diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6c0e59c8..6557e49e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -104,7 +104,8 @@ jobs:
       # Install cargo-make for building. Needed on every run, cached wasm or
       # not, because build-site and check-links are cargo-make tasks.
       - name: Install cargo-make
-        run: cargo install --debug cargo-make
+        # --locked: every zip 2.x was yanked 2026-10-16; cargo-make ^0.37 needs zip ^2.
+        run: cargo install --debug --locked cargo-make
 
       # Build WebAssembly if the cache had nothing usable
       - name: Build WebAssembly
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 759bc23a..ae0363ae 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -33,7 +33,8 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: install
-          args: --debug cargo-make
+          # --locked: every zip 2.x was yanked 2026-10-16; cargo-make ^0.37 needs zip ^2.
+          args: --debug --locked cargo-make
 
       - name: Install wasm-pack and wasm-bindgen-cli
         run: |
diff --git a/.github/workflows/publish-freenet.yml b/.github/workflows/publish-freenet.yml
index abf84156..31278308 100644
--- a/.github/workflows/publish-freenet.yml
+++ b/.github/workflows/publish-freenet.yml
@@ -29,7 +29,8 @@ jobs:
           extended: true
 
       - name: Install cargo-make
-        run: cargo install --debug cargo-make
+        # --locked: every zip 2.x was yanked 2026-10-16; cargo-make ^0.37 needs zip ^2.
+        run: cargo install --debug --locked cargo-make
 
       # Refresh build-time content for the same reason the link check below
       # exists: this publishes the same *content* as deploy.yml, and without