diff --git a/.github/workflows/cache/action.yaml b/.github/workflows/cache/action.yaml
deleted file mode 100644
index 2fef54140..000000000
--- a/.github/workflows/cache/action.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: 'Restore cache'
-runs:
-  using: "composite"
-  steps:
-    - name: Restore cached cppcheck
-      id: cppcache
-      uses: actions/cache@v4
-      with:
-        path: opendbc/safety/tests/misra/cppcheck/
-        key: cppcheck-cache-${{ runner.os }}-${{ hashFiles('opendbc/safety/tests/misra/install.sh') }}
-    - name: Set cache-hit output
-      run: echo "cache-hit=${{ steps.cppcache.outputs.cache-hit }}" >> $GITHUB_OUTPUT
-      shell: bash
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b437a690d..835e01c44 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -18,11 +18,9 @@ jobs:
           - os: ${{ github.repository == 'commaai/opendbc' && 'namespace-profile-macos-8x14' || 'macos-latest' }}
     steps:
     - uses: actions/checkout@v4
-    - uses: ./.github/workflows/cache
-      id: cache
     - uses: commaai/timeout@v1
       with:
-        timeout: ${{ github.repository == 'commaai/opendbc' && (steps.cache.outputs.cache-hit == 'true' && '60' || '90') || '999' }}
+        timeout: ${{ github.repository == 'commaai/opendbc' && '90' || '999' }}
     - run: ./test.sh
 
   safety_tests:
@@ -33,7 +31,6 @@ jobs:
       with:
         timeout: ${{ github.repository == 'commaai/opendbc' && '60' || '999' }}
     - uses: actions/checkout@v4
-    - uses: ./.github/workflows/cache
     - name: Run safety tests
       run: ./opendbc/safety/tests/test.sh
 
@@ -53,7 +50,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # need master to get diff
-      - uses: ./.github/workflows/cache
       - name: Run mutation tests
         run: |
           source setup.sh
@@ -69,7 +65,6 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: ./.github/workflows/cache
     - name: Build opendbc
       run: |
         source setup.sh
diff --git a/.github/workflows/update-cppcheck.yml b/.github/workflows/update-cppcheck.yml
deleted file mode 100644
index ee2bb1a15..000000000
--- a/.github/workflows/update-cppcheck.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Update cppcheck
-
-on:
-  #push:
-  schedule:
-    - cron: "0 14 * * 1" # every Monday at 2am UTC (6am PST)
-  workflow_dispatch:
-
-jobs:
-  update-cppcheck:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-      - name: Get latest cppcheck version
-        id: version
-        run: |
-          # Tags are sorted by time (newest first), so get the first version-like tag
-          LATEST=$(curl -fsSL "https://api.github.com/repos/danmar/cppcheck/tags?per_page=20" | \
-            jq -r '.[].name' | \
-            grep -E '^[0-9]+\.[0-9]+(\.[0-9]+)?$' | \
-            head -n 1)
-          echo "vers=$LATEST" >> "$GITHUB_OUTPUT"
-      - name: Update VERS in install.sh
-        run: |
-          sed -i "s/^VERS=\".*\"/VERS=\"${{ steps.version.outputs.vers }}\"/" opendbc/safety/tests/misra/install.sh
-          grep VERS opendbc/safety/tests/misra/install.sh
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83
-        with:
-          author: Vehicle Researcher <user@comma.ai>
-          token: ${{ secrets.ACTIONS_CREATE_PR_PAT }}
-          commit-message: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
-          title: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
-          body: "See all cppcheck releases: https://github.com/danmar/cppcheck/releases"
-          branch: "update-cppcheck"
-          base: "master"
-          delete-branch: true
-          labels: bot
diff --git a/lefthook.yml b/lefthook.yml
index 0c70870f9..082b7eef6 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -21,7 +21,7 @@ test:
       run: codespell {files} -L tge,stdio -S *.dbc
       files: git ls-tree -r HEAD --name-only
     cpplint:
-      run: cpplint --exclude=opendbc/safety/tests/misra/cppcheck/ --exclude=opendbc/can/*_pyx.cpp --recursive --quiet --counting=detailed --linelength=240 --filter=-build,-legal,-readability,-runtime,-whitespace,+build/include_subdir,+build/forward_decl,+build/include_what_you_use,+build/deprecated,+whitespace/comma,+whitespace/line_length,+whitespace/empty_if_body,+whitespace/empty_loop_body,+whitespace/empty_conditional_body,+whitespace/forcolon,+whitespace/parens,+whitespace/semicolon,+whitespace/tab,+readability/braces opendbc/
+      run: cpplint --exclude=opendbc/can/*_pyx.cpp --recursive --quiet --counting=detailed --linelength=240 --filter=-build,-legal,-readability,-runtime,-whitespace,+build/include_subdir,+build/forward_decl,+build/include_what_you_use,+build/deprecated,+whitespace/comma,+whitespace/line_length,+whitespace/empty_if_body,+whitespace/empty_loop_body,+whitespace/empty_conditional_body,+whitespace/forcolon,+whitespace/parens,+whitespace/semicolon,+whitespace/tab,+readability/braces opendbc/
     misra:
       run: opendbc/safety/tests/misra/test_misra.sh
 
diff --git a/opendbc/safety/tests/misra/coverage_table b/opendbc/safety/tests/misra/coverage_table
index 8753003fe..0395aba0d 100644
--- a/opendbc/safety/tests/misra/coverage_table
+++ b/opendbc/safety/tests/misra/coverage_table
@@ -9,7 +9,7 @@
 2.6     X (Cppcheck)
 2.7     X (Addon)
 3.1     X (Addon)
-3.2     
+3.2     X (Addon)
 4.1     X (Addon)
 4.2     X (Addon)
 5.1     X (Addon)
diff --git a/opendbc/safety/tests/misra/install.sh b/opendbc/safety/tests/misra/install.sh
deleted file mode 100755
index f586fc32d..000000000
--- a/opendbc/safety/tests/misra/install.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-: "${CPPCHECK_DIR:=$DIR/cppcheck/}"
-
-# skip if we're running in parallel with test_mutation.py
-if [ ! -z "$OPENDBC_ROOT" ]; then
-  exit 0
-fi
-
-if [ ! -d "$CPPCHECK_DIR" ]; then
-  git clone https://github.com/danmar/cppcheck.git $CPPCHECK_DIR
-fi
-
-cd $CPPCHECK_DIR
-
-VERS="2.19.1"
-if [ "$(git describe --tags --always)" != "$VERS" ]; then
-  git fetch --all --tags --force
-  git checkout $VERS
-fi
-
-#make clean
-make MATCHCOMPILTER=yes CXXFLAGS="-O2" -j8
diff --git a/opendbc/safety/tests/misra/test_misra.sh b/opendbc/safety/tests/misra/test_misra.sh
index 670784288..0b2ffeba0 100755
--- a/opendbc/safety/tests/misra/test_misra.sh
+++ b/opendbc/safety/tests/misra/test_misra.sh
@@ -11,7 +11,7 @@ YELLOW="\e[1;33m"
 RED="\e[1;31m"
 NC='\033[0m'
 
-: "${CPPCHECK_DIR:=$DIR/cppcheck/}"
+: "${CPPCHECK_DIR:=$(python3 -c "import cppcheck; print(cppcheck.DIR)")}"
 
 # ensure checked in coverage table is up to date
 python3 $CPPCHECK_DIR/addons/misra.py -generate-table > coverage_table
diff --git a/opendbc/safety/tests/misra/test_mutation.py b/opendbc/safety/tests/misra/test_mutation.py
index c4bdc93cb..cabff3fef 100644
--- a/opendbc/safety/tests/misra/test_mutation.py
+++ b/opendbc/safety/tests/misra/test_mutation.py
@@ -47,7 +47,7 @@ mutations = random.sample(mutations, 2)  # can remove this once cppcheck is fast
 def test_misra_mutation(fn, rule, transform, should_fail):
   with tempfile.TemporaryDirectory() as tmp:
     shutil.copytree(ROOT, tmp, dirs_exist_ok=True,
-                    ignore=shutil.ignore_patterns('.venv', 'cppcheck', '.git', '*.ctu-info', '.hypothesis'))
+                    ignore=shutil.ignore_patterns('.venv', '.git', '*.ctu-info', '.hypothesis'))
 
     # apply patch
     if fn is not None:
diff --git a/pyproject.toml b/pyproject.toml
index 206772789..ab3d3bb61 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,6 +41,7 @@ testing = [
   "lefthook",
   "cpplint",
   "codespell",
+  "cppcheck @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=cppcheck",
 ]
 docs = [
   "Jinja2",
diff --git a/setup.sh b/setup.sh
index 8e243493c..b318bba76 100755
--- a/setup.sh
+++ b/setup.sh
@@ -41,5 +41,3 @@ fi
 export UV_PROJECT_ENVIRONMENT="$BASEDIR/.venv"
 uv sync --all-extras --inexact
 source "$PYTHONPATH/.venv/bin/activate"
-
-$BASEDIR/opendbc/safety/tests/misra/install.sh
diff --git a/uv.lock b/uv.lock
index eff807716..445222a94 100644
--- a/uv.lock
+++ b/uv.lock
@@ -223,6 +223,11 @@ toml = [
     { name = "tomli", marker = "python_full_version <= '3.11'" },
 ]
 
+[[package]]
+name = "cppcheck"
+version = "2.16.0"
+source = { git = "https://github.com/commaai/dependencies.git?subdirectory=cppcheck&rev=releases#2f738421b9b6af97bf242319a1bea68e161d9b82" }
+
 [[package]]
 name = "cpplint"
 version = "2.0.2"
@@ -586,6 +591,7 @@ testing = [
     { name = "cffi" },
     { name = "codespell" },
     { name = "comma-car-segments" },
+    { name = "cppcheck" },
     { name = "cpplint" },
     { name = "gcovr" },
     { name = "hypothesis" },
@@ -607,6 +613,7 @@ requires-dist = [
     { name = "cffi", marker = "extra == 'testing'" },
     { name = "codespell", marker = "extra == 'testing'" },
     { name = "comma-car-segments", marker = "extra == 'testing'", url = "https://huggingface.co/datasets/commaai/commaCarSegments/resolve/main/dist/comma_car_segments-0.1.0-py3-none-any.whl" },
+    { name = "cppcheck", marker = "extra == 'testing'", git = "https://github.com/commaai/dependencies.git?subdirectory=cppcheck&rev=releases" },
     { name = "cpplint", marker = "extra == 'testing'" },
     { name = "crcmod-plus" },
     { name = "gcovr", marker = "extra == 'testing'" },