diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index dde98c7..8d4098a 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -31,6 +31,15 @@ on:
         description: One of yarn, npm, or pnpm.
         type: string
         default: yarn
+      lfs:
+        description: >
+          Fetch Git LFS objects during checkout. Off by default: LFS pulls cost
+          bandwidth against the account quota on every run. Turn it on for a
+          repo whose tests read LFS-tracked fixtures — without it they get the
+          pointer files, and fail with whatever the reading library says about
+          malformed input rather than anything about LFS.
+        type: boolean
+        default: false
       run-build:
         description: Run the build script after type-checking.
         type: boolean
@@ -49,9 +58,10 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          lfs: ${{ inputs.lfs }}
 
       # Honours the `packageManager` field in package.json, which is how Yarn
       # Berry and pnpm pin themselves.
@@ -67,7 +77,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: corepack enable
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.package-manager }}
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index 6517ca2..3cf972d 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -29,6 +29,15 @@ on:
           Mirrors the same input on node-ci.yml.
         type: string
         default: "."
+      lfs:
+        description: >
+          Fetch Git LFS objects during checkout. Off by default: LFS pulls cost
+          bandwidth against the account quota on every run. Turn it on for a
+          repo whose tests read LFS-tracked fixtures — without it they get the
+          pointer files, and fail with whatever the reading library says about
+          malformed input rather than anything about LFS.
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -43,11 +52,12 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          lfs: ${{ inputs.lfs }}
 
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: ${{ inputs.python-version }}
 
diff --git a/.github/workflows/template-ci.yml b/.github/workflows/template-ci.yml
index 527ed87..fa9196e 100644
--- a/.github/workflows/template-ci.yml
+++ b/.github/workflows/template-ci.yml
@@ -18,11 +18,11 @@ jobs:
     name: Render and validate both variants
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/template-update.yml b/.github/workflows/template-update.yml
index 86e5964..dcb6a29 100644
--- a/.github/workflows/template-update.yml
+++ b/.github/workflows/template-update.yml
@@ -49,14 +49,14 @@ jobs:
       contents: write # push the update branch
       pull-requests: write # open the PR
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history: copier needs the commit the project was last updated
           # from to compute its three-way merge.
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Check the project is copier-managed
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2125acd..d8c91b3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ Entries for 1.0.0 through 1.5.2 were backfilled from git history after the fact,
 
 ### Added
 
+- `python-ci.yml` and `node-ci.yml` take an `lfs` input, passed through to `actions/checkout`. It defaults to `false`, because an LFS pull costs bandwidth against the account quota on every run and most projects have nothing in LFS. Turn it on for a repo whose tests read LFS-tracked fixtures: without it the checkout produces pointer files, and the failure surfaces as whatever the reading library says about malformed input — `FzErrorFormat: no objects found` from PyMuPDF, in the case that prompted this — with nothing anywhere in the output mentioning LFS.
 - Repo settings as code, opt-in via `use_repo_settings` (default off, so
   `copier update --defaults` leaves existing projects alone): the scaffold
   ships `.github/repo-settings.json`