diff --git a/.github/scripts/tests/update-packages.test.py b/.github/scripts/tests/update-packages.test.py
index a38d8f1..3c48514 100644
--- a/.github/scripts/tests/update-packages.test.py
+++ b/.github/scripts/tests/update-packages.test.py
@@ -169,6 +169,13 @@ def shell(name):
 
 
 class UpdatePackagesTests(unittest.TestCase):
+    def test_setup_installs_caller_sdk_pin_without_changing_selection_policy(self):
+        setup = STEPS["Setup .NET"]
+        self.assertIn("dotnet-version: ${{ env.DOTNET_VERSION }}", setup)
+        self.assertIn("global-json-file: ${{ hashFiles('global.json') != '' && 'global.json' || '' }}", setup)
+        self.assertIn("DOTNET_INSTALL_DIR:", setup)
+        self.assertNotRegex(SOURCE, r"(?:rm|mv|sed|jq) .*global[.]json")
+
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory(prefix="update-packages-")
         self.addCleanup(self.temp.cleanup)
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 143379e..3c937f5 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -186,6 +186,10 @@ jobs:
           DOTNET_INSTALL_DIR: ${{ runner.environment == 'self-hosted' && format('{0}/dotnet', runner.temp) || '' }}
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
+          # setup-dotnet installs both versions when both inputs are present. The
+          # latest SDK alone cannot satisfy an exact pin or an older feature band.
+          # Keep the caller's roll-forward policy; never rewrite global.json.
+          global-json-file: ${{ hashFiles('global.json') != '' && 'global.json' || '' }}
 
       - name: Setup Node.js
         if: steps.detect.outputs.update_npm == 'true'