diff --git a/.github/actions/setup-node-and-pnpm/action.yml b/.github/actions/setup-node-and-pnpm/action.yml
new file mode 100644
index 0000000..cb724a3
--- /dev/null
+++ b/.github/actions/setup-node-and-pnpm/action.yml
@@ -0,0 +1,16 @@
+name: Setup Node and pnpm
+description: Install the repository pnpm version and the latest Node LTS
+
+inputs:
+  cache:
+    description: Whether this job owns the pnpm cache write
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/setup@v2
+      with:
+        runtime: node@lts
+        install: false
+        cache: ${{ inputs.cache }}
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 672b295..1a81148 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -19,16 +19,10 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0 # Not needed if lastUpdated is not enabled
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+      - name: Setup pnpm and Node
+        uses: ./.github/actions/setup-node-and-pnpm
         with:
-          run_install: false
-      - name: Setup Node
-        uses: actions/setup-node@v5
-        with:
-          node-version: 'lts/*'
-          check-latest: true
-          cache: pnpm
+          cache: false # PR CI owns cache writes when both workflows run.
       - name: Setup Pages
         uses: actions/configure-pages@v4
       - name: Install dependencies
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 18af4cb..395438d 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -16,14 +16,9 @@ jobs:
           fetch-depth: 0
       - uses: nrwl/nx-set-shas@v5
         name: Derive appropriate SHAs for base and head for `nx affected` commands
-      - uses: pnpm/action-setup@v6
+      - uses: ./.github/actions/setup-node-and-pnpm
         with:
-          run_install: false
-      - uses: actions/setup-node@v5
-        with:
-          node-version: 'lts/*'
-          check-latest: true
-          cache: pnpm
+          cache: false # Release owns cache writes on release branches.
       - run: pnpm install --frozen-lockfile
       - run: pnpm nx affected --target=build --parallel=2
       - run: pnpm nx affected --target=test --parallel=2
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 60bd3aa..17461e6 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -21,14 +21,9 @@ jobs:
           persist-credentials: false
       - uses: nrwl/nx-set-shas@v5
         name: Derive appropriate SHAs for base and head for `nx affected` commands
-      - uses: pnpm/action-setup@v6
+      - uses: ./.github/actions/setup-node-and-pnpm
         with:
-          run_install: false
-      - uses: actions/setup-node@v5
-        with:
-          node-version: 'lts/*'
-          check-latest: true
-          package-manager-cache: false
+          cache: false
       - run: pnpm install --frozen-lockfile
       - run: pnpm exec commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
       - run: pnpm nx affected --target=format:check --parallel=2
@@ -49,14 +44,9 @@ jobs:
           persist-credentials: false
       - uses: nrwl/nx-set-shas@v5
         name: Derive appropriate SHAs for base and head for `nx affected` commands
-      - uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-      - uses: actions/setup-node@v5
+      - uses: ./.github/actions/setup-node-and-pnpm
         with:
-          node-version: 'lts/*'
-          check-latest: true
-          cache: pnpm
+          cache: true
       - run: pnpm install --frozen-lockfile
       - run: pnpm nx affected --target=build --parallel=3
       - run: pnpm nx affected --target=test --parallel=2
@@ -76,14 +66,9 @@ jobs:
           persist-credentials: false
       - uses: nrwl/nx-set-shas@v5
         name: Derive appropriate SHAs for base and head for `nx affected` commands
-      - uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-      - uses: actions/setup-node@v5
+      - uses: ./.github/actions/setup-node-and-pnpm
         with:
-          node-version: 'lts/*'
-          check-latest: true
-          cache: pnpm
+          cache: true
       - name: 'Create E2E env file'
         run: |
           echo FORGE_EMAIL=${{ vars.FORGE_EMAIL }} >> e2e/nx-forge-e2e/.env
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 475a4fe..399a4fe 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -30,16 +30,10 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0 # Not needed if lastUpdated is not enabled
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+      - name: Setup pnpm and Node
+        uses: ./.github/actions/setup-node-and-pnpm
         with:
-          run_install: false
-      - name: Setup Node
-        uses: actions/setup-node@v5
-        with:
-          node-version: 'lts/*'
-          check-latest: true
-          cache: pnpm
+          cache: false # Release owns cache writes when both workflows run.
       - name: Setup Pages
         uses: actions/configure-pages@v4
       - name: Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7cca85e..b798612 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,15 +24,10 @@ jobs:
         name: Checkout [main]
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v6
+      - uses: ./.github/actions/setup-node-and-pnpm
+        name: Setup pnpm and Node.js
         with:
-          run_install: false
-      - uses: actions/setup-node@v5
-        name: Setup Node.js
-        with:
-          node-version: 'lts/*'
-          check-latest: true
-          cache: pnpm
+          cache: true
       - name: 'Create E2E env file'
         run: |
           echo FORGE_EMAIL=${{ vars.FORGE_EMAIL }} >> e2e/nx-forge-e2e/.env