diff --git a/actions/android-build/action.yml b/actions/android-build/action.yml
index 783aa5c..21ba588 100644
--- a/actions/android-build/action.yml
+++ b/actions/android-build/action.yml
@@ -45,7 +45,16 @@ runs:
   steps:
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - id: build
       shell: bash
diff --git a/actions/android-setup/action.yml b/actions/android-setup/action.yml
index c3c96c0..7e99b1f 100644
--- a/actions/android-setup/action.yml
+++ b/actions/android-setup/action.yml
@@ -70,7 +70,16 @@ runs:
       if: ${{ inputs.run-codegen == 'true' }}
       id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - name: Layered codegen
       if: ${{ inputs.run-codegen == 'true' }}
diff --git a/actions/app-store-submit/action.yml b/actions/app-store-submit/action.yml
index 5688375..a5d77a1 100644
--- a/actions/app-store-submit/action.yml
+++ b/actions/app-store-submit/action.yml
@@ -47,7 +47,16 @@ runs:
 
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - shell: bash
       env:
diff --git a/actions/artifact-upload/action.yml b/actions/artifact-upload/action.yml
index 18276fe..3e76790 100644
--- a/actions/artifact-upload/action.yml
+++ b/actions/artifact-upload/action.yml
@@ -90,7 +90,16 @@ runs:
     - id: install
       if: ${{ inputs.to-s3 == 'true' }}
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - id: s3
       if: ${{ inputs.to-s3 == 'true' }}
diff --git a/actions/codegen/action.yml b/actions/codegen/action.yml
index 7ef9543..84d5f6a 100644
--- a/actions/codegen/action.yml
+++ b/actions/codegen/action.yml
@@ -71,7 +71,16 @@ runs:
     - name: Install flutter-tools CLI
       id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - name: Run layered codegen
       shell: bash
diff --git a/actions/ensure-cli/action.yml b/actions/ensure-cli/action.yml
index 9a34fe6..e6e00d6 100644
--- a/actions/ensure-cli/action.yml
+++ b/actions/ensure-cli/action.yml
@@ -23,4 +23,13 @@ runs:
   steps:
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh" "${{ inputs.version }}"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s -- "${{ inputs.version }}"
diff --git a/actions/ios-build/action.yml b/actions/ios-build/action.yml
index 007d88c..59661da 100644
--- a/actions/ios-build/action.yml
+++ b/actions/ios-build/action.yml
@@ -43,7 +43,16 @@ runs:
   steps:
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - id: build
       shell: bash
diff --git a/actions/ios-setup/action.yml b/actions/ios-setup/action.yml
index 573e1af..5954f5f 100644
--- a/actions/ios-setup/action.yml
+++ b/actions/ios-setup/action.yml
@@ -53,7 +53,16 @@ runs:
       if: ${{ inputs.run-codegen == 'true' }}
       id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - name: Layered codegen
       if: ${{ inputs.run-codegen == 'true' }}
diff --git a/actions/play-submit/action.yml b/actions/play-submit/action.yml
index d8d6b2a..bf625e7 100644
--- a/actions/play-submit/action.yml
+++ b/actions/play-submit/action.yml
@@ -50,7 +50,16 @@ runs:
 
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - name: Upload to Play
       shell: bash
diff --git a/actions/release-cut/action.yml b/actions/release-cut/action.yml
index 6e099d8..d3eae3e 100644
--- a/actions/release-cut/action.yml
+++ b/actions/release-cut/action.yml
@@ -44,7 +44,16 @@ runs:
   steps:
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - id: compute
       shell: bash
diff --git a/actions/screenshots/action.yml b/actions/screenshots/action.yml
index 8a8a887..262deff 100644
--- a/actions/screenshots/action.yml
+++ b/actions/screenshots/action.yml
@@ -60,7 +60,16 @@ runs:
   steps:
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - id: shots
       shell: bash
diff --git a/actions/testflight-submit/action.yml b/actions/testflight-submit/action.yml
index c830abf..3e2581a 100644
--- a/actions/testflight-submit/action.yml
+++ b/actions/testflight-submit/action.yml
@@ -34,7 +34,16 @@ runs:
 
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
 
     - shell: bash
       env:
diff --git a/actions/version-stamp/action.yml b/actions/version-stamp/action.yml
index f551d5f..5095453 100644
--- a/actions/version-stamp/action.yml
+++ b/actions/version-stamp/action.yml
@@ -40,7 +40,16 @@ runs:
     # step so its $GITHUB_OUTPUT path is readable by the stamp step below.
     - id: install
       shell: bash
-      run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
+      env:
+        FT_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        # github.action_path is NOT translated into the container by the GH
+        # runner under podman → a path-based call ENOENTs. Fetch the installer
+        # from the pinned ref (container/runtime-agnostic).
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
+          | bash -s --
     - id: stamp
       shell: bash
       env:
diff --git a/scripts/install-cli.sh b/scripts/install-cli.sh
index 3b955c8..e5b4206 100755
--- a/scripts/install-cli.sh
+++ b/scripts/install-cli.sh
@@ -16,12 +16,28 @@ set -euo pipefail
 
 REPO="vymalo/flutter-tools"
 
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-repo_root="$(cd "$script_dir/.." && pwd)"
+# When piped from stdin (curl | bash) there is no on-disk checkout, so BASH_SOURCE
+# is unreliable — fall back to "." and guard every repo-relative read below.
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd || echo .)"
+repo_root="$(cd "$script_dir/.." 2>/dev/null && pwd || echo .)"
 
+# Last-resort version when neither an arg, CLI_VERSION, an on-disk cli-version.txt,
+# nor FT_REF is available. Keep in sync with cli-version.txt.
+DEFAULT_CLI_VERSION="0.1.0"
+
+# Version precedence: explicit arg / CLI_VERSION → on-disk cli-version.txt (normal
+# checkout) → cli-version.txt fetched from the action ref (curl-pipe; FT_REF set by
+# the calling action = github.action_ref) → baked default.
 version="${1:-${CLI_VERSION:-}}"
 if [ -z "$version" ]; then
-  version="$(tr -d ' \t\n\r' < "$repo_root/cli-version.txt")"
+  if [ -f "$repo_root/cli-version.txt" ]; then
+    version="$(tr -d ' \t\n\r' < "$repo_root/cli-version.txt")"
+  elif [ -n "${FT_REF:-}" ]; then
+    version="$(curl --fail --silent --show-error --location --retry 3 \
+      "https://raw.githubusercontent.com/${REPO}/${FT_REF}/cli-version.txt" | tr -d ' \t\n\r')"
+  else
+    version="$DEFAULT_CLI_VERSION"
+  fi
 fi
 # Tolerate a leading `cli-v` / `v` so `v0.1.0` or `cli-v0.1.0` also resolve.
 version="${version#cli-v}"