diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7cb2785..ae3058c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -52,7 +52,11 @@ jobs:
 
       - name: Install dependencies
         if: steps.check-published.outputs.already_published == 'false'
-        run: npm install
+        # npm ci installs exactly what the lockfile says. `npm install` re-resolved
+        # peers on every run, so an upstream publish could break CI between a
+        # PR's green run and its merge (2026-09-09: react-dom 19.3.0 arrived
+        # two minutes before react 19.3.0 did).
+        run: npm ci
 
       - name: Build
         if: steps.check-published.outputs.already_published == 'false'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 763a1b2..73f6dab 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -42,7 +42,11 @@ jobs:
         run: npm install -g npm@11
 
       - name: Install dependencies
-        run: npm install
+        # npm ci installs exactly what the lockfile says. `npm install` re-resolved
+        # peers on every run, so an upstream publish could break CI between a
+        # PR's green run and its merge (2026-09-09: react-dom 19.3.0 arrived
+        # two minutes before react 19.3.0 did).
+        run: npm ci
 
       - name: Check formatting
         run: npm run format:check