diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 26ac6d2..4615929 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -17,9 +18,9 @@ jobs:
       matrix:
         go-version: ["1.24"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -42,7 +43,7 @@ jobs:
         id: setup-bats
         uses: bats-core/bats-action@5b1e60c2ee94cb1b44a616ea4b1f466f9d6e38ef # v4.0.0
         with:
-          bats-version: latest
+          bats-version: v1.13.0
           support-install: true
           assert-install: true
           detik-install: false
@@ -58,9 +59,9 @@ jobs:
     name: CLI (macOS)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.24"
 
@@ -71,7 +72,7 @@ jobs:
         id: setup-bats
         uses: bats-core/bats-action@5b1e60c2ee94cb1b44a616ea4b1f466f9d6e38ef # v4.0.0
         with:
-          bats-version: latest
+          bats-version: v1.13.0
           support-install: true
           assert-install: true
           detik-install: false
@@ -87,9 +88,9 @@ jobs:
     name: Integration (Linux)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.24"
 
@@ -108,7 +109,7 @@ jobs:
         id: setup-bats
         uses: bats-core/bats-action@5b1e60c2ee94cb1b44a616ea4b1f466f9d6e38ef # v4.0.0
         with:
-          bats-version: latest
+          bats-version: v1.13.0
           support-install: true
           assert-install: true
           detik-install: false
@@ -126,12 +127,21 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.24"
 
-      - uses: golangci/golangci-lint-action@v6
-        with:
-          version: latest
+      - name: Install golangci-lint
+        env:
+          GOLANGCI_LINT_VERSION: "1.64.8"
+          GOLANGCI_LINT_SHA256: b6270687afb143d019f387c791cd2a6f1cb383be9b3124d241ca11bd3ce2e54e
+        run: |
+          curl -fsSLo /tmp/golangci-lint.tar.gz "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz"
+          echo "${GOLANGCI_LINT_SHA256}  /tmp/golangci-lint.tar.gz" | sha256sum -c -
+          tar -xzf /tmp/golangci-lint.tar.gz -C /tmp
+          echo "/tmp/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64" >> "$GITHUB_PATH"
+
+      - name: Lint
+        run: golangci-lint run
diff --git a/.github/workflows/refresh-kernel-versions.yml b/.github/workflows/refresh-kernel-versions.yml
index 100332a..a50a0be 100644
--- a/.github/workflows/refresh-kernel-versions.yml
+++ b/.github/workflows/refresh-kernel-versions.yml
@@ -22,6 +22,9 @@ on:
         default: ""
 
 permissions:
+  # Needed only to dispatch CI on the bot-created PR branch. Pull-request
+  # events caused by GITHUB_TOKEN do not trigger workflows automatically.
+  actions: write
   contents: write
   pull-requests: write
 
@@ -118,3 +121,10 @@ jobs:
             `internal/kernelversions/cmd/kvgen/known_gaps.go`.
           labels: |
             dependencies
+
+      - name: Run CI on refresh PR branch
+        if: steps.drift.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh workflow run ci.yml --ref chore/refresh-kernel-versions