diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 14e7ab8..09cee66 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -135,7 +135,7 @@ jobs:
   # -- 3. Render and publish the deploy artifact ----------------------------
   publish-deploy-artifact:
     needs: [resolve-image-lock]
-    uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@ea7a9a1c52870c2ae3db08cd077d54dbef48aa3d # v0.14.0
+    uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@5b5e93dc81846cac4e13118e7280fd81a143685e # v0.15.1
     with:
       ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}
       artifact-name: knowledge
diff --git a/platform/render-local.sh b/platform/render-local.sh
index 85f933a..890fd29 100755
--- a/platform/render-local.sh
+++ b/platform/render-local.sh
@@ -20,7 +20,6 @@
 # NODE_AUTH_TOKEN) first: export GITHUB_TOKEN="$(gh auth token)".
 set -euo pipefail
 
-DEPLOY_CHECK_VERSION="0.15.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 cd "$REPO_ROOT"
@@ -45,6 +44,18 @@ value_from_workflows() {
     | awk '{print $2}' | sort -u | head -1
 }
 
+# deploy-check ships from the same repository as the reusable workflows and is
+# released with them, so the version comment on the deploy-validate pin is the
+# version to run. Hardcoding it here is what let the previous copy rot.
+DEPLOY_CHECK_VERSION="$(
+  grep -rhoE 'github-workflows/\.github/workflows/deploy-(validate|artifact)\.yml@[0-9a-f]{40} # v[0-9]+\.[0-9]+\.[0-9]+' \
+    .github/workflows/*.yml 2>/dev/null \
+    | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+$' | tr -d v \
+    | sort -t. -k1,1n -k2,2n -k3,3n | tail -1
+)"
+[ -n "$DEPLOY_CHECK_VERSION" ] \
+  || fail "no '# vX.Y.Z' comment on a deploy-validate/deploy-artifact pin in .github/workflows/*.yml"
+
 SCHEMA_VERSION="$(value_from_workflows 'schema-version')"
 CONTEXT_REF="$(value_from_workflows 'context-ref')"
 [ -n "$SCHEMA_VERSION" ] || fail "no schema-version found in .github/workflows/*.yml"