diff --git a/crdt-sync/pyproject.toml b/crdt-sync/pyproject.toml
index ea28ccd..44411ec 100644
--- a/crdt-sync/pyproject.toml
+++ b/crdt-sync/pyproject.toml
@@ -3,7 +3,7 @@ name = "crdt-sync"
 version = "0.9.0"
 description = "Shared CRDT merge scheme + GitHub-Contents-API sync transport for cross-device apps"
 requires-python = ">=3.10"
-dependencies = ["requests"]
+dependencies = ["requests==2.34.2"]
 
 # Ship only the library. `tool/` is a package too (it has an __init__.py so
 # its scripts import cleanly), and setuptools' flat-layout auto-discovery
diff --git a/crdt-sync/requirements.txt b/crdt-sync/requirements.txt
index 2e554ba..cdad590 100644
--- a/crdt-sync/requirements.txt
+++ b/crdt-sync/requirements.txt
@@ -1,9 +1,12 @@
-bandit[toml]>=1.7
-mypy>=1.13
-pre-commit>=4.0
-pylint>=3.3
-pytest>=8.0
-pytest-cov>=5.0
-requests>=2.31
-ruff>=0.15
-types-requests>=2.31
+# Exact pins, enforced by the shared dependency-freshness gate: a `>=`
+# floor is satisfied by anything newer, so it tells a checker nothing
+# about whether this repo is actually current.
+bandit[toml]==1.9.4
+mypy==2.3.1
+pre-commit==4.6.2
+pylint==4.0.7
+pytest==9.1.1
+pytest-cov==7.1.0
+requests==2.34.2
+ruff==0.16.5
+types-requests==2.33.0.20260712
diff --git a/gatelock/pyproject.toml b/gatelock/pyproject.toml
index 93608e9..fce82d1 100644
--- a/gatelock/pyproject.toml
+++ b/gatelock/pyproject.toml
@@ -15,7 +15,7 @@ dependencies = []  # pure stdlib — tkinter is bundled with Python
 # promptly — so this must stay OPTIONAL: a locker that refuses to start
 # because a dependency is missing is itself a way to end up unlocked.
 # Consumers' install scripts install it unconditionally all the same.
-randr = ["python-xlib>=0.33"]
+randr = ["python-xlib==0.33"]
 
 [tool.setuptools.packages.find]
 include = ["gatelock*"]
diff --git a/gatelock/requirements.txt b/gatelock/requirements.txt
index 6cd88cc..2222fa1 100644
--- a/gatelock/requirements.txt
+++ b/gatelock/requirements.txt
@@ -1,7 +1,10 @@
-bandit[toml]>=1.7
-mypy>=1.13
-pre-commit>=4.0
-pylint>=3.3
-pytest>=8.0
-pytest-cov>=5.0
-ruff>=0.15
+# Exact pins, enforced by the shared dependency-freshness gate: a `>=`
+# floor is satisfied by anything newer, so it tells a checker nothing
+# about whether this repo is actually current.
+bandit[toml]==1.9.4
+mypy==2.3.1
+pre-commit==4.6.2
+pylint==4.0.7
+pytest==9.1.1
+pytest-cov==7.1.0
+ruff==0.16.5