diff --git a/.github/workflows/_bazel.yml b/.github/workflows/_bazel.yml
index 24d376f328..ee6707b5f4 100644
--- a/.github/workflows/_bazel.yml
+++ b/.github/workflows/_bazel.yml
@@ -33,13 +33,6 @@ on:
       cache-keys:
         type: string
         default:
-      cache-keys-default:
-        type: string
-        default: |
-          llvm-x86
-          llvm-aarch
-          llvm-macos
-          v8-source
       cache-path:
         type: string
         default: /home/runner/.cache/bazel-repository-cache
@@ -126,37 +119,6 @@ jobs:
     - name: Checkout Repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-    - name: Cache keys
-      if: ${{ inputs.cache-entries != 'NONE' && inputs.cache-keys }}
-      id: cache-keys
-      uses: envoyproxy/toolshed/actions/jq@1cdb7a0116109cef13471c348171587eeca2b7d8  # actions-v0.4.20
-      with:
-        input: ${{ inputs.cache-keys }}
-        input-format: yaml
-    - name: Filtered caches
-      if: ${{ inputs.cache-entries != 'NONE' }}
-      id: cache-entries-all
-      uses: envoyproxy/toolshed/actions/jq@1cdb7a0116109cef13471c348171587eeca2b7d8  # actions-v0.4.20
-      with:
-        input: ${{ inputs.cache-entries || inputs.cache-entries-default }}
-        input-format: yaml
-        filter: .
-    - name: Filtered caches
-      if: ${{ inputs.cache-entries != 'NONE' }}
-      id: cache-entries
-      uses: envoyproxy/toolshed/actions/jq@1cdb7a0116109cef13471c348171587eeca2b7d8  # actions-v0.4.20
-      with:
-        input: |
-          entries: ${{ steps.cache-entries-all.outputs.value }}
-          keys: ${{ steps.cache-keys.outputs.value }}
-        input-format: yaml
-        filter: |
-          (.keys // []) as $keys
-          | if ($keys | length) == 0
-            then .entries
-            else .entries | with_entries(select(.key | IN($keys[])))
-            end
-
     - name: Bazel caches
       id: repo-cache-resolve
       uses: ./actions/bazel/cache/resolve
@@ -164,7 +126,8 @@ jobs:
       with:
         lock-file: bazel/MODULE.bazel.lock
         cache-path: ${{ inputs.cache-path }}
-        entries: ${{ steps.cache-entries.outputs.value }}
+        entries: ${{ inputs.cache-entries || inputs.cache-entries-default }}
+        keys: ${{ inputs.cache-keys }}
     - name: Restore caches
       if: ${{ inputs.cache-entries != 'NONE' }}
       uses: ./actions/github/caches/restore
@@ -220,7 +183,7 @@ jobs:
         if [[ "${BAZEL_UPLOAD}" == "true" && -n "${ARTIFACT_PATTERNS}" ]]; then
            download_toplevel="--remote_download_toplevel"
         fi
-        if [[ -n "${REPO_CACHE_PATH}" ]]; then
+        if [[ -n "${REPO_CACHE_PATH}" && -n "${CACHE_ENTRIES}" ]]; then
             repository_cache_flag="--repository_cache=${REPO_CACHE_PATH}"
             if [[ ! -e "${REPO_CACHE_PATH}" ]]; then
                 mkdir -p "${REPO_CACHE_PATH}"
@@ -238,6 +201,7 @@ jobs:
         ARTIFACT_PATTERNS: ${{ inputs.artifacts }}
         RBE_AUTHORIZED: ${{ steps.rbe.outputs.authorized }}
         EVENT_NAME: ${{ github.event_name }}
+        CACHE_ENTRIES: ${{ inputs.cache-entries != 'NONE' && inputs.cache-entries || '' }}
         REPO_CACHE_PATH: ${{ inputs.cache-path }}
     - name: Bazel targets (${{ inputs.action }}/${{ inputs.bazel-mode }}) [container]
       if: runner.os == 'Linux'
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index 6831a307cb..4d40c6d419 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -112,6 +112,7 @@ jobs:
             --config=gcc
             --noenable_bzlmod --enable_workspace
           bazel_mode: workspace-gcc
+          cache-entries: NONE
           create_source: false
           privileged: false
           rbe: true
@@ -128,6 +129,7 @@ jobs:
             --config=ci
             --config=gcc
           bazel_mode: bzlmod-gcc
+          cache-entries: NONE
           create_source: false
           privileged: false
           rbe: true
@@ -146,7 +148,6 @@ jobs:
             --noenable_bzlmod --enable_workspace
           bazel_mode: workspace-macos
           cache-entries: NONE
-          cache-path: "${HOME}/.cache/bazel-repository-cache"
           create_source: false
           privileged: false
           rbe: true
@@ -163,7 +164,7 @@ jobs:
             --config=ci
             --config=macos
           bazel_mode: bzlmod-macos
-          cache-path: "${HOME}/.cache/bazel-repository-cache"
+          cache-entries: NONE
           create_source: false
           privileged: false
           rbe: true
diff --git a/actions/bazel/cache/resolve/action.yml b/actions/bazel/cache/resolve/action.yml
index 71043c2b75..87a3d88c6a 100644
--- a/actions/bazel/cache/resolve/action.yml
+++ b/actions/bazel/cache/resolve/action.yml
@@ -10,6 +10,8 @@ inputs:
     required: true
   entries:
     required: true  # yaml: name -> {extension, repo} | {module}
+  keys:
+    default:  # yaml list of entry names, empty selects all entries
   lock-file:
     default: MODULE.bazel.lock
 
@@ -33,12 +35,33 @@ runs:
       SHA256=$(command -v sha256sum || echo 'shasum -a 256')
       echo "value=$($SHA256 "$f" | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
 
+  - id: keys
+    if: ${{ inputs.keys }}
+    uses: envoyproxy/toolshed/actions/jq@81f14242f0c4d8cae0964c85ae0c830a37b38d53
+    with:
+      input-format: yaml
+      input: ${{ inputs.keys }}
+      filter: .
+
   - id: entries
     uses: envoyproxy/toolshed/actions/jq@81f14242f0c4d8cae0964c85ae0c830a37b38d53
     with:
       input-format: yaml
       input: ${{ inputs.entries }}
-      filter: .
+      options: --argjson keys '${{ steps.keys.outputs.value || '[]' }}'
+      filter: |
+        . as $entries
+        | (if ($keys | type) == "string"
+           then [($keys | splits("\\s+") | select(length > 0))]
+           else $keys
+           end) as $keys
+        | ([$keys[] | . as $key | select($entries | has($key) | not)] | unique) as $unknown
+        | if ($unknown | length) > 0
+          then error("unknown cache keys: \($unknown | join(", "))")
+          elif ($keys | length) == 0
+          then $entries
+          else $entries | with_entries(select(.key | IN($keys[])))
+          end
 
   - id: resolved
     uses: envoyproxy/toolshed/actions/jq@81f14242f0c4d8cae0964c85ae0c830a37b38d53
diff --git a/actions/bazel/cache/resolve/tests/fixtures/extension.lock.yml b/actions/bazel/cache/resolve/tests/fixtures/extension.lock.yml
index 7628295681..74c24e7861 100644
--- a/actions/bazel/cache/resolve/tests/fixtures/extension.lock.yml
+++ b/actions/bazel/cache/resolve/tests/fixtures/extension.lock.yml
@@ -5,4 +5,10 @@ moduleExtensions:
         my_repo:
           attributes:
             sha256: abc123sha256abcd
+        my_other_repo:
+          attributes:
+            sha256: def456sha256efgh
+        my_third_repo:
+          attributes:
+            sha256: 789abcsha256ijkl
 registryFileHashes: {}
diff --git a/actions/bazel/cache/resolve/tests/keys-single.test.yml b/actions/bazel/cache/resolve/tests/keys-single.test.yml
new file mode 100644
index 0000000000..3329eb696e
--- /dev/null
+++ b/actions/bazel/cache/resolve/tests/keys-single.test.yml
@@ -0,0 +1,25 @@
+uses: ./actions/bazel/cache/resolve
+id: resolve
+with:
+  cache-all: false
+  cache-path: /tmp/cache
+  lock-file: ${{ env.ACTION_TEST_PATH }}/fixtures/extension.lock.yml
+  entries: |
+    llvm:
+      extension: my_extension
+      repo: my_repo
+    llvm-other:
+      extension: my_extension
+      repo: my_other_repo
+  keys: llvm-other
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    RESOLVE_OUTPUT='${{ steps.resolve.outputs.caches }}'
+    test_output_not_empty "$RESOLVE_OUTPUT"
+    test_json_key "$RESOLVE_OUTPUT" '["bazel-llvm-other-def456sha256efgh"]' \
+      "/tmp/cache/content_addressable/sha256/def456sha256efgh"
+    HAS_LLVM=$(echo "$RESOLVE_OUTPUT" | jq 'has("bazel-llvm-abc123sha256abcd")')
+    test_output_equals "$HAS_LLVM" "false" "Unselected single-line cache key is absent"
diff --git a/actions/bazel/cache/resolve/tests/keys-subset.test.yml b/actions/bazel/cache/resolve/tests/keys-subset.test.yml
new file mode 100644
index 0000000000..75a9bb5391
--- /dev/null
+++ b/actions/bazel/cache/resolve/tests/keys-subset.test.yml
@@ -0,0 +1,32 @@
+uses: ./actions/bazel/cache/resolve
+id: resolve
+with:
+  cache-all: false
+  cache-path: /tmp/cache
+  lock-file: ${{ env.ACTION_TEST_PATH }}/fixtures/extension.lock.yml
+  entries: |
+    llvm:
+      extension: my_extension
+      repo: my_repo
+    llvm-other:
+      extension: my_extension
+      repo: my_other_repo
+    llvm-third:
+      extension: my_extension
+      repo: my_third_repo
+  keys: |
+    llvm
+    llvm-other
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    RESOLVE_OUTPUT='${{ steps.resolve.outputs.caches }}'
+    test_output_not_empty "$RESOLVE_OUTPUT"
+    test_json_key "$RESOLVE_OUTPUT" '["bazel-llvm-abc123sha256abcd"]' \
+      "/tmp/cache/content_addressable/sha256/abc123sha256abcd"
+    test_json_key "$RESOLVE_OUTPUT" '["bazel-llvm-other-def456sha256efgh"]' \
+      "/tmp/cache/content_addressable/sha256/def456sha256efgh"
+    HAS_LLVM_THIRD=$(echo "$RESOLVE_OUTPUT" | jq 'has("bazel-llvm-third-789abcsha256ijkl")')
+    test_output_equals "$HAS_LLVM_THIRD" "false" "Unselected cache key is absent"
diff --git a/actions/bazel/cache/resolve/tests/keys-unknown.test.yml b/actions/bazel/cache/resolve/tests/keys-unknown.test.yml
new file mode 100644
index 0000000000..40c622f79e
--- /dev/null
+++ b/actions/bazel/cache/resolve/tests/keys-unknown.test.yml
@@ -0,0 +1,23 @@
+uses: ./actions/bazel/cache/resolve
+id: resolve
+with:
+  cache-all: false
+  cache-path: /tmp/cache
+  lock-file: ${{ env.ACTION_TEST_PATH }}/fixtures/extension.lock.yml
+  entries: |
+    llvm:
+      extension: my_extension
+      repo: my_repo
+    llvm-other:
+      extension: my_extension
+      repo: my_other_repo
+  keys: |
+    llvm
+    missing
+
+after:
+- if: always()
+  shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    test_output_equals '${{ steps.resolve.outcome }}' "failure" "Unknown cache key fails resolution"
diff --git a/actions/bazel/cache/resolve/tests/keys-unset.test.yml b/actions/bazel/cache/resolve/tests/keys-unset.test.yml
new file mode 100644
index 0000000000..adb896f26c
--- /dev/null
+++ b/actions/bazel/cache/resolve/tests/keys-unset.test.yml
@@ -0,0 +1,24 @@
+uses: ./actions/bazel/cache/resolve
+id: resolve
+with:
+  cache-all: false
+  cache-path: /tmp/cache
+  lock-file: ${{ env.ACTION_TEST_PATH }}/fixtures/extension.lock.yml
+  entries: |
+    llvm:
+      extension: my_extension
+      repo: my_repo
+    llvm-other:
+      extension: my_extension
+      repo: my_other_repo
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    RESOLVE_OUTPUT='${{ steps.resolve.outputs.caches }}'
+    test_output_not_empty "$RESOLVE_OUTPUT"
+    test_json_key "$RESOLVE_OUTPUT" '["bazel-llvm-abc123sha256abcd"]' \
+      "/tmp/cache/content_addressable/sha256/abc123sha256abcd"
+    test_json_key "$RESOLVE_OUTPUT" '["bazel-llvm-other-def456sha256efgh"]' \
+      "/tmp/cache/content_addressable/sha256/def456sha256efgh"