diff --git a/.github/workflows/__zstd-bundle-fallback.yml b/.github/workflows/__zstd-bundle-fallback.yml
index d495f2126f..fe927ca5a7 100644
--- a/.github/workflows/__zstd-bundle-fallback.yml
+++ b/.github/workflows/__zstd-bundle-fallback.yml
@@ -60,8 +60,13 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        run: |
-          rm -rf $RUNNER_TOOL_CACHE/CodeQL
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
+            fs.rmdirSync(codeqlPath, { recursive: true });
       - id: init
         uses: ./../action/init
         with:
diff --git a/.github/workflows/__zstd-bundle.yml b/.github/workflows/__zstd-bundle.yml
index f43ae77834..e6c8a81b73 100644
--- a/.github/workflows/__zstd-bundle.yml
+++ b/.github/workflows/__zstd-bundle.yml
@@ -60,8 +60,13 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        run: |
-          rm -rf $RUNNER_TOOL_CACHE/CodeQL
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
+            fs.rmdirSync(codeqlPath, { recursive: true });
       - id: init
         uses: ./../action/init
         with:
diff --git a/pr-checks/checks/zstd-bundle-fallback.yml b/pr-checks/checks/zstd-bundle-fallback.yml
index 4b8f424557..fdca2be318 100644
--- a/pr-checks/checks/zstd-bundle-fallback.yml
+++ b/pr-checks/checks/zstd-bundle-fallback.yml
@@ -11,8 +11,13 @@ env:
   CODEQL_ACTION_FORCE_ZSTD_FAILURE: true
 steps:
   - name: Remove CodeQL from toolcache
-    run: |
-      rm -rf $RUNNER_TOOL_CACHE/CodeQL
+    uses: actions/github-script@v7
+    with:
+      script: |
+        const fs = require('fs');
+        const path = require('path');
+        const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
+        fs.rmdirSync(codeqlPath, { recursive: true });
   - id: init
     uses: ./../action/init
     with:
diff --git a/pr-checks/checks/zstd-bundle.yml b/pr-checks/checks/zstd-bundle.yml
index 6affcbc7d9..b6403c53fa 100644
--- a/pr-checks/checks/zstd-bundle.yml
+++ b/pr-checks/checks/zstd-bundle.yml
@@ -10,8 +10,13 @@ env:
   CODEQL_ACTION_ZSTD_BUNDLE: true
 steps:
   - name: Remove CodeQL from toolcache
-    run: |
-      rm -rf $RUNNER_TOOL_CACHE/CodeQL
+    uses: actions/github-script@v7
+    with:
+      script: |
+        const fs = require('fs');
+        const path = require('path');
+        const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
+        fs.rmdirSync(codeqlPath, { recursive: true });
   - id: init
     uses: ./../action/init
     with: