diff --git a/.github/workflows/crdt-sync-precommit.yml b/.github/workflows/crdt-sync-precommit.yml
index 0866ef9..95165ff 100644
--- a/.github/workflows/crdt-sync-precommit.yml
+++ b/.github/workflows/crdt-sync-precommit.yml
@@ -16,11 +16,17 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-          cache: pip
-          cache-dependency-path: crdt-sync/requirements.txt
-      - name: Install dependencies
-        working-directory: crdt-sync
-        run: pip install -r requirements.txt
+      # Only pre-commit itself. Every linting hook runs in its own isolated
+      # env -- ruff, mypy, pylint, bandit and codespell each come from their
+      # own repo+rev, and the local hooks need nothing beyond bash and
+      # python3 -- so installing the full requirements.txt spent 9s a run on
+      # packages no pre-commit-stage hook imports. Verified by running all
+      # three configs green in a venv holding pre-commit and nothing else.
+      # The pin is read out of requirements.txt rather than repeated here, so
+      # it cannot drift from what the dependency-freshness gate governs.
+      - name: Install pre-commit
+        run: |
+          pip install "$(grep '^pre-commit==' crdt-sync/requirements.txt)"
 
       # Keyed on THIS package's config. pre-commit/action@v3.0.1 caches on
       # hashFiles('.pre-commit-config.yaml') -- the repo ROOT's -- so all three
@@ -34,6 +40,14 @@ jobs:
           key: >-
             pre-commit-crdt-sync-${{ env.pythonLocation }}-${{
             hashFiles('crdt-sync/.pre-commit-config.yaml') }}
+          # Prefix fallback, or this fix would evaporate on the very
+          # event that motivated it: bumping a hook rev changes the
+          # exact key, and a total miss means reinstalling every hook
+          # again. pre-commit's store is keyed internally by hook
+          # repo+rev, so a superseded entry is ignored disk rather
+          # than a wrong hook, and cache still re-saves under the new
+          # exact key after a prefix-only hit.
+          restore-keys: pre-commit-crdt-sync-${{ env.pythonLocation }}-
       - name: Run the hooks
         run: >-
           pre-commit run --config crdt-sync/.pre-commit-config.yaml
diff --git a/.github/workflows/freedays-precommit.yml b/.github/workflows/freedays-precommit.yml
index 1ed99b8..3a277e6 100644
--- a/.github/workflows/freedays-precommit.yml
+++ b/.github/workflows/freedays-precommit.yml
@@ -19,13 +19,17 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-          cache: pip
-          cache-dependency-path: freedays/requirements.txt
-      - name: Install the sibling package
-        run: pip install ./crdt-sync
-      - name: Install dependencies
-        working-directory: freedays
-        run: pip install -r requirements.txt
+      # Only pre-commit itself. Every linting hook runs in its own isolated
+      # env -- ruff, mypy, pylint, bandit and codespell each come from their
+      # own repo+rev, and the local hooks need nothing beyond bash and
+      # python3 -- so installing the full requirements.txt spent 9s a run on
+      # packages no pre-commit-stage hook imports. Verified by running all
+      # three configs green in a venv holding pre-commit and nothing else.
+      # The pin is read out of requirements.txt rather than repeated here, so
+      # it cannot drift from what the dependency-freshness gate governs.
+      - name: Install pre-commit
+        run: |
+          pip install "$(grep '^pre-commit==' freedays/requirements.txt)"
 
       # Keyed on THIS package's config. pre-commit/action@v3.0.1 caches on
       # hashFiles('.pre-commit-config.yaml') -- the repo ROOT's -- so all three
@@ -39,6 +43,14 @@ jobs:
           key: >-
             pre-commit-freedays-${{ env.pythonLocation }}-${{
             hashFiles('freedays/.pre-commit-config.yaml') }}
+          # Prefix fallback, or this fix would evaporate on the very
+          # event that motivated it: bumping a hook rev changes the
+          # exact key, and a total miss means reinstalling every hook
+          # again. pre-commit's store is keyed internally by hook
+          # repo+rev, so a superseded entry is ignored disk rather
+          # than a wrong hook, and cache still re-saves under the new
+          # exact key after a prefix-only hit.
+          restore-keys: pre-commit-freedays-${{ env.pythonLocation }}-
       - name: Run the hooks
         run: >-
           pre-commit run --config freedays/.pre-commit-config.yaml
diff --git a/.github/workflows/gatelock-precommit.yml b/.github/workflows/gatelock-precommit.yml
index 7118321..3f98c75 100644
--- a/.github/workflows/gatelock-precommit.yml
+++ b/.github/workflows/gatelock-precommit.yml
@@ -18,11 +18,17 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-          cache: pip
-          cache-dependency-path: gatelock/requirements.txt
-      - name: Install dependencies
-        working-directory: gatelock
-        run: pip install -r requirements.txt
+      # Only pre-commit itself. Every linting hook runs in its own isolated
+      # env -- ruff, mypy, pylint, bandit and codespell each come from their
+      # own repo+rev, and the local hooks need nothing beyond bash and
+      # python3 -- so installing the full requirements.txt spent 9s a run on
+      # packages no pre-commit-stage hook imports. Verified by running all
+      # three configs green in a venv holding pre-commit and nothing else.
+      # The pin is read out of requirements.txt rather than repeated here, so
+      # it cannot drift from what the dependency-freshness gate governs.
+      - name: Install pre-commit
+        run: |
+          pip install "$(grep '^pre-commit==' gatelock/requirements.txt)"
 
       # Keyed on THIS package's config. pre-commit/action@v3.0.1 caches on
       # hashFiles('.pre-commit-config.yaml') -- the repo ROOT's -- so all three
@@ -36,6 +42,14 @@ jobs:
           key: >-
             pre-commit-gatelock-${{ env.pythonLocation }}-${{
             hashFiles('gatelock/.pre-commit-config.yaml') }}
+          # Prefix fallback, or this fix would evaporate on the very
+          # event that motivated it: bumping a hook rev changes the
+          # exact key, and a total miss means reinstalling every hook
+          # again. pre-commit's store is keyed internally by hook
+          # repo+rev, so a superseded entry is ignored disk rather
+          # than a wrong hook, and cache still re-saves under the new
+          # exact key after a prefix-only hit.
+          restore-keys: pre-commit-gatelock-${{ env.pythonLocation }}-
       - name: Run the hooks
         run: >-
           pre-commit run --config gatelock/.pre-commit-config.yaml