diff --git a/.github/workflows/stubsabot.yml b/.github/workflows/stubsabot.yml
index 9996d6cab635..7ca0a0cbd7b2 100644
--- a/.github/workflows/stubsabot.yml
+++ b/.github/workflows/stubsabot.yml
@@ -28,6 +28,10 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
+          # A compromised dependency in a test job on main could poison the shared
+          # uv cache. Restoring it here could execute attacker-controlled code
+          # with access to stubsabot's SSH key and GitHub token.
+          enable-cache: false
       - name: Git config
         run: |
           git config --global user.name stubsabot