diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 91a4a52..e77d4d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,13 +19,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v31
+        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31
 
       - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v7
+        uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7
         with:
           primary-key: nix-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.nix', 'flake.lock', 'Cargo.lock', 'Cargo.toml') }}-${{ hashFiles('crates/**', 'scripts/**', 'install.sh', 'README.md', 'LICENSE') }}
           restore-prefixes-first-match: |
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Test install.sh with sh
         run: scripts/install-sh-test.sh
diff --git a/scripts/build-latest-ownership-snapshot.sh b/scripts/build-latest-ownership-snapshot.sh
index 0641f25..c09fd75 100755
--- a/scripts/build-latest-ownership-snapshot.sh
+++ b/scripts/build-latest-ownership-snapshot.sh
@@ -126,6 +126,16 @@ if ! command -v jq >/dev/null 2>&1; then
     echo "jq is required for manifest/source metadata processing" >&2
     exit 1
 fi
+# NUL-separated discovery fields need jq 1.7 (--raw-output0) and bash 4.4
+# (mapfile -d); the packaged publisher provides both.
+if ! jq --raw-output0 -n '"x"' >/dev/null 2>&1; then
+    echo "jq 1.7 or newer is required (for --raw-output0); found $(jq --version 2>&1)" >&2
+    exit 1
+fi
+if ((BASH_VERSINFO[0] < 4 || (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 4))); then
+    echo "bash 4.4 or newer is required (for mapfile -d); found ${BASH_VERSION}" >&2
+    exit 1
+fi
 
 if ! "$IDX_BIN" version >/dev/null 2>&1; then
     echo "failed to run idx binary: $IDX_BIN" >&2