diff --git a/.github/workflows/reusable-upgrade-testing.yml b/.github/workflows/reusable-upgrade-testing.yml
index 95645aee79981..e1f8142d67c54 100644
--- a/.github/workflows/reusable-upgrade-testing.yml
+++ b/.github/workflows/reusable-upgrade-testing.yml
@@ -91,6 +91,19 @@ jobs:
           coverage: none
           tools: wp-cli
 
+      # setup-php only warns when a tool fails to install, so fall back to the official phar if WP-CLI is missing.
+      - name: Ensure WP-CLI is available
+        run: |
+          if ! command -v wp > /dev/null; then
+            mkdir -p "${RUNNER_TEMP}/wp-cli"
+            curl -fsSL --retry 3 -o "${RUNNER_TEMP}/wp-cli/wp" https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
+            chmod +x "${RUNNER_TEMP}/wp-cli/wp"
+            echo "${RUNNER_TEMP}/wp-cli" >> "${GITHUB_PATH}"
+            "${RUNNER_TEMP}/wp-cli/wp" --version
+          else
+            wp --version
+          fi
+
       - name: Download WordPress ${{ inputs.wp }}
         run: wp core download --version="${WP_VERSION}"
         env:
diff --git a/src/wp-admin/css/login.css b/src/wp-admin/css/login.css
index 1489356612442..b499928a56d04 100644
--- a/src/wp-admin/css/login.css
+++ b/src/wp-admin/css/login.css
@@ -293,11 +293,11 @@ p {
 	vertical-align: baseline;
 }
 
-.login h1 {
+.login :is(h1, .wp-login-logo) {
 	text-align: center;
 }
 
-.login h1 a {
+.login :is(h1, .wp-login-logo) a {
 	background-image: url(../images/w-logo-gray.png?ver=20260303);
 	background-image: none, url(../images/wordpress-logo-gray.svg?ver=20260303);
 	background-size: 84px;
@@ -346,13 +346,13 @@ p {
 
 .login #nav a:hover,
 .login #backtoblog a:hover,
-.login h1 a:hover {
+.login :is(h1, .wp-login-logo) a:hover {
 	color: var(--wp-admin-theme-color-darker-20);
 }
 
 .login #nav a:focus,
 .login #backtoblog a:focus,
-.login h1 a:focus {
+.login :is(h1, .wp-login-logo) a:focus {
 	color: var(--wp-admin-theme-color-darker-20);
 }
 
@@ -408,7 +408,7 @@ body.interim-login {
 	margin: 5px auto 20px;
 }
 
-.interim-login.login h1 a {
+.interim-login.login :is(h1, .wp-login-logo) a {
 	width: auto;
 }
 
diff --git a/src/wp-login.php b/src/wp-login.php
index 5a8df12b01c5e..e1172a9b8abd5 100644
--- a/src/wp-login.php
+++ b/src/wp-login.php
@@ -212,14 +212,22 @@ function login_header( $title = null, $message = '', $wp_error = null ) {
 	do_action( 'login_header' );
 	?>
 	<?php
-	if ( 'confirm_admin_email' !== $action && ! empty( $title ) ) :
+	$has_title_heading = 'confirm_admin_email' !== $action && ! empty( $title );
+
+	/*
+	 * The logo is the page's main heading only when there is no other h1.
+	 * The admin email confirmation screen outputs its own h1 in the form.
+	 */
+	$logo_heading_tag = ( $has_title_heading || 'confirm_admin_email' === $action ) ? 'h2' : 'h1';
+
+	if ( $has_title_heading ) :
 		?>
 		<h1 class="screen-reader-text"><?php echo $title; ?></h1>
 		<?php
 	endif;
 	?>
 	<div id="login">
-		<h1 role="presentation" class="wp-login-logo"><a href="<?php echo esc_url( $login_header_url ); ?>"><?php echo $login_header_text; ?></a></h1>
+		<<?php echo $logo_heading_tag; ?><?php echo 'h2' === $logo_heading_tag ? ' role="presentation"' : ''; ?> class="wp-login-logo"><a href="<?php echo esc_url( $login_header_url ); ?>"><?php echo $login_header_text; ?></a></<?php echo $logo_heading_tag; ?>>
 	<?php
 	/**
 	 * Filters the message to display above the login form.