diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
index 2e72e64..8d4c00d 100644
--- a/.tangled/workflows/ci.yml
+++ b/.tangled/workflows/ci.yml
@@ -1,30 +1,43 @@
-# Continuous checks: typecheck and tests on every push and pull request to main.
-# The container image is built separately, on release tags (build-image.yml).
+# Continuous checks: formatting, typecheck, and tests on every push and pull
+# request to main. The container image is built separately, on release tags
+# (build-image.yml).
+#
+# Deno is pinned explicitly rather than taken from nixpkgs: `deno fmt` rules and
+# which file types it covers (CSS, HTML, SVG, Svelte, ...) change between
+# versions, so CI must run the SAME version developers format with — otherwise
+# the format check flags files that are clean locally. Keep DENO_VERSION in sync
+# with your local deno (and ideally the Dockerfile's denoland/deno tag).
 #
 # Skip a run with:  git push -o skip-ci
 when:
   - event: ["push", "pull_request"]
     branch: ["main"]
 
-engine: "nixery"
+engine: nixery
 
 dependencies:
   nixpkgs:
-    - deno
+    - curl
+    - unzip
     - git
 
 environment:
   DENO_NO_UPDATE_CHECK: "1"
+  DENO_VERSION: "v2.9.3"
 
 steps:
-  - name: "Check formatting"
-    command: deno task fmt:check
-
-  - name: "Install dependencies"
-    command: deno install
+  - name: "Checks: fmt, typecheck, tests (pinned Deno)"
+    command: |
+      set -euo pipefail
 
-  - name: "Typecheck (svelte-check)"
-    command: deno task check
+      # Install the pinned Deno into the workspace and put it first on PATH so
+      # that `deno task ...` (which shells out to `deno`) uses this version too.
+      export DENO_INSTALL="$PWD/.deno"
+      curl -fsSL https://deno.land/install.sh | sh -s "$DENO_VERSION"
+      export PATH="$DENO_INSTALL/bin:$PATH"
 
-  - name: "Test"
-    command: deno task test
+      deno --version
+      deno fmt --check
+      deno install
+      deno task check
+      deno task test