diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6be943d6..2bf5e80f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -127,17 +127,11 @@ jobs:
       - name: Build baton-ipa
         run: go build ./cmd/baton-ipa
 
-      # scripts/get-baton.sh resolves the release through an unauthenticated API
-      # call, which is rate limited on shared runner IPs. Use the workflow token.
       - name: Install baton
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          gh release download --repo ConductorOne/baton \
-            --pattern 'baton-*-linux-amd64.tar.gz' --output baton.tar.gz --clobber
-          tar xzf baton.tar.gz
-          ./baton --version
+        uses: ConductorOne/github-workflows/actions/get-baton@v4
+
+      - name: Check baton version
+        run: baton --version
 
       # CXP-842 regression guard. Every assertion below is a grant or
       # entitlement the connector can only produce by resolving an LDAP DN from
@@ -159,7 +153,7 @@ jobs:
 
           assert_grant() {
             local entitlement="$1" principal="$2"
-            if ! ./baton grants --file=sync.c1z --entitlement="$entitlement" --output-format=json \
+            if ! baton grants --file=sync.c1z --entitlement="$entitlement" --output-format=json \
               | jq --exit-status --arg p "$principal" \
                 'any(.grants[]?; .principal.id.resource == $p)' >/dev/null; then
               echo "::error::no grant of '$entitlement' to '$principal'"
@@ -170,7 +164,7 @@ jobs:
 
           assert_entitlement() {
             local entitlement="$1"
-            if ! ./baton entitlements --file=sync.c1z --output-format=json \
+            if ! baton entitlements --file=sync.c1z --output-format=json \
               | jq --exit-status --arg id "$entitlement" \
                 'any(.entitlements[]?; .entitlement.id == $id)' >/dev/null; then
               echo "::error::entitlement '$entitlement' was not synced"