diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d19577a..e01e3f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   quality:
-    uses: nocoo/base-ci/.github/workflows/quality.yml@ad43150de3a2be2fa464b5cd2f921dc4fa9f8f0f
+    uses: nocoo/base-ci/.github/workflows/quality.yml@0394178ebcff0418c442d84a84119220f31f8987 # v2026.9
     with:
       runtime-version: "1.3.14"
       install-policy: "trusted"
@@ -22,7 +22,7 @@ jobs:
 
   l2:
     name: L2 real-HTTP + routes
-    uses: nocoo/base-ci/.github/workflows/test-job.yml@ad43150de3a2be2fa464b5cd2f921dc4fa9f8f0f
+    uses: nocoo/base-ci/.github/workflows/test-job.yml@0394178ebcff0418c442d84a84119220f31f8987 # v2026.9
     with:
       runtime-version: "1.3.14"
       install-policy: "trusted"
@@ -38,7 +38,7 @@ jobs:
 
   l3:
     name: L3 managed Chromium + WebKit + build
-    uses: nocoo/base-ci/.github/workflows/test-job.yml@ad43150de3a2be2fa464b5cd2f921dc4fa9f8f0f
+    uses: nocoo/base-ci/.github/workflows/test-job.yml@0394178ebcff0418c442d84a84119220f31f8987 # v2026.9
     with:
       runtime-version: "1.3.14"
       install-policy: "trusted"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88a9330..81db8e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'success')
-    uses: nocoo/base-ci/.github/workflows/deploy-worker.yml@ad43150de3a2be2fa464b5cd2f921dc4fa9f8f0f
+    uses: nocoo/base-ci/.github/workflows/deploy-worker.yml@0394178ebcff0418c442d84a84119220f31f8987 # v2026.9
     with:
       expected-workflow-path: ".github/workflows/ci.yml"
       expected-workflow-name: "CI"
@@ -37,7 +37,6 @@ jobs:
       runtime-version: "1.3.14"
       install-policy: "blocked"
       build-command: "bun run build"
-      wrangler-version: "4.149.0"
       wrangler-working-directory: "packages/worker"
       d1-migrations: true
       d1-command: "d1 migrations apply xray-db --remote --env production"
diff --git a/scripts/check-wrangler-version-sync.ts b/scripts/check-wrangler-version-sync.ts
index 12e7be1..9d8a1eb 100644
--- a/scripts/check-wrangler-version-sync.ts
+++ b/scripts/check-wrangler-version-sync.ts
@@ -26,9 +26,11 @@ function main(): void {
 	const releaseVersions = [...release.matchAll(/^\s+wrangler-version:\s*"([^"]+)"\s*$/gm)].map(
 		(match) => match[1],
 	);
-	if (releaseVersions.length !== 1 || !releaseVersions[0]) {
-		throw new Error("Release workflow must declare exactly one wrangler-version.");
+	// base-ci v2026.9 derives Wrangler from the lockfile; an explicit pin is optional.
+	if (releaseVersions.length > 1) {
+		throw new Error("Release workflow must declare at most one wrangler-version.");
 	}
+	const releaseVersion = releaseVersions[0] ?? "lockfile";
 
 	const manifestVersion = workerPackage.devDependencies?.wrangler;
 	if (!manifestVersion) throw new Error("Worker package must declare a Wrangler devDependency.");
@@ -49,10 +51,11 @@ function main(): void {
 		"resolved Wrangler package in bun.lock",
 	);
 
-	const versions = [releaseVersions[0], manifestVersion, lockedWorkspaceVersion, resolvedVersion];
+	const versions = [manifestVersion, lockedWorkspaceVersion, resolvedVersion];
+	if (releaseVersion !== "lockfile") versions.push(releaseVersion);
 	if (!versions.every((version) => version === manifestVersion)) {
 		throw new Error(
-			`Wrangler version mismatch: release=${releaseVersions[0]}, manifest=${manifestVersion}, ` +
+			`Wrangler version mismatch: release=${releaseVersion}, manifest=${manifestVersion}, ` +
 				`workspace-lock=${lockedWorkspaceVersion}, resolved-lock=${resolvedVersion}.`,
 		);
 	}