diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02d8c06..08a9c8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,11 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      - uses: pnpm/action-setup@v4
+
+      # 検証用: 公開から3日未満のリリース (v4.5.1 は 2026-07-24 公開)。if: false なので実行はされない
+      - if: ${{ false }}
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/docker-compose.yml b/docker-compose.yml
index 831eeb6..41838a1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   mariadb:
-    image: mariadb:11@sha256:efb4959ef2c835cd735dbc388eb9ad6aab0c78dd64febcd51bc17481111890c4
+    image: mariadb:11
     restart: unless-stopped
     ports:
       - "3306:3306"
diff --git a/tools/cooldown-demo/package.json b/tools/cooldown-demo/package.json
new file mode 100644
index 0000000..b05c38d
--- /dev/null
+++ b/tools/cooldown-demo/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "cooldown-demo",
+  "private": true,
+  "description": "検証用: 公開から7日未満の npm パッケージを厳密指定 (renovate@43.280.2 は 2026-07-24 公開)。pnpm workspace 外なので install はされない",
+  "dependencies": {
+    "renovate": "43.280.2"
+  }
+}