diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts
index b564161aa..8222f96e2 100644
--- a/src/setup-codeql.ts
+++ b/src/setup-codeql.ts
@@ -427,8 +427,10 @@ export async function getCodeQLSource(
       Feature.AllowToolcacheInput,
     );
     const allowToolcacheValue =
-      toolsInputFromRepositoryProperty ||
-      (allowToolcacheValueFF && (isDynamicWorkflow() || util.isInTestMode()));
+      allowToolcacheValueFF &&
+      (toolsInputFromRepositoryProperty ||
+        isDynamicWorkflow() ||
+        util.isInTestMode());
     if (allowToolcacheValue) {
       // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache
       // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to