diff --git a/.github/actions/use-mise/action.yml b/.github/actions/use-mise/action.yml
new file mode 100644
index 0000000..f6a3399
--- /dev/null
+++ b/.github/actions/use-mise/action.yml
@@ -0,0 +1,11 @@
+name: Use mise
+description: jdx/mise-action with the mise binary pinned
+runs:
+  using: composite
+  steps:
+    # Pinned, not left to the action's newest-release default, so a new mise
+    # release reaches CI only when bumped here (as immich-app/devtools'
+    # use-mise does). The unit lane started failing on 2026.10.10.
+    - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      with:
+        version: 2026.10.5
diff --git a/.github/workflows/adapters.yml b/.github/workflows/adapters.yml
index 5a3425d..83aa4a6 100644
--- a/.github/workflows/adapters.yml
+++ b/.github/workflows/adapters.yml
@@ -30,7 +30,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Discover the adapter tiers
         id: tiers
         env:
@@ -59,7 +59,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Detect the adapter language
@@ -97,7 +97,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Detect the adapter language
@@ -134,7 +134,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Detect the adapter language
@@ -171,7 +171,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Detect the adapter language
@@ -204,7 +204,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Run the deploy check for two apps
@@ -222,7 +222,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Setup PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
@@ -249,7 +249,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Detect the adapter language
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8dfeb32..40011a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Run the unit lane
         run: mise run ci-unit
 
@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Enable corepack
         run: corepack enable
       - name: Setup PHP
@@ -61,7 +61,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       # Not common/: its placeholder `uses: you/.github/...` makes ref-confusion
       # error out. tests/workflows.bats checks those call sites structurally.
       - name: Run zizmor
diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml
index 607a466..217ff2e 100644
--- a/.github/workflows/provenance.yml
+++ b/.github/workflows/provenance.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: ./.github/actions/use-mise
       - name: Clone upstream immich
         run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich"
       - name: Run the provenance self-test