diff --git a/.github/instructions/CI.instructions.md b/.github/instructions/CI.instructions.md
index 06b3b24..ab8bdcd 100644
--- a/.github/instructions/CI.instructions.md
+++ b/.github/instructions/CI.instructions.md
@@ -31,6 +31,14 @@ test:
   - Run test suite (bash test scripts)
 ```
 
+### lint GitHub Actions workflows (.github/workflows/lint-github-actions.yml)
+
+**Purpose**: Optional manual actionlint run in Actions (same tool as the pre-commit hook)
+
+**Triggers:**
+
+- `workflow_dispatch` only (not required for merge; enforcement is via pre-commit in CI)
+
 ### Release Workflows
 
 **Triggers:**
diff --git a/.github/workflows/bot-automerge.yml b/.github/workflows/bot-automerge.yml
index ab767d7..33bff9c 100644
--- a/.github/workflows/bot-automerge.yml
+++ b/.github/workflows/bot-automerge.yml
@@ -3,19 +3,19 @@ name: Bot auto-merge
 
 # Arms GitHub's native auto-merge (squash) on Dependabot and pre-commit-ci pull requests
 # that pass the eligibility rules below. GitHub performs the merge only once the pull
-# request is mergeable -- all nine required contexts green, no unresolved review threads --
+# request is mergeable -- all eight required contexts green, no unresolved review threads --
 # so a review comment pauses it until that thread is resolved.
 #
 # There is deliberately no in-workflow check polling. The previous version of this file
 # called `gh pr checks --required --watch`, which races check registration: it reports "no
 # required checks reported" before CI has posted and fails the job on a pull request that
 # was never unhealthy. Native auto-merge gates on the ruleset server-side, which is both
-# correct and free. `main-protect` requires nine contexts here -- `actionlint`, three
-# `pre-commit` platforms and five `tests` matrix legs -- and those are what auto-merge waits
+# correct and free. `main-protect` requires eight contexts here -- three `pre-commit`
+# platforms and five `tests` matrix legs -- and those are what auto-merge waits
 # on; without at least one required check GitHub rejects `--auto` outright, so removing them
 # would break this workflow rather than relax it.
 #
-# Nine contexts is the widest required base of any of these repositories, which is what
+# Eight contexts is the widest required base of any of these repositories, which is what
 # makes arming an actions major defensible below even though this repository publishes.
 #
 # The author guard reads `pull_request.user.login` and not `github.actor`. `github.actor`
diff --git a/.github/workflows/lint-github-actions.yml b/.github/workflows/lint-github-actions.yml
index a028f25..07a9dd1 100644
--- a/.github/workflows/lint-github-actions.yml
+++ b/.github/workflows/lint-github-actions.yml
@@ -1,11 +1,6 @@
 ---
 name: lint GitHub Actions workflows
 on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-    paths: ['.github/workflows/*.ya?ml']
   workflow_dispatch:
 
 permissions:
@@ -15,27 +10,8 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: dorny/paths-filter@v4
-        id: filter
-        if: >-
-          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository
-        with:
-          filters: |
-            addedOrModifiedWorkflows:
-              - added|modified:
-                - .github/workflows/*.yaml
-                - .github/workflows/*.yml
       - uses: actions/checkout@v6
-        if: >-
-          github.event_name == 'push' ||
-          github.event_name == 'workflow_dispatch' ||
-          steps.filter.outputs.addedOrModifiedWorkflows == 'true'
       - name: Check workflow files
-        if: >-
-          github.event_name == 'push' ||
-          github.event_name == 'workflow_dispatch' ||
-          steps.filter.outputs.addedOrModifiedWorkflows == 'true'
-        uses: docker://rhysd/actionlint:latest
+        uses: docker://rhysd/actionlint:v1.7.12
         with:
           args: -color