diff --git a/.github/actions/generate-tool-inventory/action.yml b/.github/actions/generate-tool-inventory/action.yml
index 0ec84fb2..6e05f6b0 100644
--- a/.github/actions/generate-tool-inventory/action.yml
+++ b/.github/actions/generate-tool-inventory/action.yml
@@ -11,7 +11,7 @@ inputs:
   allowlist:
     description: >-
       Path to the flavor's tool allowlist JSON, relative to the caller
-      repository root. The file is sparse-checked-out by this action.
+      repository root.
     required: true
   flavor:
     description: Name of the flavor the inventory is generated for
@@ -29,14 +29,6 @@ outputs:
 runs:
   using: composite
   steps:
-    # The allowlist lives in the caller repository; check out just that file so
-    # the action is self-contained and callers need no separate checkout step.
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        persist-credentials: false
-        sparse-checkout: ${{ inputs.allowlist }}
-        sparse-checkout-cone-mode: false
-        path: ${{ runner.temp }}/allowlist
     - shell: bash
       run: |
         set -Eeuo pipefail
@@ -80,6 +72,6 @@ runs:
         echo "${inventory}" | tee "${OUTPUT_FILE}"
       env:
         SBOM: ${{ inputs.sbom }}
-        ALLOWLIST: ${{ runner.temp }}/allowlist/${{ inputs.allowlist }}
+        ALLOWLIST: ${{ inputs.allowlist }}
         FLAVOR: ${{ inputs.flavor }}
         OUTPUT_FILE: ${{ inputs.output-file }}
diff --git a/.github/workflows/wc-build-push.yml b/.github/workflows/wc-build-push.yml
index 3e4b41bd..30812f73 100644
--- a/.github/workflows/wc-build-push.yml
+++ b/.github/workflows/wc-build-push.yml
@@ -282,6 +282,12 @@ jobs:
           registry-password: ${{ secrets.DOCKER_REGISTRY_PASSWORD || github.token }}
           dependency-snapshot: true
           output-file: ${{ runner.temp }}/sbom.spdx.json
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: ${{ inputs.tool-inventory-file != '' }}
+        with:
+          persist-credentials: false
+          sparse-checkout: ${{ inputs.tool-inventory-file }}
+          sparse-checkout-cone-mode: false
       - name: Generate tool inventory
         if: ${{ inputs.tool-inventory-file != '' }}
         id: generate-tool-inventory