diff --git a/.github/workflows/ci.cli.yml b/.github/workflows/ci.cli.yml
index a79f54db..440b828b 100644
--- a/.github/workflows/ci.cli.yml
+++ b/.github/workflows/ci.cli.yml
@@ -35,8 +35,14 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pkgxdev/setup@v2
 
+      - uses: denoland/setup-deno@v1
+        if: runner.os == 'macos'
+
+      - run: pkgx install deno
+        if: runner.os == 'linux'
+
       - name: precache  # makes it easier to read the real output
-        run: pkgx deno cache test/test.ts build/build.ts
+        run: deno cache test/test.ts build/build.ts
 
       - run: bin/bk build ${{matrix.pkg}}
       - run: bin/bk test ${{matrix.pkg}}
diff --git a/audit/action.yml b/audit/action.yml
index 3b99345a..f72c4fa9 100644
--- a/audit/action.yml
+++ b/audit/action.yml
@@ -21,12 +21,19 @@ runs:
         fi
       shell: bash
 
+    - uses: denoland/setup-deno@v1
+      if: runner.os == 'macos'
+
+    - run: pkgx install deno
+      shell: bash
+      if: runner.os == 'linux'
+
     - name: fetch deno deps
       shell: bash
       run: |
         echo "::group::fetch deno deps"
         cd $GITHUB_ACTION_PATH
-        pkgx deno cache ./audit.ts
+        deno cache ./audit.ts
         echo "::endgroup::"
 
     - run: ${GITHUB_ACTION_PATH}/audit.ts '${{ inputs.pkg }}'
diff --git a/audit/audit.ts b/audit/audit.ts
index 9c91c27c..03a7cc47 100755
--- a/audit/audit.ts
+++ b/audit/audit.ts
@@ -1,4 +1,4 @@
-#!//usr/bin/env -S pkgx +git +gh deno run --allow-env --allow-read --allow-run --allow-net --ext=ts
+#!//usr/bin/env -S pkgx +git +gh env deno run --allow-env --allow-read --allow-run --allow-net --ext=ts
 
 import { Command } from "cliffy/command/mod.ts"
 import { swallow } from "brewkit/utils.ts"
diff --git a/build/action.yml b/build/action.yml
index e7f6e681..7a99432d 100644
--- a/build/action.yml
+++ b/build/action.yml
@@ -44,12 +44,19 @@ runs:
         fi
       shell: bash
 
+    - uses: denoland/setup-deno@v1
+      if: runner.os == 'macos'
+
+    - run: pkgx install deno
+      shell: bash
+      if: runner.os == 'linux'
+
     - name: fetch deno deps
       shell: bash
       run: |
         echo "::group::fetch deno deps"
         cd $GITHUB_ACTION_PATH
-        pkgx deno cache ./build.ts
+        deno cache ./build.ts
         echo "::endgroup::"
 
     - name: build
diff --git a/build/build.ts b/build/build.ts
index 2b1bbb02..a4124651 100755
--- a/build/build.ts
+++ b/build/build.ts
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S pkgx +rsync +git +bash +gum +gh +curl +bzip2 +xz +unzip +lzip +column deno run --ext=ts --allow-env --allow-read --allow-write --allow-run --allow-net
+#!/usr/bin/env -S pkgx +rsync +git +bash +gum +gh +curl +bzip2 +xz +unzip +lzip +column env deno run --ext=ts --allow-env --allow-read --allow-write --allow-run --allow-net
 
 import make_build_script from "brewkit/porcelain/build-script.ts"
 import { gum, rsync } from "brewkit/utils.ts"
diff --git a/test/action.yml b/test/action.yml
index b783c022..a1f48fbe 100644
--- a/test/action.yml
+++ b/test/action.yml
@@ -19,12 +19,19 @@ runs:
         fi
       shell: bash
 
+    - uses: denoland/setup-deno@v1
+      if: runner.os == 'macos'
+
+    - run: pkgx install deno
+      shell: bash
+      if: runner.os == 'linux'
+
     - name: fetch deno deps
       shell: bash
       run: |
         echo "::group::fetch deno deps"
         cd ${GITHUB_ACTION_PATH}
-        pkgx deno cache ./test.ts
+        deno cache ./test.ts
         echo "::endgroup::"
 
     - name: test
diff --git a/test/test.ts b/test/test.ts
index d258d03d..e376f4f7 100755
--- a/test/test.ts
+++ b/test/test.ts
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S pkgx +bash +gum +gh +rsync deno run --ext=ts --allow-env --allow-read --allow-write --allow-net --allow-run
+#!/usr/bin/env -S pkgx +bash +gum +gh +rsync env deno run --ext=ts --allow-env --allow-read --allow-write --allow-net --allow-run
 
 //TODO net required because we go to github for version info, but really we should require
 // a built product that is then recorded for us to use