diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ff3a6e92..9f645569 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -540,8 +540,11 @@ jobs:
       - name: Test bridge-core
         run: dotnet test bridges/tray-bridge/tests/TapScribe.Bridge.Core.Tests/TapScribe.Bridge.Core.Tests.csproj -c Release
 
+      # Pinned to a workload set: 10.0.401.1 brings the macOS 27.0 SDK pack, which
+      # needs Xcode 27, and macos-latest does not have it yet (MT0179). Raise the
+      # pin when the runner image ships Xcode 27.
       - name: Install the macos workload
-        run: dotnet workload install macos
+        run: dotnet workload install macos --version 10.0.401
 
       # A dedicated keychain for the [RequiresMacOS] Keychain round trip, because
       # the runner's login keychain is the wrong thing to bet on twice over: if it
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3a211b5..921637f9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -153,9 +153,10 @@ jobs:
         with:
           global-json-file: bridges/tray-bridge/global.json
 
-      # Not on the runner image, and the shell does not build without it.
+      # Not on the runner image, and the shell does not build without it. Pinned
+      # to the set ci.yml pins, which says why.
       - name: Install the macos workload
-        run: dotnet workload install macos
+        run: dotnet workload install macos --version 10.0.401
 
       - name: Derive version from tag
         run: echo "VER=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_ENV"