diff --git a/.taskfiles/_internal.Taskfile.yml b/.taskfiles/_internal.Taskfile.yml
index 0f5ff8f..f641861 100644
--- a/.taskfiles/_internal.Taskfile.yml
+++ b/.taskfiles/_internal.Taskfile.yml
@@ -42,13 +42,13 @@ tasks:
     cmds:
       - cmd: |
           {{if ne .VER "latest"}}
-            {{.CMD}} | grep -F "{{.VER}}"
+            { {{.CMD}} 2>&1 || true; } | grep -F "{{.VER}}"
           {{end}}
         platforms: [linux, darwin]
       - cmd: |
           {{if ne .VER "latest"}}
             {{.PWSH}} '
-              $match = (& {{.CMD}}) | Select-String -Pattern "{{.VER}}" -SimpleMatch
+              $match = (& {{.CMD}} 2>&1) | Select-String -Pattern "{{.VER}}" -SimpleMatch
               if (-not $match) { exit 1 }
             '
           {{end}}
diff --git a/.taskfiles/github.Taskfile.yml b/.taskfiles/github.Taskfile.yml
index 91c26e5..2a8afa2 100644
--- a/.taskfiles/github.Taskfile.yml
+++ b/.taskfiles/github.Taskfile.yml
@@ -6,7 +6,7 @@ version: "3"
 vars:
   GITHUB_VERSION:
     map:
-      actionlint: latest
+      actionlint: 1.7.12
       act: 0.2.88
       pinact: 4.0.0
       ghalint: 1.5.6
diff --git a/.taskfiles/markdown.Taskfile.yml b/.taskfiles/markdown.Taskfile.yml
index 5f44f47..00bf769 100644
--- a/.taskfiles/markdown.Taskfile.yml
+++ b/.taskfiles/markdown.Taskfile.yml
@@ -6,7 +6,7 @@ version: "3"
 vars:
   MARKDOWN_VERSION:
     map:
-      markdownlintCli2: latest
+      markdownlintCli2: 0.23.0
       markdownTableFormatter: 1.7.0
 
 tasks:
diff --git a/.taskfiles/runtime.Taskfile.yml b/.taskfiles/runtime.Taskfile.yml
index 9a7caf6..97c9f00 100644
--- a/.taskfiles/runtime.Taskfile.yml
+++ b/.taskfiles/runtime.Taskfile.yml
@@ -8,6 +8,8 @@ vars:
     map:
       uv: 0.11.16
       fnm: 1.39.0
+      # pwsh stays "latest": its installers use the Microsoft package repo /
+      # Homebrew, which only provide the latest release and reject version pins.
       pwsh: latest
       golang: 1.26.5
   RUNTIME_INSTALLER_SHA:
diff --git a/.taskfiles/scripts/install_actionlint.sh b/.taskfiles/scripts/install_actionlint.sh
index ea72dc7..9eb2bd3 100755
--- a/.taskfiles/scripts/install_actionlint.sh
+++ b/.taskfiles/scripts/install_actionlint.sh
@@ -69,11 +69,13 @@ if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
   exit 0
 fi
 
-# Normalize VERSION: empty/whitespace -> "latest", numeric -> add "v" prefix
+# Normalize VERSION: empty/whitespace -> "latest". The pinned
+# download-actionlint.bash expects a bare semantic version (e.g. 1.7.12) or
+# "latest", so strip any leading "v" prefix from a specific version.
 if [[ -z "${VERSION//[[:space:]]/}" ]]; then
   VERSION="latest"
-elif [[ "${VERSION}" != "latest" && "${VERSION}" =~ ^[0-9] ]]; then
-  VERSION="v${VERSION}"
+elif [[ "${VERSION}" != "latest" ]]; then
+  VERSION="${VERSION#v}"
 fi
 
 # Determine install directory