diff --git a/.github/workflows/BetterDependabot.yml b/.github/workflows/BetterDependabot.yml
index b1d4394..91ad572 100644
--- a/.github/workflows/BetterDependabot.yml
+++ b/.github/workflows/BetterDependabot.yml
@@ -20,9 +20,15 @@ jobs:
         with:
           node-version: '22'
 
+      # Pinned instead of "latest": pnpm 11.12.0 (published 2026-07-13) ships a
+      # broken self-installer that crashes with
+      # "Cannot use 'in' operator to search for 'integrity' in undefined"
+      # whenever action-setup switches to it (see run 29232206286). Pin to the
+      # last known-good release until upstream ships a fix, and bump this
+      # explicitly going forward instead of trusting "latest".
       - uses: pnpm/action-setup@v6
         with:
-          version: latest
+          version: '11.11.0'
 
       - name: Install (sync lockfile state)
         run: pnpm install --no-frozen-lockfile --ignore-scripts
diff --git a/originGUI/package.json b/originGUI/package.json
index 27e1973..350832e 100644
--- a/originGUI/package.json
+++ b/originGUI/package.json
@@ -28,7 +28,7 @@
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-n": "^18.2.2",
     "eslint-plugin-promise": "^7.3.0",
-    "postcss": "^8.5.16",
+    "postcss": "^8.5.17",
     "sass": "^1.101.0",
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",