diff --git a/.github/actions/bootstrap/action.yaml b/.github/actions/bootstrap/action.yaml
index 32fe6c9cfedba3..0d349bb552b4d7 100644
--- a/.github/actions/bootstrap/action.yaml
+++ b/.github/actions/bootstrap/action.yaml
@@ -9,10 +9,24 @@ inputs:
     description: "Bootstrap log name"
     required: false
     default: bootstrap-logs-${{ github.job }}
+outputs:
+  cache-hit:
+    description: "Bootstrap environment was restored from cache"
+    value: ${{ fromJSON(steps.bootstrap-cache.outputs.outputs).cache-hit }} # retry returns all outputs in `outputs`
 
 runs:
   using: "composite"
   steps:
+    - name: Calculate bootstrap cache key
+      id: bootstrap-cache-key
+      shell: bash
+      run: |
+        # In addition to the various setup files, the work directory matters as well.
+        set -x
+        FILES_HASH="${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}"
+        FINAL_HASH="$(echo "$PWD:$FILES_HASH" | sha256sum | cut -d' ' -f1)"
+        echo "hash=$FINAL_HASH" >> "$GITHUB_OUTPUT"
+
     - uses: Wandalen/wretry.action@v1.4.10
       name: Bootstrap from cache
       id: bootstrap-cache
@@ -22,20 +36,20 @@ runs:
         attempt_limit: 3
         attempt_delay: 2000
         with: |
-          key: ${{ runner.os }}-${{ inputs.platform }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
+          key: ${{ runner.os }}-${{ inputs.platform }}-${{ steps.bootstrap-cache-key.outputs.hash}}
           path: |
               .environment
               build_overrides/pigweed_environment.gni
 
     - name: Run bootstrap
-      if: fromJSON(steps.bootstrap-cache.outputs.outputs).cache-hit != 'true' # retry returns all outputs in `outputs`
+      if: fromJSON(steps.bootstrap-cache.outputs.outputs).cache-hit != 'true'
       env:
         PW_NO_CIPD_CACHE_DIR: Y
       shell: bash
       run: source scripts/bootstrap.sh -p all,${{ inputs.platform }}
 
     - name: Uploading bootstrap logs
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: always() && !env.ACT && fromJSON(steps.bootstrap-cache.outputs.outputs).cache-hit != 'true'
       with:
         name: ${{ inputs.bootstrap-log-name }}
diff --git a/scripts/setup/bootstrap.sh b/scripts/setup/bootstrap.sh
index d723e86f70924a..0a2a898eaf02c5 100644
--- a/scripts/setup/bootstrap.sh
+++ b/scripts/setup/bootstrap.sh
@@ -75,16 +75,6 @@ _bootstrap_or_activate() {
         unset PW_CONFIG_FILE
     fi
 
-    if [ ! -f "$_CHIP_ROOT/third_party/pigweed/repo/pw_env_setup/util.sh" ]; then
-        # Make sure our submodule remotes are correct for this revision.
-        git submodule sync --recursive
-        git submodule update --init
-    elif [ "$_BOOTSTRAP_NAME" = "bootstrap.sh" ]; then
-        # In this case, only update already checked out submodules.
-        git submodule sync --recursive
-        git submodule update
-    fi
-
     PW_BRANDING_BANNER="$_CHIP_ROOT/scripts/setup/banner.txt"
     export PW_BRANDING_BANNER
 
@@ -94,6 +84,10 @@ _bootstrap_or_activate() {
     PW_ROOT="$_CHIP_ROOT/third_party/pigweed/repo"
     export PW_ROOT
 
+    # Update or init the pigweed submodule if necessary. Don't touch any other submodules.
+    if [ "$_BOOTSTRAP_NAME" = "bootstrap.sh" -a ! -f "$_CHIP_ROOT/third_party/pigweed/repo/pw_env_setup/util.sh" ]; then
+        git submodule update --init "$_CHIP_ROOT/third_party/pigweed/repo"
+    fi
     . "$_CHIP_ROOT/third_party/pigweed/repo/pw_env_setup/util.sh"
 
     _chip_bootstrap_banner() {
@@ -105,7 +99,7 @@ _bootstrap_or_activate() {
 
     local _PW_BANNER_FUNC="_chip_bootstrap_banner"
 
-    # Force the Pigweed environment directory to be '.environment'
+    # Default the Pigweed environment directory to be '.environment'
     if [ -z "$PW_ENVIRONMENT_ROOT" ]; then
         export PW_ENVIRONMENT_ROOT="$PW_PROJECT_ROOT/.environment"
     fi