diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8c1b1c30..3820c9b7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -187,9 +187,27 @@ jobs:
       with:
         python-version: '3.12'
 
+    # Ruff is pinned to the rev in .pre-commit-config.yaml rather than
+    # hardcoded here, so bumping the hook bumps CI in the same commit.
+    # An unpinned `pip install ruff` silently adopts newly-stabilized
+    # rules and fails code the local hook just passed.
+    - name: Resolve pinned ruff version
+      if: matrix.type == 'ruff'
+      id: ruff_version
+      run: |
+        version=$(grep -A1 'astral-sh/ruff-pre-commit' \
+          "$GITHUB_WORKSPACE/.pre-commit-config.yaml" \
+          | grep -oP 'rev:\s*v\K[0-9]+\.[0-9]+\.[0-9]+')
+        if [[ -z "$version" ]]; then
+          echo "Could not resolve ruff rev from .pre-commit-config.yaml"
+          exit 1
+        fi
+        echo "Pinned ruff version: $version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Install ruff
       if: matrix.type == 'ruff'
-      run: pip install ruff
+      run: pip install "ruff==${{ steps.ruff_version.outputs.version }}"
 
     # Biome / Frontend Setup
     - name: Setup Node.js
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f1716f02..357909bc 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,10 @@
 repos:
   # Python Ruff Checks
+  # This rev is the single source of truth for the ruff version.
+  # .github/workflows/lint.yml reads it from this file so CI and the
+  # local hook can never lint with two different rule sets.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.1
+    rev: v0.16.1
     hooks:
       # Beginner projects
       - id: ruff