diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8a1b81521..aafe67450 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -83,7 +83,19 @@ jobs:
       - run: bun install --frozen-lockfile
       - name: Run Tests
         run: bun run coverage
+      # Persist the scanner CLI across runs so the action restores it from cache
+      # (tc.find short-circuits the download) instead of fetching it from the
+      # intermittently-403ing binaries.sonarsource.com on every run.
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        if: ${{ env.SONAR_TOKEN != '' }}
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          path: ${{ runner.tool_cache }}/sonar-scanner-cli
+          key: sonar-scanner-cli-${{ runner.os }}-${{ runner.arch }}-8.1.0.6389
       - uses: sonarsource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1
+        with:
+          scannerVersion: 8.1.0.6389
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}