diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 359cd43..df4fb7e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -48,13 +48,17 @@ jobs:
           set -euo pipefail
           mkdir -p "$HOME/.local/bin"
           arch="$(uname -m)"
+          # nextest names its Linux builds "linux" and "linux-arm"; a target
+          # triple here is a 404, and `curl -fsSL | tar` would fail obscurely.
           case "$arch" in
-            x86_64) nextest_arch=x86_64-unknown-linux-gnu; deny_arch=x86_64-unknown-linux-musl ;;
-            aarch64) nextest_arch=aarch64-unknown-linux-gnu; deny_arch=aarch64-unknown-linux-musl ;;
+            x86_64) nextest_slug=linux; deny_arch=x86_64-unknown-linux-musl ;;
+            aarch64) nextest_slug=linux-arm; deny_arch=aarch64-unknown-linux-musl ;;
             *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
           esac
-          curl -fsSL "https://get.nexte.st/latest/$nextest_arch" | tar zxf - -C "$HOME/.local/bin"
-          deny_version=0.18.6
+          curl -fsSL "https://get.nexte.st/latest/$nextest_slug" | tar zxf - -C "$HOME/.local/bin"
+          # Pinned, and pinned to what a developer on this project actually runs,
+          # so a licence or source verdict cannot differ between CI and a laptop.
+          deny_version=0.20.2
           curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
             | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
@@ -128,13 +132,17 @@ jobs:
           set -euo pipefail
           mkdir -p "$HOME/.local/bin"
           arch="$(uname -m)"
+          # nextest names its Linux builds "linux" and "linux-arm"; a target
+          # triple here is a 404, and `curl -fsSL | tar` would fail obscurely.
           case "$arch" in
-            x86_64) nextest_arch=x86_64-unknown-linux-gnu; deny_arch=x86_64-unknown-linux-musl ;;
-            aarch64) nextest_arch=aarch64-unknown-linux-gnu; deny_arch=aarch64-unknown-linux-musl ;;
+            x86_64) nextest_slug=linux; deny_arch=x86_64-unknown-linux-musl ;;
+            aarch64) nextest_slug=linux-arm; deny_arch=aarch64-unknown-linux-musl ;;
             *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
           esac
-          curl -fsSL "https://get.nexte.st/latest/$nextest_arch" | tar zxf - -C "$HOME/.local/bin"
-          deny_version=0.18.6
+          curl -fsSL "https://get.nexte.st/latest/$nextest_slug" | tar zxf - -C "$HOME/.local/bin"
+          # Pinned, and pinned to what a developer on this project actually runs,
+          # so a licence or source verdict cannot differ between CI and a laptop.
+          deny_version=0.20.2
           curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
             | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"