diff --git a/.github/actions/go-cache/action.sh b/.github/actions/go-cache/action.sh
index bd584f6f1..d820740b1 100755
--- a/.github/actions/go-cache/action.sh
+++ b/.github/actions/go-cache/action.sh
@@ -23,10 +23,11 @@ if [ -z "${URL:-}" ]; then
     exit 0
 fi
 
-BIN_PATH="${RUNNER_TEMP:-/tmp}/cigocacher$(go env GOEXE)"
-go build -o "${BIN_PATH}" ./cmd/cigocacher
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+BASE_CMD="${REPO_ROOT}/tool/cigocacher --cache-dir ${CACHE_DIR} --cigocached-url ${URL} --cigocached-host ${HOST}"
 
-CIGOCACHER_TOKEN="$("${BIN_PATH}" --auth --cigocached-url "${URL}" --cigocached-host "${HOST}" )"
+CIGOCACHER_TOKEN="$("${BASE_CMD}" --auth)"
 if [ -z "${CIGOCACHER_TOKEN:-}" ]; then
     echo "Failed to fetch cigocacher token, skipping cigocacher setup"
     exit 0
@@ -35,5 +36,5 @@ fi
 echo "Fetched cigocacher token successfully"
 echo "::add-mask::${CIGOCACHER_TOKEN}"
 
-echo "GOCACHEPROG=${BIN_PATH} --cache-dir ${CACHE_DIR} --cigocached-url ${URL} --cigocached-host ${HOST} --token ${CIGOCACHER_TOKEN}" >> "${GITHUB_ENV}"
+echo "GOCACHEPROG=${BASE_CMD} --token ${CIGOCACHER_TOKEN}" >> "${GITHUB_ENV}"
 echo "success=true" >> "${GITHUB_OUTPUT}"
diff --git a/tool/cigocacher b/tool/cigocacher
new file mode 100755
index 000000000..e148bad32
--- /dev/null
+++ b/tool/cigocacher
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+#
+# Run cmd/cigocacher based on the revision pinned in tool/cigocacher.rev
+
+set -euo pipefail
+
+goos() {
+    case "$(uname -s)" in
+        Linux*)
+            echo "linux"
+            ;;
+        Darwin*)
+            echo "darwin"
+            ;;
+        MINGW*|MSYS*|CYGWIN*)
+            echo "windows"
+            ;;
+        *)
+            echo "unknown"
+            ;;
+    esac
+}
+
+goarch() {
+    local machine="$(uname -m)"
+    case "$machine" in
+        x86_64|amd64)
+            echo "amd64"
+            ;;
+        aarch64|arm64)
+            echo "arm64"
+            ;;
+        armv7l|armv6l)
+            echo "arm"
+            ;;
+        i386|i686)
+            echo "386"
+            ;;
+        *)
+            echo "$machine"
+            ;;
+    esac
+}
+
+if [[ "${CI:-}" == "true" ]]; then
+    set -x
+fi
+
+cachedir="${HOME}/.cache/tailscale-cigocacher"
+
+(
+    if [[ "${CI:-}" == "true" ]]; then
+        set -x
+    fi
+
+    SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+    repo_root="${SCRIPT_DIR}/../"
+    cd "$repo_root"
+
+    tarball="${cachedir}.tar.gz"
+
+    want_rev="$(cat ./tool/cigocacher.rev)"
+    got_rev=""
+    if [[ -x "${cachedir}/cigocacher" ]]; then
+        got_rev=$("${cachedir}/cigocacher" --version)
+    fi
+
+    if [[ "$want_rev" != "$got_rev" ]]; then
+        rm -rf "$cachedir" "$tarball"
+        mkdir -p "$cachedir"
+        curl -w "%{size_download} bytes | %{time_total}s | %{speed_download} bytes/sec\n" -fsSL -o "$tarball" \
+            "https://github.com/tailscale/tailscale/releases/download/cmd%2Fcigocacher%2F${want_rev}/cigocacher-$(goos)-$(goarch).tar.gz"
+        (cd "$cachedir" && tar -xf "$tarball")
+        rm -f "$tarball"
+    fi
+)
+
+exec "${cachedir}/cigocacher" "$@"
diff --git a/tool/cigocacher.cmd b/tool/cigocacher.cmd
new file mode 100644
index 000000000..8cf5f9afb
--- /dev/null
+++ b/tool/cigocacher.cmd
@@ -0,0 +1,5 @@
+@echo off
+@REM Allows running ./tool/cigocacher on Windows, which doesn't have the x
+@REM permission bit and shebang support that we use for Unix.
+@REM Requires Git Bash.
+bash "%~dp0cigocacher" %*
diff --git a/tool/cigocacher.rev b/tool/cigocacher.rev
new file mode 100644
index 000000000..1c5836d56
--- /dev/null
+++ b/tool/cigocacher.rev
@@ -0,0 +1 @@
+d0d993f5d6576b5d97d0242c64bbe2de049d6486
\ No newline at end of file