diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 801a40191..3714658f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
           node-version: "24"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: TypeScript typecheck
         run: bun run typecheck
@@ -101,7 +101,7 @@ jobs:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: TypeScript typecheck
         run: bun run --cwd packages/pi-plugin typecheck
@@ -126,7 +126,7 @@ jobs:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       # Frontend-only checks (no Rust/Tauri needed). The key gate is the test
       # step, which runs config-parity.test.ts — it fails the build if the