diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e8783dc..33aef82 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,8 +38,9 @@ jobs:
         if: steps.ver.outputs.version != ''
         env:
           GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.ver.outputs.version }}
         run: |
-          if gh release view "v${{ steps.ver.outputs.version }}" >/dev/null 2>&1; then
+          if gh release view "v${VERSION}" >/dev/null 2>&1; then
             echo "exists=true" >> "$GITHUB_OUTPUT"
           else
             echo "exists=false" >> "$GITHUB_OUTPUT"
@@ -49,9 +50,10 @@ jobs:
         if: steps.ver.outputs.version != '' && steps.check.outputs.exists == 'false'
         env:
           GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.ver.outputs.version }}
         run: |
-          python tools/changelog_extract.py "${{ steps.ver.outputs.version }}" > RELEASE_NOTES.md
-          gh release create "v${{ steps.ver.outputs.version }}" \
+          python tools/changelog_extract.py "${VERSION}" > RELEASE_NOTES.md
+          gh release create "v${VERSION}" \
             --target "${GITHUB_SHA}" \
-            --title "v${{ steps.ver.outputs.version }}" \
+            --title "v${VERSION}" \
             --notes-file RELEASE_NOTES.md
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index ee85798..8d7d0ac 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -52,8 +52,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Install ruff
-        run: python -m pip install --upgrade ruff
+      - name: Install dev dependencies
+        run: python -m pip install --upgrade -r requirements-dev.txt
       - name: Lint reference tooling and tests
         run: python -m ruff check tools/ tests/
 
diff --git a/requirements-dev.txt b/requirements-dev.txt
index d033c1e..23f18a9 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,6 +1,18 @@
 # Development / CI dependencies for the feedBack plugin-spec repo.
 # The reference validator needs only jsonschema; pytest + ruff are for the
 # test and lint jobs.
-jsonschema
-pytest
-ruff
+#
+# Pinned to a patch-compatible range (~=X.Y.Z, PEP 440's "compatible
+# release" clause with all three components) rather than left floating:
+# an unpinned dev dependency means CI silently picks up whatever the
+# latest release is on a given day, so a breaking change upstream shows
+# up as a mysterious CI failure unrelated to the PR that triggered it.
+# NOTE: ~=X.Y (two components, no patch digit) does NOT do what it looks
+# like it does — ~=4.26 permits 4.27, 4.99, anything 4.*, same as leaving
+# it unpinned in every way that matters here. The third component is load-
+# bearing: only ~=X.Y.Z locks the minor version and allows patch-only
+# drift. Bump deliberately (the X.Y.Z value itself) when actually
+# adopting a newer version.
+jsonschema~=4.26.0
+pytest~=9.1.1
+ruff~=0.16.1
diff --git a/requirements-docs.txt b/requirements-docs.txt
index 9913b5e..18d8632 100644
--- a/requirements-docs.txt
+++ b/requirements-docs.txt
@@ -1,2 +1,7 @@
 # Docs-site dependencies (GitHub Pages build only). See .github/workflows/pages.yml.
-mkdocs-material
+#
+# Pinned to a patch-compatible range (~=X.Y.Z, all three components — see
+# requirements-dev.txt for why the third digit is load-bearing) rather
+# than left floating. Bump deliberately when actually adopting a newer
+# version.
+mkdocs-material~=9.7.7