diff --git a/.bazelrc b/.bazelrc
index 30d9ad9d34..76f81ade40 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -29,7 +29,6 @@ common:linux --test_env=PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
 common:macos --test_env=PATH=/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
 
 # Pass through some env vars Windows needs to use powershell?
-common:windows --test_env=PATH
 common:windows --test_env=SYSTEMROOT
 common:windows --test_env=COMSPEC
 common:windows --test_env=WINDIR
diff --git a/.github/actions/setup-bazel-ci/action.yml b/.github/actions/setup-bazel-ci/action.yml
index 7c605c60b7..e249a37a5e 100644
--- a/.github/actions/setup-bazel-ci/action.yml
+++ b/.github/actions/setup-bazel-ci/action.yml
@@ -122,6 +122,77 @@ runs:
           }
         }
 
+    - name: Compute cache-stable Windows Bazel PATH
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        # Bazel action/test cache keys include PATH when it is forwarded into the
+        # execution environment. Filter the runner PATH down to the tool
+        # locations these Windows Bazel jobs actually need so hosted-image churn
+        # such as Maven updates does not invalidate otherwise reusable entries.
+        $stablePathEntries = New-Object System.Collections.Generic.List[string]
+        $seenEntries = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        $windowsAppsPath = Join-Path $env:LOCALAPPDATA 'Microsoft\WindowsApps'
+        $windowsDir = if ($env:WINDIR) { $env:WINDIR } else { $env:SystemRoot }
+
+        function Add-StablePathEntry {
+          param([string]$PathEntry)
+
+          if ([string]::IsNullOrWhiteSpace($PathEntry)) {
+            return
+          }
+
+          if ($seenEntries.Add($PathEntry)) {
+            [void]$stablePathEntries.Add($PathEntry)
+          }
+        }
+
+        foreach ($pathEntry in ($env:PATH -split ';')) {
+          if ([string]::IsNullOrWhiteSpace($pathEntry)) {
+            continue
+          }
+
+          if (
+            $pathEntry -like '*Microsoft Visual Studio*' -or
+            $pathEntry -like '*Windows Kits*' -or
+            $pathEntry -like '*Microsoft SDKs*' -or
+            $pathEntry -like 'C:\Program Files\Git\*' -or
+            $pathEntry -like 'C:\Program Files\PowerShell\*' -or
+            $pathEntry -like 'C:\hostedtoolcache\windows\node\*' -or
+            $pathEntry -eq 'D:\a\_temp\install-dotslash\bin' -or
+            ($windowsDir -and ($pathEntry -eq $windowsDir -or $pathEntry -like "${windowsDir}\*")) -or
+            ($windowsAppsPath -and $pathEntry -eq $windowsAppsPath)
+          ) {
+            Add-StablePathEntry $pathEntry
+          }
+        }
+
+        $gitCommand = Get-Command git -ErrorAction SilentlyContinue
+        if ($gitCommand) {
+          Add-StablePathEntry (Split-Path $gitCommand.Source -Parent)
+        }
+
+        $nodeCommand = Get-Command node -ErrorAction SilentlyContinue
+        if ($nodeCommand) {
+          Add-StablePathEntry (Split-Path $nodeCommand.Source -Parent)
+        }
+
+        $pwshCommand = Get-Command pwsh -ErrorAction SilentlyContinue
+        if ($pwshCommand) {
+          Add-StablePathEntry (Split-Path $pwshCommand.Source -Parent)
+        }
+
+        if (Test-Path $windowsAppsPath) {
+          Add-StablePathEntry $windowsAppsPath
+        }
+
+        if ($stablePathEntries.Count -eq 0) {
+          throw 'Failed to derive cache-stable Windows PATH.'
+        }
+
+        $stablePath = $stablePathEntries -join ';'
+        "CODEX_BAZEL_WINDOWS_PATH=$stablePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
     - name: Enable Git long paths (Windows)
       if: runner.os == 'Windows'
       shell: pwsh
diff --git a/.github/scripts/run-bazel-ci.sh b/.github/scripts/run-bazel-ci.sh
index e5376a812a..cf2d4ce340 100755
--- a/.github/scripts/run-bazel-ci.sh
+++ b/.github/scripts/run-bazel-ci.sh
@@ -306,7 +306,6 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
     INCLUDE
     LIB
     LIBPATH
-    PATH
     UCRTVersion
     UniversalCRTSdkDir
     VCINSTALLDIR
@@ -323,6 +322,17 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
       post_config_bazel_args+=("--action_env=${env_var}" "--host_action_env=${env_var}")
     fi
   done
+
+  if [[ -z "${CODEX_BAZEL_WINDOWS_PATH:-}" ]]; then
+    echo "CODEX_BAZEL_WINDOWS_PATH must be set for Windows Bazel CI." >&2
+    exit 1
+  fi
+
+  post_config_bazel_args+=(
+    "--action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+    "--host_action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+    "--test_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+  )
 fi
 
 bazel_console_log="$(mktemp)"