diff --git a/images/macos/provision/core/codeql-bundle.sh b/images/macos/provision/core/codeql-bundle.sh
index 53210a3d9232..dab0f9dc015c 100644
--- a/images/macos/provision/core/codeql-bundle.sh
+++ b/images/macos/provision/core/codeql-bundle.sh
@@ -1,16 +1,44 @@
 #!/bin/bash -e -o pipefail
 source ~/utils/utils.sh
 
-# Retrieve the name of the CodeQL bundle preferred by the Action (in the format codeql-bundle-YYYYMMDD).
+# Retrieve the CLI versions and bundle tags of the latest two CodeQL bundles.
 base_url="$(curl -sSL https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json)"
 codeql_tag_name="$(echo "$base_url" | jq -r '.bundleVersion')"
 codeql_cli_version="$(echo "$base_url" | jq -r '.cliVersion')"
 prior_codeql_tag_name="$(echo "$base_url" | jq -r '.priorBundleVersion')"
 prior_codeql_cli_version="$(echo "$base_url" | jq -r '.priorCliVersion')"
 
-# Convert the tag names to bundles with a version number (x.y.z-YYYYMMDD).
-codeql_bundle_version="${codeql_cli_version}-${codeql_tag_name##*-}"
-prior_codeql_bundle_version="${prior_codeql_cli_version}-${prior_codeql_tag_name##*-}"
+# Compute the toolcache version number for each bundle. This is either `x.y.z` or `x.y.z-YYYYMMDD`.
+if [[ "${codeql_tag_name##*-}" == "v"* ]]; then
+  # Tag name of the format `codeql-bundle-vx.y.z`, where x.y.z is the CLI version.
+  # We don't need to include the tag name in the toolcache version number because it's derivable
+  # from the CLI version.
+  codeql_bundle_version="$codeql_cli_version"
+elif [[ "${codeql_tag_name##*-}" =~ ^[0-9]+$ ]]; then
+  # Tag name of the format `codeql-bundle-YYYYMMDD`.
+  # We need to include the tag name in the toolcache version number because it can't be derived
+  # from the CLI version.
+  codeql_bundle_version="$codeql_cli_version-${codeql_tag_name##*-}"
+else
+  echo "Unrecognised current CodeQL bundle tag name: $codeql_tag_name." \
+    "Could not compute toolcache version number."
+  exit 1
+fi
+if [[ "${prior_codeql_tag_name##*-}" == "v"* ]]; then
+  # Tag name of the format `codeql-bundle-vx.y.z`, where x.y.z is the CLI version.
+  # We don't need to include the tag name in the toolcache version number because it's derivable
+  # from the CLI version.
+  prior_codeql_bundle_version="$prior_codeql_cli_version"
+elif [[ "${prior_codeql_tag_name##*-}" =~ ^[0-9]+$ ]]; then
+  # Tag name of the format `codeql-bundle-YYYYMMDD`.
+  # We need to include the tag name in the toolcache version number because it can't be derived
+  # from the CLI version.
+  prior_codeql_bundle_version="$prior_codeql_cli_version-${prior_codeql_tag_name##*-}"
+else
+  echo "Unrecognised prior CodeQL bundle tag name: $prior_codeql_tag_name." \
+    "Could not compute toolcache version number."
+  exit 1
+fi
 
 # Download and name both CodeQL bundles.
 codeql_bundle_versions=("${codeql_bundle_version}" "${prior_codeql_bundle_version}")