diff --git a/.github/workflows/maven-goal/action.yml b/.github/workflows/maven-goal/action.yml
index 4cf9c6e9..3ffdb66f 100644
--- a/.github/workflows/maven-goal/action.yml
+++ b/.github/workflows/maven-goal/action.yml
@@ -20,11 +20,12 @@ runs:
   using: "composite"
   steps:
     - name: Set up JDK
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v6
       with:
         java-version-file: .java-version
         distribution: ${{ inputs.distribution }}
-        cache: 'maven'
+        # cache intentionally disabled (cache poisoning risk): shared by CI and release
+        # workflows with no per-caller toggle, so it's off everywhere. elastic/observability-robots#3261
     - run: "${COMMAND}"
       shell: ${{ inputs.shell }}
       env:
diff --git a/.mvn/maven.config b/.mvn/maven.config
index df90860a..39230e54 100644
--- a/.mvn/maven.config
+++ b/.mvn/maven.config
@@ -2,4 +2,5 @@
 -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn
 -Dhttps.protocols=TLSv1.2
 -Dmaven.wagon.http.retryHandler.count=3
--Dmaven.wagon.httpconnectionManager.ttlSeconds=25
\ No newline at end of file
+-Dmaven.wagon.httpconnectionManager.ttlSeconds=25
+-Daether.checksumPolicy=fail
\ No newline at end of file