diff --git a/dist/cache-DoD2J4WY.js b/dist/cache-BqdT1UO_.js
similarity index 99%
rename from dist/cache-DoD2J4WY.js
rename to dist/cache-BqdT1UO_.js
index d2f15329..fa24482a 100644
--- a/dist/cache-DoD2J4WY.js
+++ b/dist/cache-BqdT1UO_.js
@@ -1,4 +1,4 @@
-import { f as debug, m as mkdirP, n as create, l as exec, w as which, o as warning, i as info, H as HttpCodes, p as HttpClientError, q as HttpClient, t as isDebug, u as setSecret, B as BearerCredentialHandler, v as rmRF, e as error } from './cleanup-DYJDrBaf.js';
+import { f as debug, m as mkdirP, l as create, n as exec, w as which, o as warning, i as info, H as HttpCodes, p as HttpClientError, q as HttpClient, t as isDebug, u as setSecret, B as BearerCredentialHandler, v as rmRF, e as error } from './cleanup-ChjhZSHu.js';
 import * as path from 'path';
 import * as crypto from 'crypto';
 import * as fs from 'fs';
diff --git a/dist/cache-BaeW9gVW.js b/dist/cache-DOeVf6hi.js
similarity index 99%
rename from dist/cache-BaeW9gVW.js
rename to dist/cache-DOeVf6hi.js
index 98c32e1c..3cbdd682 100644
--- a/dist/cache-BaeW9gVW.js
+++ b/dist/cache-DOeVf6hi.js
@@ -1,4 +1,4 @@
-import { x as commonjsGlobal, y as requireTunnel, z as getDefaultExportFromCjs, A as getAugmentedNamespace } from './cleanup-DYJDrBaf.js';
+import { x as commonjsGlobal, y as requireTunnel, z as getDefaultExportFromCjs, A as getAugmentedNamespace } from './cleanup-ChjhZSHu.js';
 import os__default from 'os';
 import crypto__default from 'crypto';
 import fs__default from 'fs';
diff --git a/dist/cleanup-DYJDrBaf.js b/dist/cleanup-ChjhZSHu.js
similarity index 99%
rename from dist/cleanup-DYJDrBaf.js
rename to dist/cleanup-ChjhZSHu.js
index 486168f7..1c1fa99c 100644
--- a/dist/cleanup-DYJDrBaf.js
+++ b/dist/cleanup-ChjhZSHu.js
@@ -34972,10 +34972,10 @@ async function getCacheProvider() {
     let cache;
     switch (cacheProvider) {
         case "github":
-            cache = await import('./cache-DoD2J4WY.js');
+            cache = await import('./cache-BqdT1UO_.js');
             break;
         case "warpbuild":
-            cache = await import('./cache-BaeW9gVW.js').then(function (n) { return n.c; });
+            cache = await import('./cache-DOeVf6hi.js').then(function (n) { return n.c; });
             break;
         default:
             throw new Error(`The \`cache-provider\` \`${cacheProvider}\` is not valid.`);
@@ -35714,4 +35714,4 @@ async function rmRF(dirName) {
     await rmRF$1(dirName);
 }
 
-export { getAugmentedNamespace as A, BearerCredentialHandler as B, CacheConfig as C, HttpCodes as H, getInput as a, exportVariable as b, cleanTargetDir as c, isCacheUpToDate as d, error as e, debug as f, getCacheProvider as g, cleanRegistry as h, info as i, cleanBin as j, cleanGit as k, exec as l, mkdirP as m, create as n, warning as o, HttpClientError as p, HttpClient as q, reportError as r, setOutput as s, isDebug as t, setSecret as u, rmRF$1 as v, which as w, commonjsGlobal as x, requireTunnel as y, getDefaultExportFromCjs as z };
+export { getAugmentedNamespace as A, BearerCredentialHandler as B, CacheConfig as C, HttpCodes as H, getInput as a, exportVariable as b, cleanTargetDir as c, isCacheUpToDate as d, error as e, debug as f, getCacheProvider as g, cleanRegistry as h, info as i, cleanBin as j, cleanGit as k, create as l, mkdirP as m, exec as n, warning as o, HttpClientError as p, HttpClient as q, reportError as r, setOutput as s, isDebug as t, setSecret as u, rmRF$1 as v, which as w, commonjsGlobal as x, requireTunnel as y, getDefaultExportFromCjs as z };
diff --git a/dist/restore.js b/dist/restore.js
index 5a77ed8a..2b2f85b9 100644
--- a/dist/restore.js
+++ b/dist/restore.js
@@ -1,4 +1,4 @@
-import { e as error, g as getCacheProvider, a as getInput, b as exportVariable, C as CacheConfig, i as info, c as cleanTargetDir, r as reportError, s as setOutput } from './cleanup-DYJDrBaf.js';
+import { e as error, g as getCacheProvider, a as getInput, b as exportVariable, C as CacheConfig, i as info, c as cleanTargetDir, r as reportError, s as setOutput } from './cleanup-ChjhZSHu.js';
 import 'os';
 import 'crypto';
 import 'fs';
diff --git a/dist/save.js b/dist/save.js
index fcebd7d6..f789cbf9 100644
--- a/dist/save.js
+++ b/dist/save.js
@@ -1,4 +1,6 @@
-import { e as error, g as getCacheProvider, a as getInput, d as isCacheUpToDate, i as info, C as CacheConfig, c as cleanTargetDir, f as debug, h as cleanRegistry, j as cleanBin, k as cleanGit, r as reportError, l as exec } from './cleanup-DYJDrBaf.js';
+import { e as error, g as getCacheProvider, a as getInput, d as isCacheUpToDate, i as info, C as CacheConfig, c as cleanTargetDir, f as debug, h as cleanRegistry, j as cleanBin, k as cleanGit, r as reportError } from './cleanup-ChjhZSHu.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 import 'os';
 import 'crypto';
 import 'fs';
@@ -15,7 +17,6 @@ import 'node:net';
 import 'node:http';
 import 'node:stream';
 import 'node:buffer';
-import 'node:util';
 import 'node:querystring';
 import 'node:events';
 import 'node:diagnostics_channel';
@@ -115,7 +116,8 @@ async function macOsWorkaround() {
     try {
         // Workaround for https://github.com/actions/cache/issues/403
         // Also see https://github.com/rust-lang/cargo/issues/8603
-        await exec("sudo", ["/usr/sbin/purge"], { silent: true });
+        // Unlike @actions/exec, execFile also rejects when spawning sudo is denied.
+        await promisify(execFile)("sudo", ["/usr/sbin/purge"]);
     }
     catch { }
 }
diff --git a/src/save.ts b/src/save.ts
index dae4a275..2c2a308a 100644
--- a/src/save.ts
+++ b/src/save.ts
@@ -1,5 +1,6 @@
 import * as core from "@actions/core";
-import * as exec from "@actions/exec";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 
 import { cleanBin, cleanGit, cleanRegistry, cleanTargetDir } from "./cleanup.js";
 import { CacheConfig, isCacheUpToDate } from "./config.js";
@@ -94,6 +95,7 @@ async function macOsWorkaround() {
   try {
     // Workaround for https://github.com/actions/cache/issues/403
     // Also see https://github.com/rust-lang/cargo/issues/8603
-    await exec.exec("sudo", ["/usr/sbin/purge"], { silent: true });
+    // Unlike @actions/exec, execFile also rejects when spawning sudo is denied.
+    await promisify(execFile)("sudo", ["/usr/sbin/purge"]);
   } catch {}
 }