diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4effa589a8..e6947063ff 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,7 +22,15 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '21'
-          cache: 'gradle'
+
+      # 캐싱 소유자는 setup-gradle 하나 — setup-java 의 cache: gradle 은 정책 테스트
+      # (supply-chain-policy.test.mjs)가 금지한다. wrapper 검증도 여기서 fail-closed.
+      - name: Set up Gradle and validate wrapper
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        with:
+          cache-provider: basic
+          cache-read-only: true
+          validate-wrappers: true
 
       - name: Run Ktlint
         uses: ScaCap/action-ktlint@master