diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 8117e46..b45352b 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -16,6 +16,8 @@ jobs:
           version: 11
           runtime: node@24
           cache: true
+      - name: Install deps
+        run: pnpm install --frozen-lockfile
       - name: Build
         run: pnpm build
       - name: Deploy to Netlify
diff --git a/.forgejo/workflows/pr.yml b/.forgejo/workflows/pr.yml
index 1ca7474..cf6cb20 100644
--- a/.forgejo/workflows/pr.yml
+++ b/.forgejo/workflows/pr.yml
@@ -24,6 +24,8 @@ jobs:
           version: 11
           runtime: node@24
           cache: true
+      - name: Install deps
+        run: pnpm install --frozen-lockfile
       - name: Lint
         run: pnpm lint
       - name: Svelte Check
diff --git a/AGENTS.md b/AGENTS.md
index c024b58..0bda88d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,8 +16,8 @@ Personal website and blog for Benjamin Palko, deployed on Netlify.
 ## Toolchain
 
 - **pnpm is the canonical local package manager**.
-- The GitHub Actions PR gate (`.github/workflows/pr.yml`) runs `pnpm`. Keep both working; document pnpm commands.
-- Deploys to Netlify run via Forgejo Actions (`.forgejo/workflows/deploy.yml`) on push to `main`. It needs `NETLIFY_AUTH_TOKEN` and `NETLIFY_SITE_ID` as Forgejo repo secrets.
+- The PR gate runs via Forgejo Actions (`.forgejo/workflows/pr.yml`) on pull requests to `main`. It installs with `pnpm install --frozen-lockfile` so CI matches a clean local install. Keep both working; document pnpm commands.
+- Deploys to Netlify run via Forgejo Actions (`.forgejo/workflows/deploy.yml`) on push to `main`. It needs `NETLIFY_AUTH_TOKEN` and `NETLIFY_SITE_ID` as Forgejo repo secrets. It also installs with `pnpm install --frozen-lockfile`.
 
 ## Scripts (pnpm)