diff --git a/action.yaml b/action.yaml
index a3976da..d046d18 100644
--- a/action.yaml
+++ b/action.yaml
@@ -11,12 +11,22 @@ outputs:
 runs:
   using: 'composite'
   steps:
+    # github.action_ref is empty inside a composite action's run steps (and
+    # leaks the ref of `uses:` steps like actions/cache). github.action_path is
+    # reliable; its last segment is the ref: .../_actions/<owner>/<repo>/<ref>
+    - name: Resolve action ref
+      id: meta
+      shell: bash
+      run: |
+        AP="${{ github.action_path }}"
+        echo "version=${AP##*/}" >> "$GITHUB_OUTPUT"
+
     - name: Restore cached binary
       id: cache
       uses: actions/cache@v4
       with:
         path: /tmp/cac
-        key: cac-${{ runner.os }}-${{ runner.arch }}-${{ github.action_ref || github.ref_name }}
+        key: cac-${{ runner.os }}-${{ runner.arch }}-${{ steps.meta.outputs.version }}
 
     - name: Download pre-built binary
       id: download
@@ -24,8 +34,8 @@ runs:
       shell: bash
       continue-on-error: true
       run: |
-        VERSION="${{ github.action_ref || github.ref_name }}"
-        REPO="${{ github.action_repository }}"
+        VERSION="${{ steps.meta.outputs.version }}"
+        REPO="SecureAuthCorp/ciam-config-as-code"
 
         ARCH=$(uname -m)
         case "$ARCH" in