diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ba9be7b0d8..4985478dd2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -327,13 +327,13 @@ jobs:
       - name: Set up mise tools
         uses: ./.github/actions/setup-mise
         with:
-          install-args: "go node pnpm helm actionlint aqua:crate-ci/typos"
+          install-args: "go node pnpm helm aqua:crate-ci/typos"
 
       - name: Install pnpm dependencies
         uses: ./.github/actions/pnpm-install
 
       - name: Install Go mise tools
-        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/golangci/golangci-lint/cmd/golangci-lint go:github.com/coder/paralleltestctx/cmd/paralleltestctx
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/golangci/golangci-lint/cmd/golangci-lint go:github.com/coder/paralleltestctx/cmd/paralleltestctx go:github.com/rhysd/actionlint/cmd/actionlint
 
       - name: Get golangci-lint cache dir
         run: |
@@ -410,7 +410,10 @@ jobs:
       - name: Set up mise tools
         uses: ./.github/actions/setup-mise
         with:
-          install-args: "actionlint zizmor"
+          install-args: "go zizmor"
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/rhysd/actionlint/cmd/actionlint
 
       - name: make lint/actions
         run: make --output-sync=line -j lint/actions
diff --git a/Makefile b/Makefile
index fd1af317c6..25e4a964b7 100644
--- a/Makefile
+++ b/Makefile
@@ -790,7 +790,7 @@ lint/actions: lint/actions/actionlint lint/actions/zizmor
 .PHONY: lint/actions
 
 lint/actions/actionlint:
-	mise exec actionlint -- actionlint
+	mise exec "go:github.com/rhysd/actionlint/cmd/actionlint" -- actionlint
 .PHONY: lint/actions/actionlint
 
 # zizmor uses GH_TOKEN to fetch imported workflows from GitHub; without it,
diff --git a/mise.lock b/mise.lock
index b96d6b9ae6..1e12256c64 100644
--- a/mise.lock
+++ b/mise.lock
@@ -1,53 +1,5 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
 
-[[tools.actionlint]]
-version = "1.7.10"
-backend = "aqua:rhysd/actionlint"
-
-[tools.actionlint."platforms.linux-arm64"]
-checksum = "sha256:cd3dfe5f66887ec6b987752d8d9614e59fd22f39415c5ad9f28374623f41773a"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_linux_arm64.tar.gz"
-
-[tools.actionlint."platforms.linux-arm64-musl"]
-checksum = "sha256:cd3dfe5f66887ec6b987752d8d9614e59fd22f39415c5ad9f28374623f41773a"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_linux_arm64.tar.gz"
-
-[tools.actionlint."platforms.linux-x64"]
-checksum = "sha256:f4c76b71db5755a713e6055cbb0857ed07e103e028bda117817660ebadb4386f"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_linux_amd64.tar.gz"
-
-[tools.actionlint."platforms.linux-x64-baseline"]
-checksum = "sha256:f4c76b71db5755a713e6055cbb0857ed07e103e028bda117817660ebadb4386f"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_linux_amd64.tar.gz"
-
-[tools.actionlint."platforms.linux-x64-musl"]
-checksum = "sha256:f4c76b71db5755a713e6055cbb0857ed07e103e028bda117817660ebadb4386f"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_linux_amd64.tar.gz"
-
-[tools.actionlint."platforms.linux-x64-musl-baseline"]
-checksum = "sha256:f4c76b71db5755a713e6055cbb0857ed07e103e028bda117817660ebadb4386f"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_linux_amd64.tar.gz"
-
-[tools.actionlint."platforms.macos-arm64"]
-checksum = "sha256:004ca87b367b37f4d75c55ab6cf80f9b8c043adbfbd440f31c604d417939c442"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_darwin_arm64.tar.gz"
-
-[tools.actionlint."platforms.macos-x64"]
-checksum = "sha256:16782c41f2af264db80f855ee5d09164ca98fc78edf3bcd0f46eecff279682ba"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_darwin_amd64.tar.gz"
-
-[tools.actionlint."platforms.macos-x64-baseline"]
-checksum = "sha256:16782c41f2af264db80f855ee5d09164ca98fc78edf3bcd0f46eecff279682ba"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_darwin_amd64.tar.gz"
-
-[tools.actionlint."platforms.windows-x64"]
-checksum = "sha256:283467f9d6202a8cb8c00ad8dd0ee4e685b71fb86a6a56c68fcbb9ae8ed91237"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_windows_amd64.zip"
-
-[tools.actionlint."platforms.windows-x64-baseline"]
-checksum = "sha256:283467f9d6202a8cb8c00ad8dd0ee4e685b71fb86a6a56c68fcbb9ae8ed91237"
-url = "https://github.com/rhysd/actionlint/releases/download/v1.7.10/actionlint_1.7.10_windows_amd64.zip"
-
 [[tools."aqua:ahmetb/kubectx/kubens"]]
 version = "0.9.4"
 backend = "aqua:ahmetb/kubectx/kubens"
@@ -560,6 +512,10 @@ backend = "go:github.com/mikefarah/yq/v4"
 version = "v0.3.13"
 backend = "go:github.com/quasilyte/go-ruleguard/cmd/ruleguard"
 
+[[tools."go:github.com/rhysd/actionlint/cmd/actionlint"]]
+version = "011a6d15e749bb3f2d771eed9c7aa0e7e3e10ee7"
+backend = "go:github.com/rhysd/actionlint/cmd/actionlint"
+
 [[tools."go:github.com/slsyy/mtimehash/cmd/mtimehash"]]
 version = "1.0.0"
 backend = "go:github.com/slsyy/mtimehash/cmd/mtimehash"
diff --git a/mise.toml b/mise.toml
index db02df3a16..64a7ddb016 100644
--- a/mise.toml
+++ b/mise.toml
@@ -40,7 +40,15 @@ protoc-gen-go = "1.30.0"
 "go:mvdan.cc/sh/v3/cmd/shfmt" = "v3.12.0"
 
 # Infrastructure, release, and lint CLIs.
-actionlint = "1.7.10"
+# Source build: no release (latest v1.7.12) carries rhysd/actionlint#651, which
+# fixes a shellcheck-integration deadlock that hangs pre-commit hooks. Switch
+# back to a released `actionlint = "1.7.x"` pin once the fix ships.
+# A `[tool_alias]` would keep the short `actionlint` name, but `mise install
+# --locked actionlint` then fails with "No lockfile URL found": go-backend tools
+# record no URL in the lockfile, and aliasing makes `--locked` require one. Keep
+# the full backend key here and at call sites. Consequence: `mise exec
+# actionlint` resolves to the aqua release, so always use the full key.
+"go:github.com/rhysd/actionlint/cmd/actionlint" = "011a6d15e749bb3f2d771eed9c7aa0e7e3e10ee7"
 "aqua:ahmetb/kubectx/kubens" = "0.9.4"
 cosign = "2.4.3"
 # crane is the registry client `mise oci push` shells out to. Sourced