diff --git a/.github/actions/php/setup-composer/action.yml b/.github/actions/php/setup-composer/action.yml
index 5a9fe5ff3b..a84857a77b 100644
--- a/.github/actions/php/setup-composer/action.yml
+++ b/.github/actions/php/setup-composer/action.yml
@@ -106,7 +106,7 @@ runs:
       with:
         working-directory: ${{ inputs.dev-tools-source-directory }}
         composer-options: --prefer-dist --no-plugins --no-scripts
-        require-lock-file: 'true'
+        require-lock-file: 'false'
         custom-cache-suffix: dev-tools-runtime
 
     - name: Expose DevTools runtime
diff --git a/.github/wiki b/.github/wiki
index 07f4fb20ee..e256370c4c 160000
--- a/.github/wiki
+++ b/.github/wiki
@@ -1 +1 @@
-Subproject commit 07f4fb20ee4a1835576c7ae581193c206b27f19a
+Subproject commit e256370c4cecea70b19704d5373ab18d324de3cf
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c88d991f4..1b5b5aa867 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Relax workflow fallback Composer install so .dev-tools-actions bootstrap does not require composer.lock when provisioning DevTools runtime in shared GitHub Actions contexts (#342).
+
 ## [1.25.4] - 2026-05-11
 
 ### Fixed
diff --git a/tests/GitHubActions/SetupComposerActionTest.php b/tests/GitHubActions/SetupComposerActionTest.php
index 8aea5ebbcb..98c3a77ba7 100644
--- a/tests/GitHubActions/SetupComposerActionTest.php
+++ b/tests/GitHubActions/SetupComposerActionTest.php
@@ -103,6 +103,19 @@ public function detectRuntimeWillPreferTheConsumerLocalInstallation(): void
         self::assertSame($resolvedWorkspace . '/vendor/autoload.php', $outputs['autoload']);
     }
 
+    /**
+     * @return void
+     */
+    #[Test]
+    public function fallbackInstallShouldNotRequireComposerLockFile(): void
+    {
+        $actionFile = self::ACTION_PATH . '/action.yml';
+        $actionContents = file_get_contents($actionFile);
+
+        self::assertStringContainsString("require-lock-file: 'false'", $actionContents);
+        self::assertStringNotContainsString("require-lock-file: 'true'", $actionContents);
+    }
+
     /**
      * @return void
      */