@@ -21,7 +21,17 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set tool versions
+        uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
+        with:
+          postfix: _TOOL_VERSION
+
       - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+        with:
+          # Without a pin this installs whatever prek released most recently,
+          # so a hostile release reaches CI with no change here. The version
+          # comes from .tool-versions, so CI and a local run agree on it.
+          prek-version: ${{ env.PREK_TOOL_VERSION }}
         env:
           # zizmor's five online audits skip silently without a token, and its
           # summary line reads the same either way, so CI would look green with
 
@@ -1,2 +1,3 @@
 just 1.40.0
+prek 0.5.5
 uv 0.8.14
@@ -1,6 +1,6 @@
 # lint files
 lint:
-    uvx prek run --all-files
+    prek run --all-files
 
 # run the tests
 test:
Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`	`just 1.40.0`
	`2`	`+prek 0.5.5`
`2`	`3`	`uv 0.8.14`