diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fca421eb..11dcd16a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     name: Lint
@@ -14,7 +18,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
-      - run: pip install ruff
+      - run: pip install -r requirements-dev.txt
+      - run: pip check
       - run: ruff check .
 
   typecheck:
@@ -25,7 +30,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
-      - run: pip install pyright pyyaml anthropic mcp pytest
+      - run: pip install -r requirements-dev.txt
+      - run: pip check
       - run: pyright
 
   test:
@@ -36,5 +42,6 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
-      - run: pip install pytest pyyaml anthropic
+      - run: pip install -r requirements-dev.txt
+      - run: pip check
       - run: pytest plugins/
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 00000000..2e8da162
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,30 @@
+# Pinned dev/CI dependencies for claude-plugins.
+#
+# Installed in every CI job via `pip install -r requirements-dev.txt`, then
+# validated with `pip check` to guard against broken dependency graphs.
+#
+# Bumped manually. To regenerate:
+#
+#   python3.13 -m venv /tmp/claude-plugins-lockfile
+#   /tmp/claude-plugins-lockfile/bin/pip install --upgrade pip
+#   /tmp/claude-plugins-lockfile/bin/pip install ruff pyright pytest pyyaml anthropic mcp
+#   /tmp/claude-plugins-lockfile/bin/pip freeze
+#
+# Then update the pinned direct dependencies below. Transitive dependencies
+# are resolved by pip at install time; `pip check` verifies the resolved graph
+# is internally consistent.
+#
+# Direct dependencies used by CI jobs:
+#   - ruff:     linting (lint job)
+#   - pyright:  type checking (typecheck job)
+#   - pytest:   test runner (test / contract-tests / quarantine jobs)
+#   - pyyaml:   YAML parsing in plugin tools + tests
+#   - anthropic: Anthropic SDK (imported by plugin code under test)
+#   - mcp:      MCP SDK (imported by plugin code under test)
+
+anthropic==0.92.0
+mcp==1.27.0
+pyright==1.1.408
+pytest==9.0.3
+PyYAML==6.0.3
+ruff==0.15.9