diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5ccd09..2083939 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,11 @@ on:
   pull_request:
     branches: [main, next, 'release/v2']
 
+env:
+  # Pinned so a blocking API gate is reproducible. Matches the golang.org/x/exp
+  # pseudo-version already in go.mod; bump both together.
+  GORELEASE_VERSION: v0.0.0-20251113190631-e25ba8c21ef6
+
 jobs:
   ci:
     name: Lint & Test
@@ -32,11 +37,20 @@ jobs:
         run: nix develop --command go vet -tags='example integration argo' ./...
 
       - name: API compatibility check
-        # Breaking API changes are intended on `next` (v3 line) — informational there.
-        if: github.ref_name != 'next' && github.base_ref != 'next'
-        run: nix develop --command go run golang.org/x/exp/cmd/gorelease@latest
+        # Breaking API changes are intended on the v3 line, so this gate is
+        # informational wherever `next` is involved and blocking everywhere else:
+        #   - ref_name == 'next'  : pushes to next
+        #   - base_ref == 'next'  : PRs targeting next
+        #   - head_ref == 'next'  : the next -> main v3 release PR. Without this
+        #     clause base_ref is 'main' and the blocking gate fires on the whole
+        #     intended v3 break set, making the release PR unmergeable.
+        if: github.ref_name != 'next' && github.base_ref != 'next' && github.head_ref != 'next'
+        run: nix develop --command go run golang.org/x/exp/cmd/gorelease@${{ env.GORELEASE_VERSION }}
 
       - name: API compatibility report (informational on next)
-        if: github.ref_name == 'next' || github.base_ref == 'next'
+        if: github.ref_name == 'next' || github.base_ref == 'next' || github.head_ref == 'next'
+        # gorelease reports "no baseline version" until the first non-prerelease
+        # /v3 tag exists on main; that is expected for the v3 release PR and is
+        # why this run must not gate the merge.
         continue-on-error: true
-        run: nix develop --command go run golang.org/x/exp/cmd/gorelease@latest
+        run: nix develop --command go run golang.org/x/exp/cmd/gorelease@${{ env.GORELEASE_VERSION }}
diff --git a/.golangci.yml b/.golangci.yml
index e981af5..cb3caf1 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,4 +1,4 @@
-# golangci-lint configuration for github.com/jasoet/pkg/v2
+# golangci-lint configuration for github.com/jasoet/pkg/v3
 # Go utility library with focus on reliability, security, and performance
 
 version: "2"