diff --git a/.github/workflows/cli-tests.yaml b/.github/workflows/cli-tests.yaml
index 20786d96ea9..a983b7aa110 100644
--- a/.github/workflows/cli-tests.yaml
+++ b/.github/workflows/cli-tests.yaml
@@ -86,7 +86,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@jl/migrate-installer
+        uses: jetify-com/devbox-install-action@v0.15.0
         with:
           enable-cache: true
       - name: Build flake
@@ -106,11 +106,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install devbox
-        uses: jetify-com/devbox-install-action@jl/migrate-installer
-        with:
-          enable-cache: true
-
+      # Must be restored before installing devbox: the install action runs our
+      # init_hook (`go install tool`), which populates ~/go/pkg/mod. Restoring
+      # the cache on top of that fails with "Cannot open: File exists".
       - name: Mount golang cache
         uses: actions/cache@v5
         with:
@@ -120,6 +118,11 @@ jobs:
             ~/go/pkg
           key: go-${{ runner.os }}-${{ hashFiles('go.sum') }}
 
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.15.0
+        with:
+          enable-cache: true
+
       - run:  devbox run lint
 
   test:
@@ -192,7 +195,7 @@ jobs:
             brew install dash zsh
           fi
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@jl/migrate-installer
+        uses: jetify-com/devbox-install-action@v0.15.0
         with:
           enable-cache: true
       - name: Setup Nix GitHub authentication