diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f608c24..0673f78 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           dotnet-version: |
             8.0.x
-            10.0.x
+          global-json-file: global.json
 
       # Named, so the failure can say what to do about it. NU1004 on a Dependabot branch means
       # the lock files were not regenerated, which is a chore rather than a defect -- and the
@@ -63,7 +63,7 @@ jobs:
         with:
           dotnet-version: |
             8.0.x
-            10.0.x
+          global-json-file: global.json
 
       - name: Restore
         run: dotnet restore --locked-mode
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d83732f..4aed047 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -57,7 +57,7 @@ jobs:
         with:
           dotnet-version: |
             8.0.x
-            10.0.x
+          global-json-file: global.json
 
       - name: Resolve version
         id: version
diff --git a/.github/workflows/refresh-lock-files.yml b/.github/workflows/refresh-lock-files.yml
index 0890d0f..3e00444 100644
--- a/.github/workflows/refresh-lock-files.yml
+++ b/.github/workflows/refresh-lock-files.yml
@@ -51,7 +51,7 @@ jobs:
         with:
           dotnet-version: |
             8.0.x
-            10.0.x
+          global-json-file: global.json
 
       # --force-evaluate is the whole point: it re-resolves rather than asserting the lock is right.
       - run: dotnet restore --force-evaluate
diff --git a/global.json b/global.json
new file mode 100644
index 0000000..c396020
--- /dev/null
+++ b/global.json
@@ -0,0 +1,7 @@
+{
+  "sdk": {
+    "version": "10.0.303",
+    "rollForward": "latestPatch",
+    "allowPrerelease": false
+  }
+}