diff --git a/images/ci/Dockerfile.prebuild b/images/ci/Dockerfile.prebuild
index 7aaeb632b3bb037bc1b191587644c96602d051f2..0de15b2c00a9edf8ca9561374460d99b227df6b1 100644
--- a/images/ci/Dockerfile.prebuild
+++ b/images/ci/Dockerfile.prebuild
@@ -91,6 +91,10 @@ WORKDIR /home/tezos
 COPY --chown=tezos:tezos scripts/create_opam_repo.sh scripts/version.sh octez-deps.opam.locked ./
 
 COPY --chown=tezos:tezos stdcompat.opam.locked ./
+COPY --chown=tezos:tezos scripts/kiss-fetch.sh /tmp/
+
+ENV OPAMFETCH="/tmp/kiss-fetch.sh"
+ENV KISSCACHE="http://kisscache.kisscache.svc.cluster.local"
 
 # Run the script, then clean up; we only need the result of the script (the opam repository).
 RUN ./create_opam_repo.sh \
diff --git a/images/ci/scripts/create_opam_repo.sh b/images/ci/scripts/create_opam_repo.sh
index 403567d0bdfb636c8361e64ecac5f952ae4ef585..329935795696468393b30bddc1d170d66dc9eae0 100755
--- a/images/ci/scripts/create_opam_repo.sh
+++ b/images/ci/scripts/create_opam_repo.sh
@@ -2,6 +2,12 @@
 
 set -eu
 
+# use opam proxy, if available
+# shellcheck disable=SC2034
+OPAMFETCH="/tmp/kiss-fetch.sh"
+# shellcheck disable=SC2034
+KISSCACHE="http://kisscache.kisscache.svc.cluster.local"
+
 # When running the script manually, version.sh is in: scripts/
 # But in the Dockerfile, the script is copied to: ./
 if [ -e scripts/version.sh ]; then
diff --git a/images/ci/scripts/kiss-fetch.sh b/images/ci/scripts/kiss-fetch.sh
new file mode 120000
index 0000000000000000000000000000000000000000..7aac704fd8a6c445bbe4940434ce9636b9278d1f
--- /dev/null
+++ b/images/ci/scripts/kiss-fetch.sh
@@ -0,0 +1 @@
+../../../scripts/kiss-fetch.sh
\ No newline at end of file
diff --git a/scripts/kiss-fetch.sh b/scripts/kiss-fetch.sh
new file mode 100755
index 0000000000000000000000000000000000000000..3958bf21c782772f141bdddcf2e5af79d0c304d8
--- /dev/null
+++ b/scripts/kiss-fetch.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# This script is a wrapper for opam to use
+# a kisscache server, for example located at
+# http://localhost:8001/api/v1/fetch/?url=
+
+# kisscache: https://gitlab.com/Linaro/kisscache
+
+# To enable this wrapper
+#
+# export OPAMFETCH="scripts/kiss-fetch.sh"
+#
+# before invoking opam
+#
+# Use the evn var KISSCACHE to specify a remote kisscache server.
+
+KISSCACHE=${KISSCACHE:-http://localhost:8001}
+
+# Original URL passed by opam
+original_url=${*: -1}
+arguments=${*:1:$#-1}
+
+# Mangle the URL by prepending the base URL
+encoded_url=$(echo "$original_url" | sed 's/ /%20/g; s/?/%3F/g; s/&/%26/g; s/=/%3D/g; s/#/%23/g; s/</%3C/g; s/>/%3E/g; s/"/%22/g; s/\//%2F/g; s/:/%3A/g')
+mangled_url="${KISSCACHE}/api/v1/fetch?url=${encoded_url}"
+
+# shellcheck disable=SC2086
+if curl --output /dev/null --silent --head --fail "$KISSCACHE"; then
+  # Use curl to fetch the mangled URL
+  echo "curl -L $arguments $mangled_url" >> /tmp/kiss.log
+  curl -L $arguments $mangled_url
+else
+  echo "Kisscache server unreachable, falling back to fetch using mangled URL" >> /tmp/kiss.log
+  curl -L $arguments $mangled_url
+fi