diff --git a/.github/actions/deps-install/action.yml b/.github/actions/deps-install/action.yml
index cd0f5c5516..d32fedc594 100644
--- a/.github/actions/deps-install/action.yml
+++ b/.github/actions/deps-install/action.yml
@@ -12,25 +12,37 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    - name: Download protoc (Linux)
+      if: runner.os == 'Linux' && contains(inputs.deps, 'protoc')
+      uses: ./.github/actions/download-and-verify
+      with:
+        url: "https://github.com/protocolbuffers/protobuf/releases/download/v25.3/protoc-25.3-linux-x86_64.zip"
+        output_file: "protoc-25.3-linux-x86_64.zip"
+        checksum: "f853e691868d0557425ea290bf7ba6384eef2fa9b04c323afab49a770ba9da80"
+
     - name: Install protoc (Linux)
       env:
         TMP: ${{ inputs.temp || runner.temp }}
       if: runner.os == 'Linux' && contains(inputs.deps, 'protoc')
       shell: bash
       run: |
-        wget https://github.com/protocolbuffers/protobuf/releases/download/v25.3/protoc-25.3-linux-x86_64.zip
-        echo "f853e691868d0557425ea290bf7ba6384eef2fa9b04c323afab49a770ba9da80 protoc-25.3-linux-x86_64.zip" | sha256sum -c
         unzip protoc-25.3-linux-x86_64.zip -d "$TMP/protobuf"
         echo "$TMP/protobuf/bin" >> $GITHUB_PATH
 
+    - name: Download protoc (MacOS)
+      if: runner.os == 'macOS' && contains(inputs.deps, 'protoc')
+      uses: ./.github/actions/download-and-verify
+      with:
+        url: "https://github.com/protocolbuffers/protobuf/releases/download/v25.3/protoc-25.3-osx-x86_64.zip"
+        output_file: "protoc-25.3-osx-x86_64.zip"
+        checksum: "247e003b8e115405172eacc50bd19825209d85940728e766f0848eee7c80e2a1"
+
     - name: Install protoc (MacOS)
       env:
         TMP: ${{ inputs.temp || runner.temp }}
       if: runner.os == 'macOS' && contains(inputs.deps, 'protoc')
       shell: bash
       run: |
-        wget https://github.com/protocolbuffers/protobuf/releases/download/v25.3/protoc-25.3-osx-x86_64.zip
-        echo "247e003b8e115405172eacc50bd19825209d85940728e766f0848eee7c80e2a1 *protoc-25.3-osx-x86_64.zip" | shasum -a 256 -c
         unzip protoc-25.3-osx-x86_64.zip -d "$TMP/protobuf"
         echo "$TMP/protobuf/bin" >> $GITHUB_PATH
 
diff --git a/.github/actions/download-and-verify/action.yml b/.github/actions/download-and-verify/action.yml
new file mode 100644
index 0000000000..ca18965527
--- /dev/null
+++ b/.github/actions/download-and-verify/action.yml
@@ -0,0 +1,34 @@
+name: "Download and verify remote files"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download
+      shell: bash
+      run: |
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          Invoke-WebRequest -Uri ${{ inputs.url }} -OutFile ${{ inputs.output_file }}
+        else
+          curl -L -o ${{ inputs.output_file }} ${{ inputs.url }}
+        fi
+
+    - name: Verify
+      shell: bash
+      run: |
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          echo "${{ inputs.checksum }}  ${{ inputs.output_file }}" | certutil -hashfile - SHA256 | findstr "${{ inputs.checksum }}"
+        elif [[ "$RUNNER_OS" == "macOS" ]]; then
+          echo "${{ inputs.checksum }} *${{ inputs.output_file }}" | shasum -a 256 -c
+        else
+          echo "${{ inputs.checksum }}  ${{ inputs.output_file }}" | sha256sum --check
+        fi
+inputs:
+  url:
+    description: "URL of the remote file."
+    required: true
+  output_file:
+    description: "Output path."
+    required: true
+  checksum:
+    description: "Expected checksum of the downloaded file."
+    required: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 02f684bfe5..2ae8e5af9e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -241,12 +241,17 @@ jobs:
       - name: Install wasm-pack
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
 
+      - name: Download geckodriver
+        uses: ./.github/actions/download-and-verify
+        with:
+          url: "https://github.com/mozilla/geckodriver/releases/download/v0.32.2/geckodriver-v0.32.2-linux64.tar.gz"
+          output_file: "geckodriver-v0.32.2-linux64.tar.gz"
+          checksum: "1eab226bf009599f5aa1d77d9ed4c374e10a03fd848b500be1b32cefd2cbec64"
+
       - name: Install firefox and geckodriver
         run: |
           sudo apt-get update -y
           sudo apt-get install -y firefox
-          wget https://github.com/mozilla/geckodriver/releases/download/v0.32.2/geckodriver-v0.32.2-linux64.tar.gz
-          echo "1eab226bf009599f5aa1d77d9ed4c374e10a03fd848b500be1b32cefd2cbec64 geckodriver-v0.32.2-linux64.tar.gz" | sha256sum -c
           sudo tar -xzvf geckodriver-v0.32.2-linux64.tar.gz -C /bin
           sudo chmod +x /bin/geckodriver