In reply to @drupol:matrix.org
Yes. I'm pretty sure there's room for improvements...

I found a bit of a hack that works, but it's basically the same as sharing the COMPOSER_CACHED_DIR between runners.
On the runner I then point it to the result as the cache dir and set the env var COMPOSER_CACHE_READ_ONLY=1

{
  lib,
  php83Packages,
  root,
  stdenvNoCC,
}:
let
  fs = lib.fileset;
  sourceFiles = fs.unions [
    (root + "/composer.json")
    (root + "/composer.lock")
  ];
  composerFiles = fs.toSource {
    fileset = sourceFiles;
    inherit root;
  };
in
stdenvNoCC.mkDerivation {
  name = "composer-dev-dependencies";
  src = composerFiles;
  nativeBuildInputs = [ php83Packages.composer ];
  buildPhase = ''
    export COMPOSER_HOME=$TMPDIR
    composer install --download-only --no-interaction --no-scripts --no-ansi --no-autoloader
  '';
  installPhase = ''
    mkdir -p $out/
    cp -r $COMPOSER_HOME/cache/files $out/
  '';
  dontFixup = true;
  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
  outputHash = "sha256-b3RbFaiVPuSpG6jZjSwOjFGyWo/sSb91JLdtcIIv1C8=";
}