generated provider.tf can
+        # survive across runs even after terragrunt.hcl changes upstream.
+        run: |
+          find live -type d -name '.terragrunt-cache' -prune -exec rm -rf {} \;
       - name: Decrypt secret values
         # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
         # (checkout, kubeconfig, terragrunt run) never sees it.
@@ -221,6 +233,12 @@ jobs:
       - name: Configure module registry auth
         run: |
           git config --global url."https://gitlab-module-pull:${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
+      - name: Clear stale terragrunt cache
+        # .terragrunt-cache is gitignored - a persistent workspace/runner never
+        # gets it cleaned by checkout, so a stale generated provider.tf can
+        # survive across runs even after terragrunt.hcl changes upstream.
+        run: |
+          find live -type d -name '.terragrunt-cache' -prune -exec rm -rf {} \;
       - name: Decrypt secret values
         # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
         # (checkout, kubeconfig, terragrunt run) never sees it.