diff --git a/.github/actions/setup-moonbit/action.yaml b/.github/actions/setup-moonbit/action.yaml
new file mode 100644
index 00000000..9c26e7d5
--- /dev/null
+++ b/.github/actions/setup-moonbit/action.yaml
@@ -0,0 +1,44 @@
+name: Setup MoonBit
+description: Install the repository's pinned MoonBit toolchain
+
+inputs:
+  version:
+    description: MoonBit toolchain version
+    required: false
+    # v0.10.7 ICEs while compiling moonbitlang/x@0.4.43. Keep CI on the
+    # last verified compiler until an upstream release fixes that regression.
+    default: "0.10.6+80dc50f24"
+
+runs:
+  using: composite
+  steps:
+    - name: Install MoonBit CLI (Unix)
+      if: runner.os != 'Windows'
+      shell: bash
+      env:
+        MOONBIT_INSTALL_VERSION: ${{ inputs.version }}
+      run: |
+        set -euo pipefail
+        curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
+        echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+
+    - name: Install MoonBit CLI (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        MOONBIT_INSTALL_VERSION: ${{ inputs.version }}
+      run: |
+        Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
+        irm https://cli.moonbitlang.com/install/powershell.ps1 | iex
+        echo "$env:USERPROFILE\.moon\bin" |
+          Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+    - name: Report MoonBit version (Unix)
+      if: runner.os != 'Windows'
+      shell: bash
+      run: moon version --all
+
+    - name: Report MoonBit version (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: moon version --all
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e06716d..7a9b2e7c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,9 +66,7 @@ jobs:
           version: 0.4.1
           pkl-version: none
       - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
       - name: Moon update
         run: moon update
       - name: pkf run check
@@ -182,9 +180,7 @@ jobs:
           version: 0.4.1
           pkl-version: none
       - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
       - name: Moon update
         run: moon update
       - name: Build native binary for wbtests
@@ -236,9 +232,7 @@ jobs:
         with:
           submodules: true
       - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
       - name: Moon update
         run: moon update
       - name: Distributed tests
@@ -312,9 +306,7 @@ jobs:
 
       - name: Install MoonBit CLI
         if: steps.shardtests.outputs.count != '0'
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
 
       - name: Moon update
         if: steps.shardtests.outputs.count != '0'
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 6f8811a5..882cb219 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -30,9 +30,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up MoonBit
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> $GITHUB_PATH
+        uses: ./.github/actions/setup-moonbit
 
       - name: Update MoonBit dependencies
         run: |
diff --git a/.github/workflows/git-compat-random.yml b/.github/workflows/git-compat-random.yml
index 294faaec..d156af59 100644
--- a/.github/workflows/git-compat-random.yml
+++ b/.github/workflows/git-compat-random.yml
@@ -78,9 +78,7 @@ jobs:
 
       - name: Install MoonBit CLI
         if: ${{ steps.shard_guard.outputs.should_run == 'true' }}
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
 
       - name: Build git from source
         if: ${{ steps.shard_guard.outputs.should_run == 'true' }}
diff --git a/.github/workflows/js-build.yml b/.github/workflows/js-build.yml
index 2018c518..3071003a 100644
--- a/.github/workflows/js-build.yml
+++ b/.github/workflows/js-build.yml
@@ -38,9 +38,7 @@ jobs:
           bun-version: 1.3.5
 
       - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
 
       - name: Moon update
         run: moon update
diff --git a/.github/workflows/pages-demo.yml b/.github/workflows/pages-demo.yml
index 88a17b7d..44ef260a 100644
--- a/.github/workflows/pages-demo.yml
+++ b/.github/workflows/pages-demo.yml
@@ -59,9 +59,7 @@ jobs:
           bun-version: 1.3.5
 
       - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moonbit
 
       - name: Moon update
         run: moon update
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 068072a6..b61acf87 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,19 +27,8 @@ jobs:
         with:
           submodules: true
 
-      - name: Install MoonBit CLI (Unix)
-        if: runner.os != 'Windows'
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
-
-      - name: Install MoonBit CLI (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
-          irm https://cli.moonbitlang.com/install/powershell.ps1 | iex
-          echo "$env:USERPROFILE\.moon\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+      - name: Install MoonBit CLI
+        uses: ./.github/actions/setup-moonbit
 
       - name: Moon update
         run: moon update