diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 8b4cc292..53fd6ef4 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -336,6 +336,12 @@ installed, no script invoked it, and CI never ran it — so none of the rules it
 named had ever fired. Several of the findings fixed on the way in were the
 backlog that had built up behind that.
 
+Both versions are **pinned exactly** (not ranges), as oxfmt's is: `lint` runs
+with `--deny-warnings` and CI runs `lint`, so a floating range picks up a rule
+added to `correctness` on a minor release and turns CI red on a day nobody
+touched the code. They move together — oxlint declares `oxlint-tsgolint` as a
+peer — so bump both in one deliberate change.
+
 Type-aware rules need no build here: they resolve `@workglow/*` through the
 published `dist/*.d.ts` that `bun install` already puts in `node_modules`.
 
diff --git a/bun.lock b/bun.lock
index 57bd825c..0cf26756 100644
--- a/bun.lock
+++ b/bun.lock
@@ -33,8 +33,8 @@
         "bunset": "1.0.15",
         "concurrently": "^10.0.5",
         "oxfmt": "0.66.0",
-        "oxlint": "^1.81.0",
-        "oxlint-tsgolint": "^7.0.2001",
+        "oxlint": "1.81.0",
+        "oxlint-tsgolint": "7.0.2001",
         "typescript": "~7.0.2",
         "vitest": "^4.1.11",
       },
diff --git a/package.json b/package.json
index 99f2037a..44834b9f 100644
--- a/package.json
+++ b/package.json
@@ -80,8 +80,8 @@
     "bunset": "1.0.15",
     "concurrently": "^10.0.5",
     "oxfmt": "0.66.0",
-    "oxlint": "^1.81.0",
-    "oxlint-tsgolint": "^7.0.2001",
+    "oxlint": "1.81.0",
+    "oxlint-tsgolint": "7.0.2001",
     "typescript": "~7.0.2",
     "vitest": "^4.1.11"
   },