diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72c7670d2..f634c8277 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -124,19 +124,19 @@ jobs:
         with:
           go-version-file: go.mod
 
-      # Packaging needs task and nfpm.
+      # Packaging needs task and nfpm, pinned so every release installs the same
+      # tools instead of whatever `@latest` resolves to that day.
       #
       # GOTOOLCHAIN=auto only here: setup-go exports `local`, which is right for
       # building lich (it holds every go command to the go.mod line) but breaks
-      # installing these tools, since `@latest` resolves to releases that ask for
-      # a newer Go than we declare. Scoped to the step because setup-go writes
+      # installing a tool release that asks for a newer Go than we declare. Scoped to the step because setup-go writes
       # `local` through GITHUB_ENV, which outranks a workflow-level env.
       - name: Install task and nfpm
         env:
           GOTOOLCHAIN: auto
         run: |
-          go install github.com/go-task/task/v3/cmd/task@latest
-          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@latest
+          go install github.com/go-task/task/v3/cmd/task@v3.54.0
+          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.48.0
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       # Ubuntu 24.04 refuses unprivileged user namespaces to binaries without an
@@ -206,7 +206,7 @@ jobs:
         env:
           GOTOOLCHAIN: auto
         run: |
-          go install github.com/go-task/task/v3/cmd/task@latest
+          go install github.com/go-task/task/v3/cmd/task@v3.54.0
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
           choco install innosetup -y --no-progress
 
@@ -335,7 +335,7 @@ jobs:
         env:
           GOTOOLCHAIN: auto
         run: |
-          go install github.com/go-task/task/v3/cmd/task@latest
+          go install github.com/go-task/task/v3/cmd/task@v3.54.0
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       # macOS is Unix, so this runs the real PTY tests on both architectures.