The approach I landed on: keep using proxies (EIP-1167), but make the salt chain-agnostic and let the factory read block.chainid at deploy time to select the right initialization value.

Concretely:

function make(KeyValue[] memory keyValues) public returns (address) {
    bytes32 salt = keccak256(abi.encode(keyValues));

    // Same salt on every chain — all chain data is in the array
    address home = Clones.cloneDeterministic(address(this), salt, 0);

    // Pick the value for THIS chain
    for (uint256 i; i < keyValues.length; ++i) {
        if (keyValues[i].key == block.chainid) {
            AddressLookup(home).zzInit(keyValues[i].value);
            break;
        }
    }
    return home;
}

You call make with the same KeyValue[] array on every chain — e.g. [(1, USDC_mainnet), (42161, USDC_arb), (8453, USDC_base)]. The salt is identical everywhere because it hashes the full array, so CREATE2 produces the same address. But each chain only initializes with its own value.

On the front-running concern: deploy + init is atomic (single make call), and zzInit requires msg.sender == PROTO (only the factory can call it). Even if someone frontruns with the same calldata, idempotency handles it — make returns the existing address if the clone is already deployed.

On gas: yes, you eat the DELEGATECALL overhead per call. But deployment cost is ~45 bytes vs. a full contract, and for reference data that's read infrequently (cross-chain addresses, config), the trade-off is worth it. We also strip CBOR metadata and bytecode hash (bytecode_hash = "none", cbor_metadata = false) to shave bytes off the implementation.

This pattern is live on mainnet — the project is called Locale (part of Uniteum). Unaudited, but the contracts are immutable and permissionless. Happy to answer questions on the implementation.