diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index ed2046922d63..a333688f0344 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -49,7 +49,8 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm install @actions/artifact@6.2.1 bottleneck@2.19.5
+        run: npm ci --package-lock-only=false @actions/artifact bottleneck
+        working-directory: ci/github-script
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ddf9c2d78b2d..0fd3e4acfbc9 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -51,7 +51,8 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm install bottleneck@2.19.5
+        run: npm ci --package-lock-only=false bottleneck
+        working-directory: trusted/ci/github-script
 
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index 09657b8049db..93c6d89e0a5d 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -38,7 +38,8 @@ jobs:
             maintainers/github-teams.json
 
       - name: Install dependencies
-        run: npm install bottleneck@2.19.5
+        run: npm ci --package-lock-only=false bottleneck
+        working-directory: ci/github-script
 
       - name: Synchronise teams
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/ci/github-script/package-lock.json b/ci/github-script/package-lock.json
index 9e354e74ae46..a557931231b6 100644
--- a/ci/github-script/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -4,7 +4,6 @@
   "requires": true,
   "packages": {
     "": {
-      "name": "github-script",
       "dependencies": {
         "@actions/artifact": "6.2.1",
         "@actions/core": "1.10.1",
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index 290ef068e90b..b5fb5e4a586a 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -2,9 +2,7 @@
   "private": true,
   "//": [
     "Keep `@actions/core` and `@actions/github` in sync with",
-    "https://github.com/actions/github-script/blob/main/package.json.",
-    "Keep `@actions/artifact` and `bottleneck` in sync with",
-    "`.github/workflows/bot.yml`."
+    "https://github.com/actions/github-script/blob/main/package.json."
   ],
   "dependencies": {
     "@actions/artifact": "6.2.1",
diff --git a/ci/pinned.json b/ci/pinned.json
index 0b3d817d1b06..6f50e7e09f51 100644
--- a/ci/pinned.json
+++ b/ci/pinned.json
@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "6edbf1a6a03e75886a6609c088801a0856449e88",
-      "url": "https://github.com/NixOS/nixpkgs/archive/6edbf1a6a03e75886a6609c088801a0856449e88.tar.gz",
-      "hash": "sha256-0lkauQbtrljJqwtzTCILPAiHAJyMvn6XDo264moDv30="
+      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
+      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
     }
   },
   "version": 8