diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index b49d1a3..75bd14d 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -33,9 +33,10 @@
 
 'jobs':
   'add-to-project':
-    'uses': 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@main'
+    'uses': 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@f8f0a5ae583913de18143bbbbe0db9ecab970435' # v0.45.0
     'with':
       'project-url': 'https://github.com/orgs/JorisJonkers-dev/projects/2'
     'secrets':
       'PROJECT_AUTOMATION_APP_ID': '${{ secrets.RELEASE_APP_ID }}'
       'PROJECT_AUTOMATION_APP_PRIVATE_KEY': '${{ secrets.RELEASE_APP_PRIVATE_KEY }}'
+      'PACKAGES_PROXY_TOKEN': '${{ secrets.PACKAGES_PROXY_TOKEN }}'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30cff1a..a070ab8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # Python and npm packages come through the estate's package proxy, which never serves a
+      # version published less than 7 days ago (JorisJonkers-dev/workspace#167). A pull request
+      # from a fork gets no secret, and then this step does nothing.
+      - uses: JorisJonkers-dev/github-workflows/actions/setup-package-proxy@f8f0a5ae583913de18143bbbbe0db9ecab970435 # v0.45.0
+        with:
+          token: ${{ secrets.PACKAGES_PROXY_TOKEN }}
+
       - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
         with:
           cache: true