diff --git a/lib/entry-points.js b/lib/entry-points.js
index 56914e8848..c10b0ce2ea 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -152288,6 +152288,16 @@ var CODEQL_NEXT_MINIMUM_VERSION = "2.20.7";
 var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16";
 var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
+function isDiskConfigurationError(e) {
+  if (!(e instanceof Error)) {
+    return false;
+  }
+  return (
+    // out of disk space
+    e.message.includes("ENOSPC") || // access denied
+    e.message.includes("EACCES")
+  );
+}
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) {
   try {
     const {
@@ -152323,7 +152333,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
     };
   } catch (rawError) {
     const e = wrapApiConfigurationError(rawError);
-    const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") ? ConfigurationError : Error;
+    const ErrorClass = e instanceof ConfigurationError || isDiskConfigurationError(e) ? ConfigurationError : Error;
     throw new ErrorClass(
       `Unable to download and extract CodeQL CLI: ${getErrorMessage(e)}${e instanceof Error && e.stack ? `
 
diff --git a/src/codeql.test.ts b/src/codeql.test.ts
index e8208888e7..df4bafe295 100644
--- a/src/codeql.test.ts
+++ b/src/codeql.test.ts
@@ -51,6 +51,31 @@ test.beforeEach(() => {
   });
 });
 
+test("isDiskConfigurationError - true for expected errors", async (t) => {
+  t.true(
+    codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")),
+  );
+  t.true(
+    codeql.isDiskConfigurationError(
+      new Error(
+        "EACCES: permission denied, mkdir /opt/hostedtoolcache/CodeQL/",
+      ),
+    ),
+  );
+});
+
+test("isDiskConfigurationError - false for other errors", async (t) => {
+  t.false(codeql.isDiskConfigurationError("Not an Error instance"));
+
+  const otherMessages = [
+    "Does not contain an error code we test for",
+    "ENOSP: Not quite the full error code",
+  ];
+  for (const otherMessage of otherMessages) {
+    t.false(codeql.isDiskConfigurationError(new Error(otherMessage)));
+  }
+});
+
 async function installIntoToolcache({
   apiDetails = SAMPLE_DOTCOM_API_DETAILS,
   cliVersion,
diff --git a/src/codeql.ts b/src/codeql.ts
index 8f7e9e7445..117b0d8e65 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -273,6 +273,26 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 
+/**
+ * Decides whether `e` is a disk-related error outside of our control
+ * that should be classified as a `ConfigurationError`.
+ *
+ * @param e The error to check.
+ * @returns True if the error should be treated as a `ConfigurationError` or false if not.
+ */
+export function isDiskConfigurationError(e: unknown): boolean {
+  if (!(e instanceof Error)) {
+    return false;
+  }
+
+  return (
+    // out of disk space
+    e.message.includes("ENOSPC") ||
+    // access denied
+    e.message.includes("EACCES")
+  );
+}
+
 /**
  * Set up CodeQL CLI access.
  *
@@ -343,8 +363,7 @@ export async function setupCodeQL(
   } catch (rawError) {
     const e = api.wrapApiConfigurationError(rawError);
     const ErrorClass =
-      e instanceof util.ConfigurationError ||
-      (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space
+      e instanceof util.ConfigurationError || isDiskConfigurationError(e)
         ? util.ConfigurationError
         : Error;