diff --git a/setup-certificate-1p/action.yml b/setup-certificate-1p/action.yml
index 050f861..c94bdda 100644
--- a/setup-certificate-1p/action.yml
+++ b/setup-certificate-1p/action.yml
@@ -13,8 +13,47 @@ inputs:
 runs:
   using: composite
   steps:
+    # 1password/install-cli-action calls https://app-updates.agilebits.com/latest to resolve "latest"
+    # to a concrete version, and that endpoint has degraded before (see
+    # https://github.com/1Password/install-cli-action/issues/42). Resolve the version ourselves so we
+    # can fall back to the S3-backed changelog page on releases.1password.com when the primary
+    # resolver is down, and pass a concrete version to the install action.
+    - name: Resolve 1Password CLI version
+      id: opVersion
+      shell: bash
+      run: |
+        set -uo pipefail
+        version=""
+
+        if resp=$(curl -sSf -m 10 https://app-updates.agilebits.com/latest 2>/dev/null); then
+          version=$(echo "$resp" | jq -r '.CLI2.release.version // empty')
+        fi
+
+        if [ -z "$version" ]; then
+          echo "::warning title=1Password /latest endpoint degraded::Falling back to changelog scrape at releases.1password.com. See https://github.com/1Password/install-cli-action/issues/42"
+          # Anchor on the per-release id=1password-cli-X.Y.Z headings on the changelog page.
+          # A looser number-shaped regex over the whole page also matches SVG path coordinates
+          # (e.g. 2.85714286.0), which would then be handed to the install action and 404.
+          # sort -V is GNU-only; the composite action runs on macOS (BSD sort) too,
+          # so compare numerically across the three dotted fields with POSIX sort.
+          version=$(curl -sSf -m 10 https://releases.1password.com/developers/cli/ 2>/dev/null \
+                    | grep -oE '1password-cli-[0-9]+\.[0-9]+\.[0-9]+' \
+                    | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' \
+                    | sort -u -t. -k1,1n -k2,2n -k3,3n | tail -1)
+        fi
+
+        if [ -z "$version" ]; then
+          echo "::error::Unable to determine 1Password CLI version from any source"
+          exit 1
+        fi
+
+        echo "Resolved op CLI version: $version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Install 1Password CLI
       uses: 1password/install-cli-action@9a0c9dd934086b7ab1d90115d455bda1c53c2bdb
+      with:
+        version: ${{ steps.opVersion.outputs.version }}
       env:
         OP_SERVICE_ACCOUNT_TOKEN: ${{ inputs.OP_SERVICE_ACCOUNT_TOKEN }}