diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7be0410..61f6b18 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -112,3 +112,14 @@ updates:
     package-ecosystem: "github-actions"
     schedule:
       interval: "daily"
+
+  - commit-message:
+      include: "scope"
+      prefix: "github-actions"
+    directory: "/actions/phive/install"
+    labels:
+      - "dependency"
+    open-pull-requests-limit: 10
+    package-ecosystem: "github-actions"
+    schedule:
+      interval: "daily"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9c3cb6..9571016 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 For a full diff see [`1.7.0...main`][1.7.0...main].
 
+### Added
+
+- Added composite action `phive/install` for installing dependencies with [`phive`](https://phar.io) ([#142]), by [@localheinz]
+
 ## [`1.7.0`][1.7.0]
 
 For a full diff see [`1.6.0...1.7.0`][1.6.0...1.7.0].
@@ -164,5 +168,6 @@ For a full diff see [`1.0.0...main`][1.0.0...main].
 [#96]: https://github.com/ergebnis/.github/pull/96
 [#123]: https://github.com/ergebnis/.github/pull/123
 [#124]: https://github.com/ergebnis/.github/pull/124
+[#142]: https://github.com/ergebnis/.github/pull/142
 
 [@localheinz]: https://github.com/localheinz
diff --git a/README.md b/README.md
index 91a6961..2b61f49 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,7 @@ This repository provides the following composite actions:
 - [`ergebnis/.github/actions/oh-dear/check/request-run`](#oh-dear-check-request-run)
 - [`ergebnis/.github/actions/oh-dear/maintenance-period/start`](#oh-dear-maintenance-period-start)
 - [`ergebnis/.github/actions/oh-dear/maintenance-period/stop`](#oh-dear-maintenance-period-stop)
+- [`ergebnis/.github/actions/phive/install`](#phive-install)
 
 ### <a name="composer-determine-cache-directory"> `ergebnis/.github/actions/composer/determine-cache-directory`
 
@@ -655,6 +656,63 @@ none
 
 A maintenance period is stopped by the user who owns the Oh Dear API token specified with the `oh-dear-api-token` input for the site identified by the `oh-dear-site-id` input.
 
+### <a name="phive-install"> `ergebnis/.github/actions/phive/install`
+
+This action installs dependencies with [`phive`](https://phar.io).
+
+```yaml
+name: "Integrate"
+
+on:
+  pull_request: null
+  push:
+    branches:
+      - "main"
+
+jobs:
+  tests:
+    name: "Tests"
+
+    runs-on: "ubuntu-latest"
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3.0.2"
+
+      - name: "Set up PHP"
+        uses: "shivammathur/setup-php@2.21.2"
+        with:
+          coverage: "none"
+          php-version: "8.1"
+          tools: "phive"
+
+      - name: "Install dependencies with phive"
+        uses: "ergebnis/.github/actions/phive/install@1.8.0"
+        with:
+          trust-gpg-keys: "0x033E5F8D801A2F8D,0x2A8299CE842DD38C"
+```
+
+For details, see [`actions/phive/install/action.yaml`](actions/phive/install/action.yaml).
+
+#### Inputs
+
+- `phive-home`, optional: Which directory to use as `PHIVE_HOME` directory, defaults to `".build/phive"`.
+- `trust-gpg-keys`, required: Which GPG keys to trust, a comma-separated list of trusted GPG keys
+
+#### Outputs
+
+none
+
+#### Side Effects
+
+Dependencies are installed, assuming
+
+- `phive` is available
+- `phive` could find a `phars.xml`
+- keys presented by packages are listed using the `trust-gpg-keys` option
+
+The directory configured by the `phive-home` directory is cached using [`actions/cache`](https://github.com/actions/cache).
+
 ## Changelog
 
 Please have a look at [`CHANGELOG.md`](CHANGELOG.md).
diff --git a/actions/phive/install/action.yaml b/actions/phive/install/action.yaml
new file mode 100644
index 0000000..758d2e2
--- /dev/null
+++ b/actions/phive/install/action.yaml
@@ -0,0 +1,39 @@
+# https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+# https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputs
+# https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-composite-run-steps-actions
+# https://phar.io
+
+name: "Install dependencies with phive"
+
+description: "Installs dependencies with phive"
+
+inputs:
+  phive-home:
+    default: ".build/phive"
+    description: "Which directory to use as PHIVE_HOME directory"
+    required: false
+  trust-gpg-keys:
+    default: ""
+    description: "A comma-separated list of trusted GPG keys"
+    required: true
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: "Create phive home directory"
+      run: "mkdir -p ${{ inputs.phive-home }}"
+      shell: "bash"
+
+    - name: "Cache dependencies installed with phive"
+      uses: "actions/cache@v3.2.3"
+      with:
+        path: "${{ inputs.phive-home }}"
+        key: "phive-hashFiles('**/phars.xml')"
+        restore-keys: "phive-"
+
+    - name: "Install dependencies with phive"
+      env:
+        PHIVE_HOME: "${{ inputs.phive-home }}"
+      run: "phive install --trust-gpg-keys ${{ inputs.trust-gpg-keys }}"
+      shell: "bash"