diff --git a/.github/actions/setup-maven/action.yml b/.github/actions/setup-maven/action.yml
new file mode 100644
index 000000000..429f40004
--- /dev/null
+++ b/.github/actions/setup-maven/action.yml
@@ -0,0 +1,67 @@
+name: 'Set up Maven'
+description: 'Restores the Maven caches and installs the wrapper-pinned distribution.'
+
+inputs:
+  cache-read-only:
+    description: 'Restore the dependency cache without writing a branch-scoped copy of it.'
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    # Keyed on the pinned Maven version alone, so dependency updates never evict
+    # it. It is small enough to always write back, which keeps pull requests from
+    # re-fetching the distribution from repo.maven.apache.org.
+    - uses: actions/cache@v6.1.0
+      with:
+        path: ~/.m2/wrapper/dists
+        key: maven-dist-${{ runner.os }}-${{ hashFiles('.mvn/wrapper/maven-wrapper.properties') }}
+
+    # The restore keys matter more than the exact hit: a dependency bump then
+    # resolves against the previous repository and only fetches what changed,
+    # instead of pulling the whole tree from Maven Central again.
+    - if: inputs.cache-read-only != 'true'
+      uses: actions/cache@v6.1.0
+      with:
+        path: ~/.m2/repository
+        key: maven-repo-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pom.xml') }}
+        restore-keys: maven-repo-${{ runner.os }}-${{ runner.arch }}-
+
+    - if: inputs.cache-read-only == 'true'
+      uses: actions/cache/restore@v6.1.0
+      with:
+        path: ~/.m2/repository
+        key: maven-repo-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pom.xml') }}
+        restore-keys: maven-repo-${{ runner.os }}-${{ runner.arch }}-
+
+    # A cold cache is the only time this reaches the network, but a single
+    # failed fetch would otherwise take the whole job down with it.
+    - if: runner.os != 'Windows'
+      shell: bash
+      run: |
+        for attempt in 1 2 3; do
+          if ./mvnw -v; then
+            exit 0
+          fi
+          echo "Maven distribution download failed (attempt ${attempt} of 3)"
+          rm -rf ~/.m2/wrapper/dists
+          sleep $((attempt * 15))
+        done
+        echo "::error::Could not install the Maven distribution pinned in .mvn/wrapper/maven-wrapper.properties"
+        exit 1
+
+    - if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        foreach ($attempt in 1..3) {
+          ./mvnw.cmd -v
+          if ($LASTEXITCODE -eq 0) {
+            exit 0
+          }
+          Write-Host "Maven distribution download failed (attempt $attempt of 3)"
+          Remove-Item -Recurse -Force "$HOME/.m2/wrapper/dists" -ErrorAction SilentlyContinue
+          Start-Sleep -Seconds (15 * $attempt)
+        }
+        Write-Host "::error::Could not install the Maven distribution pinned in .mvn/wrapper/maven-wrapper.properties"
+        exit 1
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 59d510175..6c9570ec9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -28,3 +28,13 @@ updates:
       actions:
         patterns:
           - "*"
+
+  # "/" only covers .github/workflows, so the composite action needs its own entry.
+  - package-ecosystem: "github-actions"
+    directory: "/.github/actions/setup-maven"
+    schedule:
+      interval: "monthly"
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 06beddf18..97533b49c 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -9,12 +9,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - name: Grant Permission
-        run: chmod +x ./mvnw
       - uses: actions/setup-java@v6.0.0
         with:
           distribution: 'corretto'
           java-version: '11'
+          cache-jdk: true
+      - uses: ./.github/actions/setup-maven
       - name: Verify
         run: ./mvnw -B -ntp clean verify -DskipTests -Dgpg.skip=true
 
@@ -23,12 +23,12 @@ jobs:
     needs: Verify
     steps:
       - uses: actions/checkout@v7
-      - name: Grant Permission
-        run: chmod +x ./mvnw
       - uses: actions/setup-java@v6.0.0
         with:
           distribution: 'corretto'
           java-version: '11'
+          cache-jdk: true
+      - uses: ./.github/actions/setup-maven
       - name: Run Tests
         run: ./mvnw -B -ntp test -Ddocker.tests=true -Dexternal.tests=true
 
@@ -37,12 +37,12 @@ jobs:
     needs: Verify
     steps:
       - uses: actions/checkout@v7
-      - name: Grant Permission
-        run: chmod +x ./mvnw
       - uses: actions/setup-java@v6.0.0
         with:
           distribution: 'corretto'
           java-version: '11'
+          cache-jdk: true
+      - uses: ./.github/actions/setup-maven
       - name: Run Tests
         run: ./mvnw -B -ntp test -Dexternal.tests=true
 
@@ -55,5 +55,7 @@ jobs:
         with:
           distribution: 'corretto'
           java-version: '11'
+          cache-jdk: true
+      - uses: ./.github/actions/setup-maven
       - name: Run Tests
         run: ./mvnw.cmd -B -ntp test "-Dexternal.tests=true"
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 51c59aa47..79982e0bc 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -27,8 +27,10 @@ jobs:
         with:
           distribution: 'corretto'
           java-version: '11'
-      - name: Grant Permission
-        run: chmod +x ./mvnw
+          cache-jdk: true
+      - uses: ./.github/actions/setup-maven
+        with:
+          cache-read-only: ${{ github.event_name == 'pull_request' }}
       - name: Compile and API compatibility check
         run: ./mvnw -B -ntp clean verify -DskipTests -Dgpg.skip=true
 
@@ -55,9 +57,10 @@ jobs:
         with:
           distribution: ${{ matrix.distribution }}
           java-version: ${{ matrix.jdk }}
-      - name: Grant Permission
-        if: runner.os != 'Windows'
-        run: chmod +x ./mvnw
+          cache-jdk: true
+      - uses: ./.github/actions/setup-maven
+        with:
+          cache-read-only: ${{ github.event_name == 'pull_request' }}
       - name: Run Tests (Linux)
         if: runner.os == 'Linux'
         run: ./mvnw -B -ntp clean test -Ddocker.tests=true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae03fde50..e603dc482 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,9 +35,11 @@ jobs:
         with:
           distribution: 'corretto'
           java-version: '11'
+          cache-jdk: true
 
-      - name: Grant Permission
-        run: chmod +x ./mvnw
+      - uses: ./.github/actions/setup-maven
+        with:
+          cache-read-only: true
 
       - name: Configure Git User
         if: inputs.release == true