diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml
index fe48df729..665629ce8 100644
--- a/.github/workflows/plugin-check.yml
+++ b/.github/workflows/plugin-check.yml
@@ -16,8 +16,28 @@ jobs:
             coverage: none
             tools: wp-cli
 
+        # setup-php stores the ephemeral Actions token in ~/.composer/auth.json
+        # as a github-oauth credential. Composer rejects that token whenever it
+        # happens to contain a character its validator dislikes ("Your github
+        # oauth token for github.com contains invalid characters",
+        # composer#12076), so this step failed on roughly half of all runs
+        # depending on the token minted for that run.
+        #
+        # dist-archive-command is a PUBLIC package and needs no auth, so the
+        # fix is to delete the stored credential before installing. Clearing
+        # the env vars alone does NOT work — they are already empty here, and
+        # the credential lives on disk (verified in run 31784727273).
+        #
+        # Do NOT switch to the WP-CLI nightly to dodge this: it reports as
+        # wp-cli 3.0.0-alpha, and every released dist-archive-command requires
+        # wp-cli ^2 / ^2.13, so the install cannot resolve against it.
+        #
+        # Pinned to v3.1.0 deliberately: newest release accepting wp-cli ^2.
+        # v3.2.x requires ^2.13, which has no stable release (latest is 2.12.0).
         - name: Install latest version of dist-archive-command
-          run: wp package install wp-cli/dist-archive-command:v3.1.0
+          run: |
+            rm -f "$(composer config --global home 2>/dev/null)/auth.json"
+            wp package install wp-cli/dist-archive-command:v3.1.0
 
         - name: Build plugin
           run: |
@@ -25,8 +45,13 @@ jobs:
             mkdir build
             unzip ${{ github.event.repository.name }}.zip -d build
 
+        # v1.1.7 fixed the wp-env silent-startup failure ("Environment not
+        # initialized. Run `wp-env start` first.") that broke this job on newer
+        # runner images; v1.1.9 fixes a bundle regression in v1.1.8. Because
+        # that fix landed upstream, @wordpress/env needs no version pin here.
+        # https://github.com/WordPress/plugin-check-action/pull/590
         - name: Run plugin check
-          uses: wordpress/plugin-check-action@v1.1.5
+          uses: wordpress/plugin-check-action@v1.1.9
           with:
             build-dir: './build/${{ github.event.repository.name }}'
             exclude-checks: |