diff --git a/.changes/cache-built-binary.md b/.changes/cache-built-binary.md
new file mode 100644
index 0000000..5ea357d
--- /dev/null
+++ b/.changes/cache-built-binary.md
@@ -0,0 +1,4 @@
+---
+kind: fixed
+---
+Cache the compiled binary keyed on a source content hash instead of recompiling via `go run .` every invocation; fixes the non-functional setup-go module cache (its cache-dependency-path sat outside GITHUB_WORKSPACE) and removes the per-run compile cost
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e279128
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/release-tool
diff --git a/action.yml b/action.yml
index 4106ad7..0623cda 100644
--- a/action.yml
+++ b/action.yml
@@ -74,10 +74,40 @@ outputs:
 runs:
   using: composite
   steps:
+    # Cache the compiled binary instead of recompiling via `go run .` on every
+    # invocation. The key is a content hash of the Go sources, so it is correct
+    # both for external consumers (pinned by SHA, source under _actions/) and for
+    # this repo's own `uses: ./` self-invocation (source changes per commit).
+    # setup-go's own module cache can't help here: its cache-dependency-path is
+    # the action's go.sum under _actions/, outside GITHUB_WORKSPACE, which the
+    # cache key resolver rejects ("Some specified paths were not resolved").
+    - name: Hash release-tool sources
+      id: srchash
+      shell: bash
+      working-directory: ${{ github.action_path }}
+      run: |
+        h=$(find . -type f \( -name '*.go' -o -name 'go.mod' -o -name 'go.sum' \) \
+          -print0 | sort -z | xargs -0 sha256sum | sha256sum | awk '{print $1}')
+        echo "hash=$h" >> "$GITHUB_OUTPUT"
+
+    - name: Restore release-tool binary
+      id: cache-bin
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+      with:
+        path: ${{ github.action_path }}/release-tool
+        key: release-tool-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ steps.srchash.outputs.hash }}
+
     - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      if: steps.cache-bin.outputs.cache-hit != 'true'
       with:
         go-version: ${{ inputs.go-version }}
-        cache-dependency-path: ${{ github.action_path }}/go.sum
+        cache: false
+
+    - name: Build release-tool
+      if: steps.cache-bin.outputs.cache-hit != 'true'
+      shell: bash
+      working-directory: ${{ github.action_path }}
+      run: go build -o release-tool .
 
     - name: Configure git identity
       shell: bash
@@ -99,18 +129,19 @@ runs:
         BASE_SHA: ${{ inputs.base-sha }}
         PR_NUMBER: ${{ inputs.pr-number }}
       run: |
+        BIN="$PWD/release-tool"
         case "$RELEASE_MODE" in
           release)
             ARGS=(--root "$WORKSPACE" --output "$WORKSPACE/$RELEASE_OUTPUT")
             [ -n "$RELEASE_NOTES" ] && ARGS+=(--notes "$WORKSPACE/$RELEASE_NOTES")
             [ "$DRY_RUN" = "true" ] && ARGS+=(--dry-run)
-            go run . release "${ARGS[@]}"
+            "$BIN" release "${ARGS[@]}"
             ;;
           status)
-            go run . status --root "$WORKSPACE"
+            "$BIN" status --root "$WORKSPACE"
             ;;
           check)
-            go run . check --root "$WORKSPACE" \
+            "$BIN" check --root "$WORKSPACE" \
               --base    "$BASE_REF" \
               --against "$BASE_SHA" \
               --pr      "$PR_NUMBER" \