diff --git a/scan-config/action.yaml b/scan-config/action.yaml
index 7b3d9e2..1d95bc5 100644
--- a/scan-config/action.yaml
+++ b/scan-config/action.yaml
@@ -43,6 +43,7 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN"
         scan_path=$(realpath "$SCAN_PATH_IN")
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
diff --git a/scan-fs/action.yaml b/scan-fs/action.yaml
index 9c2edeb..9a9f943 100644
--- a/scan-fs/action.yaml
+++ b/scan-fs/action.yaml
@@ -43,6 +43,7 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN"
         scan_path=$(realpath "$SCAN_PATH_IN")
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
diff --git a/scan-image/action.yaml b/scan-image/action.yaml
index bfaf70a..627764c 100644
--- a/scan-image/action.yaml
+++ b/scan-image/action.yaml
@@ -43,6 +43,7 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
diff --git a/setup-db/action.yaml b/setup-db/action.yaml
index 8f4ac21..3393614 100644
--- a/setup-db/action.yaml
+++ b/setup-db/action.yaml
@@ -27,6 +27,9 @@ runs:
       shell: bash
       run: |
         echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
+    - name: Ensure Trivy cache directory exists
+      shell: bash
+      run: mkdir -p "${{ inputs.cache-dir }}"
     - id: restore-db
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
       with: