diff --git a/.github/workflows/github-action-validator.yml b/.github/workflows/github-action-validator.yml
index 2673354da55..73b1e6bb3d7 100644
--- a/.github/workflows/github-action-validator.yml
+++ b/.github/workflows/github-action-validator.yml
@@ -37,7 +37,9 @@ jobs:
           node-version: "20"
 
       - name: Install Dependencies
-        run: npm install -g @action-validator/core @action-validator/cli --save-dev
+        # Versions are pinned to avoid ad-hoc, unpinned package installs
+        # (zizmor adhoc-packages). Bump deliberately when upgrading.
+        run: npm install -g @action-validator/core@0.6.0 @action-validator/cli@0.6.0
 
       - name: Run Script
         run: bash .github/workflows/github-action-validator.sh