diff --git a/.github/workflows/go-tests.yaml b/.github/workflows/go-tests.yaml
index 15a3075d2..84174e6ab 100644
--- a/.github/workflows/go-tests.yaml
+++ b/.github/workflows/go-tests.yaml
@@ -26,12 +26,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
-      - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          repository: chainguard-dev/bincapz-samples
-          path: ${{ github.workspace }}/samples
-
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: go.mod
@@ -50,12 +44,8 @@ jobs:
 
       - name: Prepare samples
         run: |
-          cp -a ${{ github.workspace }}/test_data/. ${{ github.workspace }}/samples/
-          for file in caddy.xz chezmoi.xz minio_x86_64.xz mongosh.xz neuvector_agent_aarch64.xz opa.xz ; do \
-            tar -xJvf ${{ github.workspace }}/samples/linux/clean/${file} -C ${{ github.workspace }}/samples/linux/clean; \
-          done
-          tar -xJvf ${{ github.workspace }}/samples/macOS/clean/bincapz.xz -C ${{ github.workspace }}/samples/macOS/clean
+          make prepare-samples
 
       - name: Test
         run: |
-          go test $(go list ./... | grep -v test_data)
+          make test
diff --git a/Makefile b/Makefile
index cf0032c03..67bd9b0f4 100644
--- a/Makefile
+++ b/Makefile
@@ -47,8 +47,21 @@ fix: $(FIXERS)
 
 # END: lint-install ../bincapz
 
+SAMPLES_REPO=https://github.com/chainguard-dev/bincapz-samples.git
+SAMPLES_HASH=bdcb8c2e9bf557a0abe3e2b0144f437d456299b7
+OUT_DIR=out/samples-$(SAMPLES_HASH).tmp
+out/samples-$(SAMPLES_HASH):
+	mkdir -p out
+	git clone $(SAMPLES_REPO) $(OUT_DIR)
+	git -C $(OUT_DIR) checkout $(SAMPLES_HASH)
+	find $(OUT_DIR) -name "*.xz" -execdir tar xJvf "{}" \;
+	mv $(OUT_DIR) $(basename $(OUT_DIR))
+
+prepare-samples: out/samples-$(SAMPLES_HASH)
+	cp -a test_data/. $(basename $(OUT_DIR))
+
 .PHONY: test
-test: clone-samples
+test: prepare-samples
 	go test $(shell go list ./... | grep -v test_data)
 
 .PHONY: bench
@@ -113,16 +126,7 @@ update-third-party:
 .PHONY: refresh-sample-testdata out/bincapz
 refresh-sample-testdata: clone-samples out/bincapz
 	cp ./test_data/refresh-testdata.sh samples/
-	./samples/refresh-testdata.sh ./out/bincapz
-
-.PHONY: clone-samples
-clone-samples:
-	rm -rf samples; git clone git@github.com:chainguard-dev/bincapz-samples.git samples
-	cp -a test_data/. samples/
-	for file in caddy.xz chezmoi.xz minio_x86_64.xz mongosh.xz neuvector_agent_aarch64.xz opa.xz ; do \
-		tar -xJvf samples/linux/clean/$$file -C samples/linux/clean; \
-	done
-	tar -xJvf samples/macOS/clean/bincapz.xz -C samples/macOS/clean
+	./out/samples/refresh-testdata.sh ./out/bincapz
 
 ARCH ?= $(shell uname -m)
 CRANE_VERSION=v0.20.2
diff --git a/test_data/samples_test.go b/test_data/samples_test.go
index dd227427d..ce64abd02 100644
--- a/test_data/samples_test.go
+++ b/test_data/samples_test.go
@@ -222,7 +222,7 @@ func TestDiff(t *testing.T) {
 				MinRisk:     tc.minResultScore,
 				Renderer:    simple,
 				Rules:       yrs,
-				ScanPaths:   []string{strings.TrimPrefix(tc.src, "../samples/"), strings.TrimPrefix(tc.dest, "../samples/")},
+				ScanPaths:   []string{strings.TrimPrefix(tc.src, "../out/samples/"), strings.TrimPrefix(tc.dest, "../out/samples/")},
 			}
 
 			logger := clog.New(slog.Default().Handler()).With("src", tc.src)