diff --git a/.github/workflows/reusable-ci.yaml b/.github/workflows/reusable-ci.yaml
index 2929ffb6..5297c8d2 100644
--- a/.github/workflows/reusable-ci.yaml
+++ b/.github/workflows/reusable-ci.yaml
@@ -31,6 +31,7 @@ jobs:
         uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: "${{ inputs.tool-directory }}/go.mod"
+          cache-dependency-path: '${{ inputs.tool-directory }}/go.sum'
 
       # Linting
       - name: Install golangci-lint
diff --git a/tools/env-loader/action.yaml b/tools/env-loader/action.yaml
new file mode 100644
index 00000000..751057f5
--- /dev/null
+++ b/tools/env-loader/action.yaml
@@ -0,0 +1,78 @@
+---
+name: Load environment values
+description: Load environment values
+
+inputs:
+  environments-directory:
+    description: Path to the directory containing environments files, defaulting to repo root
+  environment-name:
+    description: Name of the environment to load
+  value-sets:
+    description: Name of the value sets to load, separated by new line
+  tool-version:
+    description: Version of the tool to use
+
+runs:
+  using: "composite"
+  steps:
+    # This cannot be implemented within another tool unless it is written as a
+    # typescript action. This logic must be able to run on all platforms,
+    # with only the tools already available on the system.
+    - name: Install the tool
+      shell: bash
+      env:
+        DEFAULT_TOOL_VERSION: ${{ github.action_ref }}
+        TOOL_VERSION: ${{ inputs.tool-version }}
+        INSTALL_DIR: /opt/bin
+        TOOL_NAME: env-loader
+      run: |
+        # Build the download URL
+        case "${RUNNER_OS}" in
+          Linux)    OS='linux' ;;
+          Windows)  OS='windows' ;;
+          macOS)    OS='darwin' ;;
+          *)        echo "Unsupported runner OS ${RUNNER_OS}" >&2; exit 1 ;;
+        esac
+
+        case "${RUNNER_ARCH}" in
+          X86)    ARCH='i386' ;;
+          X64)    ARCH='amd64' ;;
+          ARM)    ARCH='arm' ;;
+          ARM64)  ARCH='arm64' ;;
+          *)      echo "Unsupported runner architecture ${RUNNER_ARCH}" >&2; exit 1 ;;
+        esac
+
+        if [[ -z "${TOOL_VERSION}" ]]; then
+          TOOL_VERSION="${DEFAULT_TOOL_VERSION##tools/${TOOL_NAME}/}"
+        fi
+
+        TAG="tools/${TOOL_NAME}/${TOOL_VERSION}"
+        URL_ENCODED_TAG="$(jq -rn --arg TAG "${TAG}" '$TAG|@uri')"
+        FILE_NAME="${TOOL_NAME}-${TOOL_VERSION}-${OS}-${ARCH}.tar.gz"
+        DOWNLOAD_URL="https://github.com/gravitational/shared-workflows/releases/download/${URL_ENCODED_TAG}/${FILE_NAME}"
+
+        # Download the tool
+        export TMPDIR="${RUNNER_TEMP}"
+        DOWNLOAD_DIR="$(mktemp -d -t "${TOOL_NAME}-XXXXXX")"
+        DOWNLOAD_PATH="${DOWNLOAD_DIR}/${TOOL_NAME}.tar.gz"
+        echo "Downloading ${TOOL_NAME} ${TOOL_VERSION} for ${OS}/${ARCH} from ${DOWNLOAD_URL} to ${DOWNLOAD_PATH}..."
+        curl -fsSL -o "${DOWNLOAD_PATH}" "${DOWNLOAD_URL}"
+        echo "Download complete"
+
+        # Install the tool
+        echo "Installing to ${INSTALL_DIR}..."
+        mkdir -pv "${INSTALL_DIR}"
+        tar -xzvf "${DOWNLOAD_PATH}" -C "${INSTALL_DIR}" "${TOOL_NAME}"
+        echo "${INSTALL_DIR}" >> "${GITHUB_PATH}"
+        echo "Installation complete!"
+
+        # Cleanup
+        rm -rf "${DOWNLOAD_DIR}"
+
+    - name: Load environment values into environment variables
+      shell: bash
+      env:
+        ENV_LOADER_ENVIRONMENTS_DIRECTORY: "${{ inputs.environments-directory }}"
+        ENV_LOADER_ENVIRONMENT: "${{ inputs.environment-name }}"
+        ENV_LOADER_VALUE_SETS: "${{ inputs.value-set }}"
+      run: env-loader >> "${GITHUB_ENV}"