diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 54a616407..81d88d1a7 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -129,10 +129,15 @@ jobs:
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
 
+      - name: Typecheck pr-checks scripts
+        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        working-directory: pr-checks
+        run: npm run typecheck
+
       - name: Run pr-checks tests
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         working-directory: pr-checks
-        run: npx tsx --test
+        run: npm run test
 
       - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
diff --git a/lib/entry-points.js b/lib/entry-points.js
index 4d5259861..49f7e9494 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -183682,13 +183682,13 @@ async function getTarVersion() {
     if (!match2?.[1]) {
       throw new Error("Failed to parse output of tar --version.");
     }
-    return { type: "gnu", version: match2[1] };
+    return { type: "gnu", version: match2[1], path: tar };
   } else if (stdout.includes("bsdtar")) {
     const match2 = stdout.match(/bsdtar ([0-9.]+)/);
     if (!match2?.[1]) {
       throw new Error("Failed to parse output of tar --version.");
     }
-    return { type: "bsd", version: match2[1] };
+    return { type: "bsd", version: match2[1], path: tar };
   } else {
     throw new Error("Unknown tar version");
   }
@@ -183755,10 +183755,10 @@ async function extractTarZst(tar, dest, tarVersion, logger2) {
       args.push("--overwrite");
     }
     args.push("-f", tar instanceof stream.Readable ? "-" : tar, "-C", dest);
-    process.stdout.write(`[command]tar ${args.join(" ")}
+    process.stdout.write(`[command]${tarVersion.path} ${args.join(" ")}
 `);
     await new Promise((resolve15, reject) => {
-      const tarProcess = (0, import_child_process.spawn)("tar", args, { stdio: "pipe" });
+      const tarProcess = (0, import_child_process.spawn)(tarVersion.path, args, { stdio: "pipe" });
       let stdout = "";
       tarProcess.stdout?.on("data", (data) => {
         stdout += data.toString();
@@ -183785,11 +183785,11 @@ async function extractTarZst(tar, dest, tarVersion, logger2) {
         if (code !== 0) {
           reject(
             new CommandInvocationError(
-              "tar",
+              tarVersion.path,
               args,
               code ?? void 0,
-              stdout,
-              stderr
+              stderr,
+              stdout
             )
           );
         }
diff --git a/package.json b/package.json
index 5e6f8e7d3..561500877 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,8 @@
     "test": "npm run ava -- src/",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh"
+    "update-pr-checks": "./pr-checks/sync.sh",
+    "typecheck": "tsc --noEmit"
   },
   "license": "MIT",
   "workspaces": [
diff --git a/pr-checks/package.json b/pr-checks/package.json
index a29428b9f..0cfda051c 100644
--- a/pr-checks/package.json
+++ b/pr-checks/package.json
@@ -2,6 +2,11 @@
   "private": true,
   "description": "Dependencies for codeql-action scripts",
   "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "npx tsx --test",
+    "checks": "npm run typecheck && npm run test"
+  },
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@actions/github": "^8.0.1",
diff --git a/pr-checks/tsconfig.json b/pr-checks/tsconfig.json
index e0a6c856c..f75a95289 100644
--- a/pr-checks/tsconfig.json
+++ b/pr-checks/tsconfig.json
@@ -9,5 +9,12 @@
     "noEmit": true
   },
   "include": ["./**/*.ts", "../src/**/*.ts"],
-  "exclude": ["node_modules"]
+  "exclude": [
+    "node_modules",
+    "../src/testdata/**",
+    "../src/**/*.test.ts",
+    "../src/testing-utils.ts",
+    "../src/json/testing-util.ts",
+    "../src/feature-flags/testing-util.ts"
+  ]
 }
diff --git a/src/tar.test.ts b/src/tar.test.ts
index 99d68b531..e193b2df4 100644
--- a/src/tar.test.ts
+++ b/src/tar.test.ts
@@ -15,7 +15,7 @@ test("extractTarZst rejects if the input stream errors", async (t) => {
     const promise = extractTarZst(
       archive,
       path.join(tmpDir, "dest"),
-      { type: "gnu", version: "1.34" },
+      { type: "gnu", version: "1.34", path: "tar" },
       new RecordingLogger(),
     );
 
diff --git a/src/tar.ts b/src/tar.ts
index 3a0d79cc6..3497da5e5 100644
--- a/src/tar.ts
+++ b/src/tar.ts
@@ -17,6 +17,8 @@ const MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
 export type TarVersion = {
   type: "gnu" | "bsd";
   version: string;
+  /** Path to the `tar` executable that reported this version. */
+  path: string;
 };
 
 async function getTarVersion(): Promise<TarVersion> {
@@ -39,14 +41,14 @@ async function getTarVersion(): Promise<TarVersion> {
       throw new Error("Failed to parse output of tar --version.");
     }
 
-    return { type: "gnu", version: match[1] };
+    return { type: "gnu", version: match[1], path: tar };
   } else if (stdout.includes("bsdtar")) {
     const match = stdout.match(/bsdtar ([0-9.]+)/);
     if (!match?.[1]) {
       throw new Error("Failed to parse output of tar --version.");
     }
 
-    return { type: "bsd", version: match[1] };
+    return { type: "bsd", version: match[1], path: tar };
   } else {
     throw new Error("Unknown tar version");
   }
@@ -171,10 +173,10 @@ export async function extractTarZst(
 
     args.push("-f", tar instanceof stream.Readable ? "-" : tar, "-C", dest);
 
-    process.stdout.write(`[command]tar ${args.join(" ")}\n`);
+    process.stdout.write(`[command]${tarVersion.path} ${args.join(" ")}\n`);
 
     await new Promise<void>((resolve, reject) => {
-      const tarProcess = spawn("tar", args, { stdio: "pipe" });
+      const tarProcess = spawn(tarVersion.path, args, { stdio: "pipe" });
 
       let stdout = "";
       tarProcess.stdout?.on("data", (data: Buffer) => {
@@ -210,11 +212,11 @@ export async function extractTarZst(
         if (code !== 0) {
           reject(
             new CommandInvocationError(
-              "tar",
+              tarVersion.path,
               args,
               code ?? undefined,
-              stdout,
               stderr,
+              stdout,
             ),
           );
         }
diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts
index 1ba980bbe..928255d3c 100644
--- a/src/tools-download.test.ts
+++ b/src/tools-download.test.ts
@@ -70,7 +70,7 @@ test.serial(
         destination,
         undefined,
         {},
-        { type: "gnu", version: "1.34" },
+        { type: "gnu", version: "1.34", path: "tar" },
         new RecordingLogger(),
       );
 
@@ -103,7 +103,7 @@ test.serial(
           destination,
           undefined,
           {},
-          { type: "gnu", version: "1.34" },
+          { type: "gnu", version: "1.34", path: "tar" },
           new RecordingLogger(),
         ),
         {
@@ -147,7 +147,7 @@ test.serial(
         destination,
         undefined,
         {},
-        { type: "gnu", version: "1.34" },
+        { type: "gnu", version: "1.34", path: "tar" },
         new RecordingLogger(),
       );
 
@@ -187,7 +187,7 @@ test.serial(
         destination,
         undefined,
         {},
-        { type: "gnu", version: "1.34" },
+        { type: "gnu", version: "1.34", path: "tar" },
         new RecordingLogger(),
       );
 
@@ -235,7 +235,7 @@ test.serial(
         path.join(tmpDir, "codeql"),
         undefined,
         {},
-        { type: "gnu", version: "1.34" },
+        { type: "gnu", version: "1.34", path: "tar" },
         new RecordingLogger(),
       );