diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index fd2463487..1bcc044f2 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -451,17 +451,6 @@ jobs:
           prefix: ${{ matrix.vcpkg_scope }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      # The action only creates its directory when the prefix matched at least one
-      # entry, and it reads that directory unguarded when it saves at the end of the
-      # job. A scope nobody has written to yet therefore leaves the directory missing
-      # and fails the job, which is exactly the state every scope starts in. Make the
-      # directory up front so an empty scope is a cache miss instead of an error.
-      - name: "Create vcpkg cache directory"
-        shell: bash
-        env:
-          CACHE_DIR: '${{ steps.vcpkg-cache.outputs.path }}'
-        run: mkdir -p "$CACHE_DIR"
-
       # Uses environment variables, see compile.sh for more details
       - name: "Build Cockatrice"
         id: build
@@ -481,15 +470,12 @@ jobs:
           PACKAGE_SUFFIX: '${{ matrix.package_suffix }}'
           TARGET_MACOS_VERSION: ${{ matrix.override_target }}
           USE_CCACHE: ${{ matrix.use_ccache }}
-          # vcpkg has to be allowed to write into the cache directory even on a pull
-          # request, because that is where "Collect new vcpkg entries" looks for the
-          # archives this run had to compile itself. With the source left at read those
-          # archives are never written, the collect step finds nothing, and vcpkg-cache-import.yml
-          # gets no artifact to heal the shared cache with. The importer is what publishes
-          # to master's scope; a pull request's own merge ref stays unreadable by every
-          # later run, so the action's own save there costs quota but nothing else.
-          # Forks keep the read-only mode, they are the case that must not be trusted.
-          VCPKG_BINARY_SOURCES: "clear;files,${{ steps.vcpkg-cache.outputs.path }},${{ case(github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository), 'readwrite', 'read') }}"
+          # Only master may write the cache itself. A pull request run has its own
+          # merge ref scope, which nothing else can read, so anything it saved there
+          # would be unreachable for every later run. Handing the new archives over
+          # to vcpkg-cache-import.yml is what lets a pull request heal the shared
+          # cache after a runner image update changes every ABI hash.
+          VCPKG_BINARY_SOURCES: "clear;files,${{ steps.vcpkg-cache.outputs.path }},${{ case(github.ref == 'refs/heads/master', 'readwrite', 'read') }}"
           VCPKG_DISABLE_METRICS: 1
           VCPKG_FEATURE_FLAGS: dependencygraph
           VCPKG_TARGET_MACOS_VERSION: ${{ matrix.vcpkg_deployment_target }}
@@ -546,15 +532,12 @@ jobs:
           echo "count=$count" >>"$GITHUB_OUTPUT"
           echo "slug=$(sed -e 's|^vcpkg/||' -e 's|/$||' -e 's|/|-|g' <<<"$VCPKG_SCOPE")" >>"$GITHUB_OUTPUT"
 
-      # archive: false accepts a single file and nothing else, and a scope hands over one
-      # archive per ABI hash vcpkg had to rebuild, which is 23 files on a cold runner.
-      # Zipping the directory keeps the fanout at the artifact root, which is where
-      # vcpkg-cache-import.yml looks for keys.txt once download-artifact unpacks it.
       - name: "Upload new vcpkg entries"
         # An empty count means the step above did not run at all, on master and on forks
         if: steps.vcpkg_new.outputs.count != '' && steps.vcpkg_new.outputs.count != '0'
         uses: actions/upload-artifact@v7
         with:
+          archive: false
           if-no-files-found: error    # a count above zero with nothing staged is a bug
           name: vcpkg-new-${{ steps.vcpkg_new.outputs.slug }}
           path: ${{ runner.temp }}/vcpkg-new