diff --git a/.github/actions/validate/action.yml b/.github/actions/validate/action.yml
index 9215673a..fd9ef5a1 100644
--- a/.github/actions/validate/action.yml
+++ b/.github/actions/validate/action.yml
@@ -89,10 +89,11 @@ runs:
         set -euo pipefail
         version="${{ inputs.cli-version }}"
         if [[ "$version" == "latest" ]]; then
-          version=$(gh release list --repo adobe/spectrum-design-data \
-            --limit 50 --json tagName \
-            --jq '.[].tagName | select(startswith("design-data-cli@"))' \
-            | sed 's/^design-data-cli@//' | sort -V | tail -1)
+          version=$("$GITHUB_ACTION_PATH/scripts/resolve-latest-cli-version.sh" adobe/spectrum-design-data)
+          if [[ -z "$version" ]]; then
+            echo "::error::could not find a design-data-cli@* release tag" >&2
+            exit 1
+          fi
         fi
         tag="design-data-cli@${version}"
         mkdir -p "$RUNNER_TEMP/design-data-cli"
diff --git a/.github/actions/validate/scripts/resolve-latest-cli-version.sh b/.github/actions/validate/scripts/resolve-latest-cli-version.sh
new file mode 100755
index 00000000..149ea6d4
--- /dev/null
+++ b/.github/actions/validate/scripts/resolve-latest-cli-version.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright 2026 Adobe. All rights reserved.
+# This file is licensed to you under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under
+# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+# OF ANY KIND, either express or implied. See the License for the specific language
+# governing permissions and limitations under the License.
+
+# Prints the latest design-data-cli@* release version in <owner/repo>, or
+# nothing if none exists. Paginates through the full releases list instead of
+# relying on a fixed --limit, so a repo with many non-CLI releases can't push
+# the design-data-cli tag off the window.
+set -euo pipefail
+
+repo="${1:?usage: resolve-latest-cli-version.sh <owner/repo>}"
+
+gh api "repos/${repo}/releases" --paginate \
+  --jq '.[].tag_name | select(startswith("design-data-cli@"))' \
+  | sed 's/^design-data-cli@//' | sort -V | tail -1
diff --git a/.github/actions/validate/scripts/resolve-latest-cli-version.test.sh b/.github/actions/validate/scripts/resolve-latest-cli-version.test.sh
new file mode 100755
index 00000000..068122e9
--- /dev/null
+++ b/.github/actions/validate/scripts/resolve-latest-cli-version.test.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Copyright 2026 Adobe. All rights reserved.
+# This file is licensed to you under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under
+# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+# OF ANY KIND, either express or implied. See the License for the specific language
+# governing permissions and limitations under the License.
+
+# Run: bash .github/actions/validate/scripts/resolve-latest-cli-version.test.sh
+#
+# Stubs `gh` on PATH to cover the two cases --limit 50/1000 couldn't: many
+# pages of unrelated releases with no design-data-cli@ tag at all, and a
+# design-data-cli@ tag buried among unrelated ones.
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+fake_bin="$(mktemp -d)"
+trap 'rm -rf "$fake_bin"' EXIT
+
+cat > "$fake_bin/gh" <<'EOF'
+#!/usr/bin/env bash
+# Stands in for `gh api repos/<repo>/releases --paginate --jq '...'`: emits
+# what the real --jq filter would have already narrowed the paginated
+# response down to.
+case "$FAKE_GH_SCENARIO" in
+  no-match)
+    ;; # many unrelated releases, none matching design-data-cli@ — jq yields nothing
+  with-match)
+    printf 'design-data-cli@1.2.0\ndesign-data-cli@1.10.0\n'
+    ;;
+esac
+EOF
+chmod +x "$fake_bin/gh"
+
+PATH="$fake_bin:$PATH"
+export PATH
+
+got="$(FAKE_GH_SCENARIO=no-match "$script_dir/resolve-latest-cli-version.sh" adobe/spectrum-design-data)"
+if [[ -n "$got" ]]; then
+  echo "no-match: expected empty output, got '$got'" >&2
+  exit 1
+fi
+
+got="$(FAKE_GH_SCENARIO=with-match "$script_dir/resolve-latest-cli-version.sh" adobe/spectrum-design-data)"
+if [[ "$got" != "1.10.0" ]]; then
+  echo "with-match: expected 1.10.0 (highest by sort -V), got '$got'" >&2
+  exit 1
+fi
+
+echo "ok"