diff --git a/.github/workflows/binding-release-candidate.yml b/.github/workflows/binding-release-candidate.yml
index f5a7c55ef..89831be09 100644
--- a/.github/workflows/binding-release-candidate.yml
+++ b/.github/workflows/binding-release-candidate.yml
@@ -97,10 +97,18 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          sudo curl -fsSL \
-            "https://github.com/bazelbuild/bazelisk/releases/download/v1.26.0/bazelisk-linux-amd64" \
-            -o /usr/local/bin/bazelisk
-          sudo chmod +x /usr/local/bin/bazelisk
+          version=1.26.0
+          # SHA-256 of bazelisk-linux-amd64 from
+          # https://github.com/bazelbuild/bazelisk/releases/tag/v1.26.0
+          # Computed locally: curl -fsSL … | shasum -a 256
+          checksum=6539c12842ad76966f3d493e8f80d67caa84ec4a000e220d5459833c967c12bc
+          tmp=$(mktemp)
+          curl -fsSL \
+            "https://github.com/bazelbuild/bazelisk/releases/download/v${version}/bazelisk-linux-amd64" \
+            -o "$tmp"
+          printf '%s  %s\n' "$checksum" "$tmp" | shasum -a 256 --check
+          sudo install -m 0755 "$tmp" /usr/local/bin/bazelisk
+          rm -f "$tmp"
           sudo ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel
           bazelisk version
 
@@ -356,10 +364,18 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          sudo curl -fsSL \
-            "https://github.com/bazelbuild/bazelisk/releases/download/v1.26.0/bazelisk-linux-amd64" \
-            -o /usr/local/bin/bazelisk
-          sudo chmod +x /usr/local/bin/bazelisk
+          version=1.26.0
+          # SHA-256 of bazelisk-linux-amd64 from
+          # https://github.com/bazelbuild/bazelisk/releases/tag/v1.26.0
+          # Computed locally: curl -fsSL … | shasum -a 256
+          checksum=6539c12842ad76966f3d493e8f80d67caa84ec4a000e220d5459833c967c12bc
+          tmp=$(mktemp)
+          curl -fsSL \
+            "https://github.com/bazelbuild/bazelisk/releases/download/v${version}/bazelisk-linux-amd64" \
+            -o "$tmp"
+          printf '%s  %s\n' "$checksum" "$tmp" | shasum -a 256 --check
+          sudo install -m 0755 "$tmp" /usr/local/bin/bazelisk
+          rm -f "$tmp"
           sudo ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel
           bazelisk version
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index da6c0ce17..bce5a469b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -900,14 +900,22 @@ jobs:
     timeout-minutes: 120
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Bazelisk
         run: |
-          sudo curl -fsSL \
-            "https://github.com/bazelbuild/bazelisk/releases/download/v1.26.0/bazelisk-linux-amd64" \
-            -o /usr/local/bin/bazelisk
-          sudo chmod +x /usr/local/bin/bazelisk
+          version=1.26.0
+          # SHA-256 of bazelisk-linux-amd64 from
+          # https://github.com/bazelbuild/bazelisk/releases/tag/v1.26.0
+          # Computed locally: curl -fsSL … | shasum -a 256
+          checksum=6539c12842ad76966f3d493e8f80d67caa84ec4a000e220d5459833c967c12bc
+          tmp=$(mktemp)
+          curl -fsSL \
+            "https://github.com/bazelbuild/bazelisk/releases/download/v${version}/bazelisk-linux-amd64" \
+            -o "$tmp"
+          printf '%s  %s\n' "$checksum" "$tmp" | shasum -a 256 --check
+          sudo install -m 0755 "$tmp" /usr/local/bin/bazelisk
+          rm -f "$tmp"
           sudo ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel
           bazelisk version
 
diff --git a/scripts/ci/test-binding-release-candidate.py b/scripts/ci/test-binding-release-candidate.py
index 523f772a6..bb1d9aa7b 100644
--- a/scripts/ci/test-binding-release-candidate.py
+++ b/scripts/ci/test-binding-release-candidate.py
@@ -549,7 +549,7 @@ def main() -> None:
     assert 'test "$CARGO_TARGET_DIR" = "$GITHUB_WORKSPACE/target"' in python_job_body
     assert "cargo_target_state=unwritable" in python_job_body
     assert "cargo_target_state=ready" in python_job_body
-    # Bazelisk install uses chmod +x; forbid chmod on the Cargo sticky reclaim path.
+    # Bazelisk install uses sudo install -m 0755; forbid chmod on the Cargo sticky reclaim path.
     maturin_lane = python_job_body.split("uses: PyO3/maturin-action@", 1)[1]
     assert "chmod" not in maturin_lane
     assert python_job_body.count('sudo chown -R "$(id -u):$(id -g)" "$CARGO_TARGET_DIR"') == 1