diff --git a/src/index.ts b/src/index.ts
index ef65ca1..f0f4b08 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -95,6 +95,7 @@ const githubActionPinnedVersions = {
     "0723387faaf9b38adef4775cd42cfd5155ed6017", // v5.5.3
   "dessant/lock-threads": "1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771", // v5.0.1
   "hashicorp/setup-copywrite": "32638da2d4e81d56a0764aa1547882fc4d209636", // v1.1.3
+  "hashicorp/setup-terraform": "b9cd54a3c349d3f38e8881555d616ced269862dd", // v3.1.2
   "imjohnbo/issue-bot": "572eed14422c4d6ca37e870f97e7da209422f5bd", // v3.4.4
   "peter-evans/create-pull-request": "c5a7806660adbe173f04e3e038b0ccdcd758773c", // v6.1.0
   "slackapi/slack-github-action": "70cd7be8e40a46e8b0eced40b0de447bdb42f68e", // v1.26.0
diff --git a/src/provider-upgrade.ts b/src/provider-upgrade.ts
index 1525f2d..a7c63e6 100644
--- a/src/provider-upgrade.ts
+++ b/src/provider-upgrade.ts
@@ -4,7 +4,7 @@
  */
 
 import { javascript } from "projen";
-import { JobPermission } from "projen/lib/github/workflows-model";
+import { JobPermission, JobStep } from "projen/lib/github/workflows-model";
 import { generateRandomCron } from "./util/random-cron";
 
 interface ProviderUpgradeOptions {
@@ -47,88 +47,103 @@ export class ProviderUpgrade {
     const newVersion = "${{ steps.new_version.outputs.value }}";
     const semanticType = "${{ steps.release.outputs.type }}";
 
+    const steps: JobStep[] = [
+      {
+        name: "Checkout",
+        uses: "actions/checkout@v4",
+      },
+      {
+        name: "Setup Node.js",
+        uses: "actions/setup-node",
+        with: {
+          "node-version": project.minNodeVersion,
+        },
+      },
+      { run: "yarn install" },
+      {
+        id: "check_version",
+        run: "yarn check-if-new-provider-version",
+      },
+      {
+        name: "get provider current version",
+        if: newerVersionAvailable,
+        id: "current_version",
+        run: `echo "value=$(jq -r '.cdktf.provider.version' package.json)" >> $GITHUB_OUTPUT`,
+      },
+      {
+        run: "yarn fetch",
+        if: newerVersionAvailable,
+        env: {
+          CHECKPOINT_DISABLE: "1",
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+        },
+      },
+      {
+        name: "get provider updated version",
+        if: newerVersionAvailable,
+        id: "new_version",
+        run: `echo "value=$(jq -r '. | to_entries[] | .value' src/version.json)" >> $GITHUB_OUTPUT`,
+      },
+      {
+        name: "Determine if this is a minor or patch release",
+        if: newerVersionAvailable,
+        id: "release",
+        env: {
+          CURRENT_VERSION: currentVersion,
+          NEW_VERSION: newVersion,
+        },
+        run: [
+          `CURRENT_VERSION_MINOR=$(cut -d "." -f 2 <<< "$CURRENT_VERSION")`,
+          `NEW_VERSION_MINOR=$(cut -d "." -f 2 <<< "$NEW_VERSION")`,
+          `[[ "$CURRENT_VERSION_MINOR" != "$NEW_VERSION_MINOR" ]] && IS_MINOR_RELEASE=true || IS_MINOR_RELEASE=false`,
+          `[[ "$IS_MINOR_RELEASE" == "true" ]] && SEMANTIC_TYPE=feat || SEMANTIC_TYPE=fix`,
+          `echo "is_minor=$IS_MINOR_RELEASE" >> $GITHUB_OUTPUT`,
+          `echo "type=$SEMANTIC_TYPE" >> $GITHUB_OUTPUT`,
+        ].join("\n"),
+      },
+      // generate docs
+      { run: "yarn compile", if: newerVersionAvailable },
+      { run: "yarn docgen", if: newerVersionAvailable },
+      // submit a PR
+      {
+        name: "Create Pull Request",
+        if: newerVersionAvailable,
+        uses: "peter-evans/create-pull-request@v3",
+        with: {
+          branch: "auto/provider-upgrade",
+          "commit-message": `${semanticType}: upgrade provider from \`${currentVersion}\` to version \`${newVersion}\``,
+          title: `${semanticType}: upgrade provider from \`${currentVersion}\` to version \`${newVersion}\``,
+          body: `This PR upgrades the underlying Terraform provider to version ${newVersion}`,
+          labels: "automerge,auto-approve",
+          token: "${{ secrets.GH_TOKEN }}",
+          "delete-branch": true,
+          committer: "team-tf-cdk <github-team-tf-cdk@hashicorp.com>",
+          author: "Team Terraform CDK <github-team-tf-cdk@hashicorp.com>",
+          signoff: true,
+        },
+      },
+    ];
+
+    // @TODO Figure out if this is really necessary; this has not been tested
+    // But I saw https://github.com/hashicorp/setup-terraform/issues/425
+    // so I added this "if" statement as a precaution
+    if (options.workflowRunsOn.includes("ubuntu-latest")) {
+      steps.splice(2, 0, {
+        name: "Setup Terraform",
+        uses: "hashicorp/setup-terraform",
+        with: {
+          terraform_wrapper: false,
+        },
+      });
+    }
+
     workflow.addJobs({
       upgrade: {
         runsOn: options.workflowRunsOn,
         env: {
           NODE_OPTIONS: `--max-old-space-size=${options.nodeHeapSize}`,
         },
-        steps: [
-          {
-            name: "Checkout",
-            uses: "actions/checkout@v4",
-          },
-          {
-            name: "Setup Node.js",
-            uses: "actions/setup-node",
-            with: {
-              "node-version": project.minNodeVersion,
-            },
-          },
-          { run: "yarn install" },
-          {
-            id: "check_version",
-            run: "yarn check-if-new-provider-version",
-          },
-          {
-            name: "get provider current version",
-            if: newerVersionAvailable,
-            id: "current_version",
-            run: `echo "value=$(jq -r '.cdktf.provider.version' package.json)" >> $GITHUB_OUTPUT`,
-          },
-          {
-            run: "yarn fetch",
-            if: newerVersionAvailable,
-            env: {
-              CHECKPOINT_DISABLE: "1",
-              GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
-            },
-          },
-          {
-            name: "get provider updated version",
-            if: newerVersionAvailable,
-            id: "new_version",
-            run: `echo "value=$(jq -r '. | to_entries[] | .value' src/version.json)" >> $GITHUB_OUTPUT`,
-          },
-          {
-            name: "Determine if this is a minor or patch release",
-            if: newerVersionAvailable,
-            id: "release",
-            env: {
-              CURRENT_VERSION: currentVersion,
-              NEW_VERSION: newVersion,
-            },
-            run: [
-              `CURRENT_VERSION_MINOR=$(cut -d "." -f 2 <<< "$CURRENT_VERSION")`,
-              `NEW_VERSION_MINOR=$(cut -d "." -f 2 <<< "$NEW_VERSION")`,
-              `[[ "$CURRENT_VERSION_MINOR" != "$NEW_VERSION_MINOR" ]] && IS_MINOR_RELEASE=true || IS_MINOR_RELEASE=false`,
-              `[[ "$IS_MINOR_RELEASE" == "true" ]] && SEMANTIC_TYPE=feat || SEMANTIC_TYPE=fix`,
-              `echo "is_minor=$IS_MINOR_RELEASE" >> $GITHUB_OUTPUT`,
-              `echo "type=$SEMANTIC_TYPE" >> $GITHUB_OUTPUT`,
-            ].join("\n"),
-          },
-          // generate docs
-          { run: "yarn compile", if: newerVersionAvailable },
-          { run: "yarn docgen", if: newerVersionAvailable },
-          // submit a PR
-          {
-            name: "Create Pull Request",
-            if: newerVersionAvailable,
-            uses: "peter-evans/create-pull-request@v3",
-            with: {
-              branch: "auto/provider-upgrade",
-              "commit-message": `${semanticType}: upgrade provider from \`${currentVersion}\` to version \`${newVersion}\``,
-              title: `${semanticType}: upgrade provider from \`${currentVersion}\` to version \`${newVersion}\``,
-              body: `This PR upgrades the underlying Terraform provider to version ${newVersion}`,
-              labels: "automerge,auto-approve",
-              token: "${{ secrets.GH_TOKEN }}",
-              "delete-branch": true,
-              committer: "team-tf-cdk <github-team-tf-cdk@hashicorp.com>",
-              author: "Team Terraform CDK <github-team-tf-cdk@hashicorp.com>",
-              signoff: true,
-            },
-          },
-        ],
+        steps,
         permissions: {
           pullRequests: JobPermission.WRITE,
           issues: JobPermission.WRITE,
diff --git a/test/__snapshots__/index.test.ts.snap b/test/__snapshots__/index.test.ts.snap
index 0d636b5..c784237 100644
--- a/test/__snapshots__/index.test.ts.snap
+++ b/test/__snapshots__/index.test.ts.snap
@@ -2844,6 +2844,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b
         with: {}
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+        with:
+          terraform_wrapper: false
       - run: yarn install
       - id: check_version
         run: yarn check-if-new-provider-version
@@ -8508,6 +8512,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b
         with: {}
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+        with:
+          terraform_wrapper: false
       - run: yarn install
       - id: check_version
         run: yarn check-if-new-provider-version
@@ -11347,6 +11355,10 @@ jobs:
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b
         with:
           node-version: 18.12.0
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+        with:
+          terraform_wrapper: false
       - run: yarn install
       - id: check_version
         run: yarn check-if-new-provider-version