diff --git a/.github/actions/setup-wp-cli/action.yml b/.github/actions/setup-wp-cli/action.yml
new file mode 100644
index 0000000000000..de72c0ffaa1f3
--- /dev/null
+++ b/.github/actions/setup-wp-cli/action.yml
@@ -0,0 +1,50 @@
+name: 'Set up WP-CLI'
+description: 'Installs WP-CLI as `wp`, retrying the download and falling back to a previously cached phar when it fails.'
+
+inputs:
+  version:
+    description: 'Optional. The WP-CLI version to install, e.g. 2.4.0. Defaults to the latest release.'
+    required: false
+    default: 'latest'
+
+# Not installed with the setup-php `tools` input: that downloads WP-CLI in a single attempt
+# and only logs an error on failure, so the job breaks later with `wp: command not found`.
+# The phar is cached in 6 hour windows, so jobs keep getting new WP-CLI releases without each
+# downloading it. When a new window's download fails, the previous window's phar is used instead.
+runs:
+  using: 'composite'
+  steps:
+    - name: Get the WP-CLI cache window
+      id: get-wp-cli-window
+      shell: bash
+      run: echo "window=$(( $(/bin/date -u '+%s') / WP_CLI_CACHE_SECONDS ))" >> "$GITHUB_OUTPUT"
+      env:
+        WP_CLI_CACHE_SECONDS: 21600 # 6 hours.
+
+    - name: Cache WP-CLI
+      id: cache-wp-cli
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ runner.temp }}/wp-cli.phar
+        key: ${{ runner.os }}-wp-cli-${{ inputs.version }}-${{ steps.get-wp-cli-window.outputs.window }}
+        restore-keys: ${{ runner.os }}-wp-cli-${{ inputs.version }}-
+
+    - name: Install WP-CLI
+      shell: bash
+      run: |
+        if [ "$CACHE_HIT" != 'true' ]; then
+          if curl --fail --silent --show-error --location --retry 5 --retry-all-errors \
+            --output "${RUNNER_TEMP}/wp-cli.phar.download" "$WP_CLI_URL"; then
+            mv "${RUNNER_TEMP}/wp-cli.phar.download" "${RUNNER_TEMP}/wp-cli.phar"
+          elif [ -f "${RUNNER_TEMP}/wp-cli.phar" ]; then
+            echo "::warning::Could not download WP-CLI, using the previously cached version."
+          else
+            echo "::error::Could not download WP-CLI."
+            exit 1
+          fi
+        fi
+        sudo install -m 0755 "${RUNNER_TEMP}/wp-cli.phar" /usr/local/bin/wp
+        wp --version
+      env:
+        CACHE_HIT: ${{ steps.cache-wp-cli.outputs.cache-hit }}
+        WP_CLI_URL: ${{ inputs.version == 'latest' && 'https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar' || format('https://github.com/wp-cli/wp-cli/releases/download/v{0}/wp-cli-{0}.phar', inputs.version) }}
diff --git a/.github/workflows/install-testing.yml b/.github/workflows/install-testing.yml
index ed0446e4e083e..cae924ec198f4 100644
--- a/.github/workflows/install-testing.yml
+++ b/.github/workflows/install-testing.yml
@@ -12,6 +12,7 @@ on:
       - trunk
     # Always test the workflow after it's updated.
     paths:
+      - '.github/actions/setup-wp-cli/**'
       - '.github/actions/smoke-check/**'
       - '.github/workflows/install-testing.yml'
       - '.version-support-*.json'
@@ -19,6 +20,7 @@ on:
   pull_request:
     # Always test the workflow when changes are suggested.
     paths:
+      - '.github/actions/setup-wp-cli/**'
       - '.github/actions/smoke-check/**'
       - '.version-support-*.json'
       - '.github/workflows/install-testing.yml'
@@ -131,7 +133,19 @@ jobs:
         with:
           php-version: '${{ matrix.php }}'
           coverage: none
-          tools: ${{ contains( fromJSON('["5.4", "5.5"]'), matrix.php ) && 'wp-cli:2.4.0' || 'wp-cli' }}
+
+      # This job does not check out the repository, so only fetch the action.
+      - name: Check out the WP-CLI setup action
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          path: ci-tools
+          sparse-checkout: .github/actions/setup-wp-cli
+          persist-credentials: false
+
+      - name: Set up WP-CLI
+        uses: ./ci-tools/.github/actions/setup-wp-cli
+        with:
+          version: ${{ contains( fromJSON('["5.4", "5.5"]'), matrix.php ) && '2.4.0' || 'latest' }}
 
       - name: Download WordPress
         run: wp core download --version="${WP_VERSION}"
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index 808f299208bc6..cc555cf9ef0e7 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -44,6 +44,7 @@ on:
       - 'tools/vendors/**'
       - 'tools/webpack/**'
       - '.github/actions/setup-npm/**'
+      - '.github/actions/setup-wp-cli/**'
       - '.github/workflows/performance.yml'
       - '.github/workflows/reusable-performance-*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/reusable-performance-test-v2.yml b/.github/workflows/reusable-performance-test-v2.yml
index 6b0e43e136c37..fb4f9898d92d2 100644
--- a/.github/workflows/reusable-performance-test-v2.yml
+++ b/.github/workflows/reusable-performance-test-v2.yml
@@ -140,9 +140,12 @@ jobs:
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ inputs.php-version }}
-          tools: wp-cli
           coverage: none
 
+      - name: Set up WP-CLI
+        if: ${{ inputs.subject == 'base' }}
+        uses: ./.github/actions/setup-wp-cli
+
       - name: Log debug information
         run: |
           npm --version
diff --git a/.github/workflows/reusable-upgrade-testing.yml b/.github/workflows/reusable-upgrade-testing.yml
index 95645aee79981..8ea7fbbc5ae7c 100644
--- a/.github/workflows/reusable-upgrade-testing.yml
+++ b/.github/workflows/reusable-upgrade-testing.yml
@@ -89,7 +89,17 @@ jobs:
         with:
           php-version: '${{ inputs.php }}'
           coverage: none
-          tools: wp-cli
+
+      # This job does not check out the repository, so only fetch the action.
+      - name: Check out the WP-CLI setup action
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          path: ci-tools
+          sparse-checkout: .github/actions/setup-wp-cli
+          persist-credentials: false
+
+      - name: Set up WP-CLI
+        uses: ./ci-tools/.github/actions/setup-wp-cli
 
       - name: Download WordPress ${{ inputs.wp }}
         run: wp core download --version="${WP_VERSION}"
diff --git a/.github/workflows/upgrade-develop-testing.yml b/.github/workflows/upgrade-develop-testing.yml
index eb9046a273ed5..e097bac30c24f 100644
--- a/.github/workflows/upgrade-develop-testing.yml
+++ b/.github/workflows/upgrade-develop-testing.yml
@@ -14,6 +14,7 @@ on:
       - 'src/**.php'
       - '*.php' # PHP files in the root, like wp-config-sample.php.
       # Confirm any changes to relevant workflow files.
+      - '.github/actions/setup-wp-cli/**'
       - '.github/actions/smoke-check/**'
       - '.github/actions/setup-npm/**'
       - '.github/workflows/upgrade-develop-testing.yml'
@@ -29,6 +30,7 @@ on:
       - '*.php' # PHP files in the root, like wp-config-sample.php.
       # Confirm any changes to relevant workflow files.
       - '.github/actions/setup-npm/**'
+      - '.github/actions/setup-wp-cli/**'
       - '.github/workflows/upgrade-develop-testing.yml'
       - '.github/workflows/reusable-upgrade-testing.yml'
   schedule:
diff --git a/.github/workflows/upgrade-testing.yml b/.github/workflows/upgrade-testing.yml
index d25bfb7271615..f7462c1946b83 100644
--- a/.github/workflows/upgrade-testing.yml
+++ b/.github/workflows/upgrade-testing.yml
@@ -9,6 +9,7 @@ on:
       - trunk
     # Always test the workflow after it's updated.
     paths:
+      - '.github/actions/setup-wp-cli/**'
       - '.github/actions/smoke-check/**'
       - '.github/workflows/upgrade-testing.yml'
       - '.github/workflows/reusable-upgrade-testing.yml'
@@ -18,6 +19,7 @@ on:
       - trunk
     # Always test the workflow when changes are suggested.
     paths:
+      - '.github/actions/setup-wp-cli/**'
       - '.github/workflows/upgrade-testing.yml'
       - '.github/workflows/reusable-upgrade-testing.yml'
   workflow_dispatch: