diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml
index eaafbf9..2eb6a7d 100644
--- a/.github/workflows/plugin-check.yml
+++ b/.github/workflows/plugin-check.yml
@@ -17,8 +17,28 @@ jobs:
             coverage: none
             tools: wp-cli
 
+        # setup-php stores the ephemeral Actions token in ~/.composer/auth.json
+        # as a github-oauth credential. Composer rejects that token whenever it
+        # happens to contain a character its validator dislikes ("Your github
+        # oauth token for github.com contains invalid characters",
+        # composer#12076), so this step failed on roughly half of all runs
+        # depending on the token minted for that run.
+        #
+        # dist-archive-command is a PUBLIC package and needs no auth, so the
+        # fix is to delete the stored credential before installing. Clearing
+        # the env vars alone does NOT work — they are already empty here, and
+        # the credential lives on disk (verified in progress-planner run 31784727273).
+        #
+        # Do NOT switch to the WP-CLI nightly to dodge this: it reports as
+        # wp-cli 3.0.0-alpha, and every released dist-archive-command requires
+        # wp-cli ^2 / ^2.13, so the install cannot resolve against it.
+        #
+        # Pinned to v3.1.0 deliberately: newest release accepting wp-cli ^2.
+        # v3.2.x requires ^2.13, which has no stable release (latest is 2.12.0).
         - name: Install latest version of dist-archive-command
-          run: wp package install wp-cli/dist-archive-command:^3.1
+          run: |
+            rm -f "$(composer config --global home 2>/dev/null)/auth.json"
+            wp package install wp-cli/dist-archive-command:v3.1.0
 
         - name: Build plugin
           run: |
@@ -26,8 +46,13 @@ jobs:
             mkdir build
             unzip ${{ github.event.repository.name }}.zip -d build
 
+        # v1.1.7 fixed the wp-env silent-startup failure ("Environment not
+        # initialized. Run `wp-env start` first.") that broke this job on newer
+        # runner images; v1.1.9 fixes a bundle regression in v1.1.8. Because
+        # that fix landed upstream, @wordpress/env needs no version pin here.
+        # https://github.com/WordPress/plugin-check-action/pull/590
         - name: Run plugin check
-          uses: wordpress/plugin-check-action@v1.1.5
+          uses: wordpress/plugin-check-action@v1.1.9
           with:
             exclude-checks: 'i18n_usage'
-            build-dir: './build/${{ github.event.repository.name }}'
\ No newline at end of file
+            build-dir: './build/${{ github.event.repository.name }}'
diff --git a/readme.txt b/readme.txt
index 3617600..3e8cf47 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Tags: comments, comment moderation, comment emails, discussion, comment policy
 Text Domain: yoast-comment-hacks
 Stable tag: 2.1.7
 Requires at least: 6.7
-Tested up to: 6.9
+Tested up to: 7.1
 Requires PHP: 7.4
 License: GPL-3.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html